Privacy Policy.

1. Data we process

We handle a few different kinds of personal data, depending on the role above.

• Conversation content — messages, comments, email correspondence, and voice-call transcripts exchanged with a concierge.
• Contact identifiers — name, email address, phone number, and channel-specific handles (a WhatsApp number, an Instagram or Messenger user ID).
• Order & account data — where a client connects their store or order system, order history, shipment status, and related details needed to answer a question.
• Technical data — IP address, device and browser information, and timestamps, collected automatically by the channel itself (the website widget, WhatsApp, and so on).
• Vocero client & site data — for people who work at a client, request a demo, or contact us directly through vocero.io: name, work email, company, and the content of what you send us.

2. How we use it

• Operating the concierge — understanding and answering questions, using a client’s knowledge base and connected tools (order lookup, shipment tracking, and similar).
• Human handover — letting a member of the client’s team see the conversation, step in, or hand it back to the AI.
• Accuracy review — auditing replies for grounding, fabrication, and policy issues before, or shortly after, they reach a customer.
• Translation — translating messages so a customer and a client’s team can each read and write in their own language.
• Running the service — billing our clients, maintaining security, preventing abuse, and meeting our legal obligations.

We do not sell personal data. We do not use conversation content to train AI models for the benefit of any client other than the one it belongs to — each client’s data is isolated from every other client’s.

3. Channels

A Vocero concierge can currently be reached on a client’s website chat widget, WhatsApp, Facebook Messenger, Instagram, email, and voice. We add and update channels over time as clients enable them; this policy applies to all of them.

4. Subprocessors

We use a small number of specialist providers to deliver the service. Each is bound by a data processing agreement and only handles what it needs to do its job.

5. Where data lives

Our primary data storage is in the EU — Supabase’s eu-central-1 region. Generating a reply necessarily involves sending relevant conversation data to our AI subprocessors, which may process it transiently on servers outside the EU/EEA before returning a result. That processing happens to produce a reply, not to build a separate copy of your data. Where personal data does leave the EU/EEA, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses.

6. Retention

We retain conversation data for as long as we operate the concierge for the relevant client, so their team can see conversation history and we can keep the concierge accurate for them. If a client’s contract ends, or on a specific deletion request, we delete or anonymize the data within a reasonable period, subject to any legal retention requirement (financial records, for example). If you’re an end customer who wants their own conversation deleted, see Data Deletion.

7. Your rights (GDPR)

If you’re an end customer of a business that uses Vocero, that business is your data controller — start with them, or see Data Deletion.

If you’re a Vocero client team member, or you’ve contacted us directly through vocero.io, you can ask us at any time to:

• access the personal data we hold about you
• correct it, if it’s inaccurate
• delete it
• restrict or object to how we use it
• receive a portable copy of it

hola@vocero.io to exercise any of these. If you’re in the EU/EEA and think we haven’t handled your request properly, you also have the right to complain to your local data protection authority — in Spain, the AEPD.

8. Cookies

vocero.io itself doesn’t use advertising or tracking cookies. Once live on a client’s site, the Vocero chat widget uses a strictly necessary session identifier (a cookie or local token) to keep track of an ongoing conversation — it isn’t used to track you across other sites or for advertising.

9. Children

Vocero isn’t directed at children, and we don’t knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we’ll delete it.

10. Changes to this policy

We’ll update this page as Vocero’s channels and processing change, and update the date at the top when we do. Material changes will be flagged to our clients directly.

11. Contact

Questions about this policy, or a request relating to your own data, can go to hola@vocero.io.

Vocero is operated by Coverso S.L. (CIF B19725985), Spain.