Voice For Locals Business App
Privacy Policy
Effective Date: 28 September 2026
1. Introduction
Voice For Locals ("Voice For Locals", "VFL", "we", "our", or "us") is committed to protecting your privacy and handling your personal information fairly, transparently, and in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable privacy laws.
This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use the Voice For Locals Business mobile application (the "App") and related services. It applies specifically to business owners, authorised staff, and till assistants using the App and supplements our general website privacy policy at voiceforlocals.co.uk/privacy.
Please read this policy carefully. By creating an account or using the App, you acknowledge that you have read and understood this Privacy Policy.
2. Data Controller
Voice For Locals is the Data Controller responsible for your personal information.
Voice For Locals
Office 7, 35–37 Ludgate HillLondon EC4M 7JN
United Kingdom
Email: support@voiceforlocals.co.uk
If you have any questions about this Privacy Policy or how we process your personal information, please contact us using the details above.
3. Who This Policy Applies To
This Privacy Policy applies to:
- Business owners and authorised representatives aged 18 or over
- Till assistants and staff members granted access through the App
- Sole traders, partnerships, and limited companies registered on the platform
The App is not intended for anyone under 18. We do not knowingly collect personal information from children.
4. Personal Information We Collect
4.1 Business Owner and Account Information
- First name, last name, and contact name
- Email address
- Mobile telephone number (where provided)
- One-time password (OTP) verification records
- Google Sign-In account identifier (when you sign in with Google)
- Apple Sign-In account identifier (when you sign in with Apple)
- Internal user ID and account role (owner, assistant, etc.)
- Login history and session tokens
We do not receive your Google or Apple account passwords.
4.2 Owner Personal Details
- Gender
- Nationality
- Ethnicity
We collect ethnicity as special category personal data with your explicit consent at the point of collection. This helps us understand the diversity of business owners on the platform and deliver inclusive support. You may withdraw consent at any time.
4.3 Sole Trader Information
If you register as a sole trader, we may collect:
- National Insurance (NI) number — required for identity verification and regulatory compliance
- Trading name and business address
NI numbers are classified as sensitive personal information. We process them under legal obligation and performance of a contract for business verification purposes. They are stored securely and are not shared with other businesses.
4.4 Business Profile Information
- Business name, trading name, and description
- Business category and subcategories
- Business logo and photographs
- Product and promotional images
- Opening hours and contact details
- Business address and geolocation coordinates
- Website and social media links
- Companies House registration details (where applicable)
- VAT number (where applicable)
4.5 Companies House Data
For limited companies, we retrieve publicly available company information from Companies House via our backend systems to verify your business registration. This may include:
- Company name and registration number
- Registered office address
- Company status and officer names (public record)
We do not store Companies House credentials; lookups are performed server-side on your behalf.
4.6 Google Business Profile Linking
If you link your Google Business Profile, we collect:
- Google Place ID
- Business name, address, and coordinates as returned by Google Places
- Opening hours and category data (where available)
This linking is optional and requires your explicit action in the App. Data is retrieved via Google Maps/Places APIs.
4.7 Payment, Subscription, and Wallet Information
- Stripe Connect account identifier and onboarding status
- Subscription plan, billing cycle, and payment status
- Wallet balance and credit transactions
- Transaction history (payments received from shoppers, subscription charges, top-ups)
- Payout records
- VAT and invoicing information (where applicable)
Full payment card numbers are not stored by Voice For Locals. Card details are entered directly into Stripe's secure payment interface.
4.8 Clover POS Integration
If you connect a Clover point-of-sale terminal, we collect:
- Clover merchant/device identifier
- Device connection status
- Order and transaction sync data from your Clover terminal
This data is used to reconcile in-store orders with Voice For Locals loyalty and payment records.
4.9 Campaign and Reward Information
- Reward and voucher configurations (discounts, validity periods, audience criteria)
- Campaign audience targeting preferences (demographics, location radius, audience profiles)
- AI-generated reward images and descriptions (see Section 6.4)
- Voucher QR codes and redemption records
- Campaign performance metrics
4.10 Live Shopper Heatmap Data
When you use campaign features with live audience targeting, our systems provide a near-real-time heatmap of shopper activity near your business. This heatmap:
- Shows aggregated GPS coordinates of Voice For Locals shoppers who have Live Mode enabled
- Covers shoppers within approximately 0.6 miles (1 km) of your business
- Reflects activity within a rolling window of approximately 4 minutes
- Does not display shopper names or individual identities in the heatmap view
Important: While the heatmap itself is anonymised, separate redemption reports and transaction records may show the names of consumers who have redeemed vouchers or made payments at your business.
This feature processes location data of other users (shoppers). We disclose this to shoppers in the Shoppers App Privacy Policy and rely on their consent to Live Mode for this processing.
4.11 Voucher Scanning and Till Operations
- QR code scan records (via device camera)
- Voucher validation and redemption logs
- Till assistant activity (who scanned, when, outcome)
- Assistant account details (name, email, role)
4.12 Feedback and Reviews
- Consumer reviews, ratings, and feedback displayed on your business dashboard
- Consumer names and profile photos associated with public reviews
- Your responses to reviews (where applicable)
4.13 Partner Search and Network Data
- Partner business search queries
- Cross-promotion and referral relationships with other businesses
4.14 Notifications
- In-app notification inbox messages (campaign alerts, system announcements, payment notifications)
- Notification read/unread status
The Business App does not use a push notification SDK. Notifications are delivered through an in-app inbox polled from our servers.
4.15 Monthly Statements
- Generated monthly statement data (transaction summaries, fees, credits)
- Export and share actions (PDF/CSV generation on device)
4.16 Device and Technical Information
- Device type and operating system
- App version
- IP address
- Session tokens (stored in device secure storage and local storage)
We do not collect advertising identifiers or use cross-app tracking.
4.17 AI-Generated Content Inputs
When you use our AI image generation feature, we collect:
- Text prompts and reward descriptions you provide
- Selected style/category parameters
- Generated images returned by the service
5. How We Collect Information
We collect personal information when you:
- Create an account or sign in (email OTP, Google Sign-In, or Apple Sign-In)
- Complete business onboarding and profile setup
- Link your Google Business Profile or Companies House registration
- Connect Stripe or Clover
- Create rewards, campaigns, or vouchers
- Scan voucher QR codes
- View the live shopper heatmap
- Access the feedback dashboard
- Search for partner businesses
- Add till assistants
- Export or share monthly statements
- Delete your account
- Contact customer support
6. How We Use Your Information
6.1 Account and Business Management
- Create and manage your business account
- Verify your identity and business registration
- Authenticate till assistants
- Maintain your business profile on the Voice For Locals platform
6.2 Payments and Subscriptions
- Process subscription payments and wallet top-ups via Stripe
- Manage Stripe Connect payouts to your bank account
- Generate invoices, monthly statements, and financial reports
- Reconcile Clover POS transactions
6.3 Rewards and Campaigns
- Publish rewards and vouchers to shoppers
- Target campaigns to audience segments based on demographics, location, and preferences
- Display live shopper heatmaps for campaign planning
- Track redemption rates and campaign performance
6.4 AI Image Generation
We use Google Gemini (server-side, via our backend) to generate promotional reward images based on your text prompts and parameters. Your prompts are sent to our servers and processed by Google's generative AI service solely to produce the requested image.
- AI-generated content may not always be accurate or suitable — you are responsible for reviewing content before publishing
- We do not use your prompts to train AI models for unrelated purposes
- Generated images are stored as part of your reward/campaign records
6.5 Shopper Interaction Data
- Display consumer reviews and feedback on your dashboard
- Show redemption and transaction reports (including consumer names where applicable)
- Enable voucher validation via QR scanning
6.6 Communications
- Deliver in-app notifications about campaigns, payments, and account activity
- Send service announcements and security alerts via email
6.7 Safety, Security, and Legal Compliance
- Verify business legitimacy (Companies House, NI number for sole traders)
- Detect fraud and abuse
- Comply with legal and tax obligations
- Respond to data subject requests
7. What We Do Not Do
- We do not sell your personal information to third parties
- We do not display third-party advertising in the App
- We do not use your data for cross-app or cross-site tracking
- We do not send push notifications via FCM/APNs (in-app inbox only)
- We do not share your NI number or ethnicity with other businesses
8. Lawful Basis for Processing
| Processing activity | Lawful basis |
|---|---|
| Account creation and core App functionality | Performance of a contract |
| Business verification (Companies House, NI number) | Legal obligation; Performance of a contract |
| Stripe Connect and payment processing | Performance of a contract; Legal obligation |
| Ethnicity | Explicit consent (special category data) |
| Google Business linking | Consent |
| AI image generation | Performance of a contract ( delivering requested feature) |
| Live shopper heatmap (processing shopper location data) | Legitimate interests (providing campaign tools to businesses; shoppers consent separately via Live Mode) |
| Public display of consumer reviews on your dashboard | Legitimate interests (operating a review platform) |
| Clover POS sync | Performance of a contract |
| Fraud prevention | Legitimate interests |
| Monthly statements and tax records | Legal obligation; Performance of a contract |
9. Sharing Your Information
| Recipient | Purpose | Data shared |
|---|---|---|
| Sign-In authentication; Maps/Places API; Gemini AI (server-side) | Account identifier, Place ID, AI prompts | |
| Apple | Sign-In authentication | Account identifier |
| Stripe | Connect onboarding, subscriptions, wallet, payouts | Business and payment data, Stripe account ID |
| Clover | POS integration and order sync | Merchant/device ID, transaction data |
| Companies House | Business verification (via VFL backend) | Company registration number |
| Google Cloud | Cloud hosting and infrastructure | All platform data (encrypted) |
| Voice For Locals shoppers | Public business profile, rewards | Business name, address, photos, offers, reviews |
| Till assistants | Voucher scanning operations | As authorised by business owner |
| Professional advisers | Legal, accounting, technical advice | As required |
| Regulators or law enforcement | Legal compliance | As required by law |
10. International Transfers
Our platform is hosted on Google Cloud infrastructure. Where personal information is transferred outside the United Kingdom, we ensure appropriate safeguards including UK International Data Transfer Agreements or equivalent mechanisms.
Stripe, Google, Apple, and Clover may process data in the United States and other countries under their respective data protection frameworks.
11. Data Retention
We retain personal information for as long as necessary to:
- Provide the App and related services
- Maintain financial, tax, and transaction records
- Resolve disputes and enforce agreements
- Comply with legal obligations
Account deletion: You may delete your account in the App (Profile → Delete Account). Deletion requires OTP verification. Upon confirmed deletion:
- Your account enters a deletion process, typically completed within 30 days
- You will be warned if you have outstanding wallet credits that will be forfeited
- Business profile content is removed from public display
- Financial records required for legal compliance may be retained in anonymised or pseudonymised form
- Till assistant accounts associated with your business are deactivated
12. Security
We implement appropriate technical and organisational measures, including:
- HTTPS/TLS encryption for all data in transit
- Secure authentication (OTP, OAuth via Google/Apple)
- Access controls and role-based permissions
- Secure cloud infrastructure (Google Cloud)
- PCI-compliant payment processing via Stripe
Known improvement area: On Android, the App currently has allowBackup="true", which may allow session tokens stored in local storage to be included in device backups. We recommend disabling backup for sensitive data or migrating tokens to encrypted storage (see store submission guide).
13. Your Rights
Under UK GDPR, you have the right to:
- Access your personal information
- Rectify inaccurate information
- Erase your information (via in-app account deletion)
- Restrict processing in certain circumstances
- Object to processing based on legitimate interests
- Withdraw consent (for consent-based processing)
- Data portability
- Lodge a complaint with the ICO at ico.org.uk
Contact us at support@voiceforlocals.co.uk to exercise your rights.
14. Till Assistants
Business owners may invite till assistants to scan vouchers. Assistants receive limited access scoped to voucher scanning. Business owners are responsible for ensuring assistants use the App appropriately. Assistant activity is logged for audit purposes.
15. Consumer Data You Receive
Through the App, you may receive personal information about consumers (e.g. names on redemption reports, review authors). You are an independent controller or joint controller (depending on context) of any consumer data you download, export, or use outside the App. You must handle such data in compliance with UK GDPR and only for legitimate business purposes related to the Voice For Locals platform.
16. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. The latest version will be available in the App and on our website. Material changes will be communicated via the App or email.
17. Contact Us
Voice For Locals
Office 7, 35–37 Ludgate HillLondon EC4M 7JN
United Kingdom
Email: support@voiceforlocals.co.uk