Privacy Policy

Last updated: 17 October 2026

Voltara HQ Ltd (“Voltara”, “we”, “us”) builds capture-first compliance software for field engineering. This policy explains the personal data we process when you use Voltara — in particular when you connect an email mailbox so we can match regulator, certifier, and customer replies to the right job — and the rights you have over it. Voltara HQ Ltd (UK company number 17211528) is the data controller.

The data we access when you connect a mailbox

When you connect a Microsoft or Google mailbox, Voltara reads only your Inbox (the Microsoft Inbox folder, or the Gmail INBOX label). We never read other folders or labels such as Sent or Drafts, and we are read-only — Voltara never sends, deletes, or modifies mail on your behalf. Specifically, we process:

• Inbox messages — message metadata (subject, sender, recipients, timestamps), body text and HTML, and attachments. Attachments are kept as part of the original message; Voltara does not analyse them.
• Identity from your provider — a stable account identifier and your primary email address (and, for Google Workspace, your hosted-domain; for Microsoft, your tenant identifier). These let us recognise your mailbox when you sign in again. We ask your provider for your basic profile so it can identify the mailbox, but keep only these identifiers. We never receive or store your password.
• A refresh token — stored encrypted, used only to obtain fresh access tokens so background sync keeps working.
• Extracted compliance fields — details such as an application reference, an MPAN, a postcode or an MCS certificate number, used to match the message to the correct job, and, for mail read by AI, a hint such as a customer’s email address, kept with the message record.
• Senders you trust — if you choose to trust a sender, their exact email address, whether they are the job’s customer, and when you added them. This list is kept unencrypted (so incoming mail can be matched against it), readable only by you and our servers. It is deleted when you remove the sender, when you disconnect your last mailbox, or when your account is deleted.
• A record of your consent (which version of the connect notice you agreed to, for which provider, and when). We no longer record your IP address in this record; an older record may still hold one until you next connect a mailbox.

Which messages Voltara keeps

Our servers look at each new message in your Inbox to decide whether it is job correspondence. When you first connect, they also look back over the last 90 days for mail from our built-in known senders. Voltara keeps a message only if it comes from a known sender, or mentions something that looks like a job reference: a network operator application reference, a 13-digit number that could be a meter number (MPAN), an MCS certificate number, or any UK postcode, so a postcode in an unrelated email can cause it to be kept. Known senders are our built-in list (the six GB network operator groups, Energy Networks Association’s Connect Direct service and MCS) plus your account’s own list: any sender you choose to trust (one exact email address at a time, from an email Voltara has matched to one of your jobs) and any that our team adds for you. Everything else is dropped and not saved, including automatic replies and mailing-list or marketing mail from unknown senders. Only a record that the message was seen (the mail provider’s message ID) is kept, with a short reason code for why it was dropped.

Why we use it, and our legal basis

We use this data to provide the Connected Inbox: filing incoming correspondence from DNOs, certification bodies, SEG providers, wholesalers, and your customers onto the right job in your Voltara workspace, so your compliance record stays complete without manual filing; and, when you ask, drafting a reply for you to review and send yourself from your own mail client. Voltara never sends email for you. Our lawful bases under UK GDPR are Article 6(1)(b) (performance of our contract with you) and Article 6(1)(f) (our legitimate interest in operating the platform). Where we rely on your consent, such as when you connect a mailbox, you can withdraw it at any time by disconnecting in Settings.

How AI is used

When our rule-based parsers can’t read a message from a known sender (see above) and your mail provider has not flagged it as a likely forgery, we send its sender, subject and up to 6,000 characters of its body text to Anthropic, our AI processor, to extract compliance details such as an application reference or an MPAN. Mail from a sender you trusted is sent only when it matches one of your jobs and your mail provider confirms it is genuine (it passes the provider’s DMARC check); their other mail is never sent. What the AI reads from it can only be added to the job as evidence when you confirm, never change a compliance status. You can remove a trusted sender at any time in Settings, and disconnecting your last mailbox removes them all. Mail from other senders is never sent for automatic AI extraction; it reaches Anthropic only if you ask for a reply draft. When you ask Voltara to draft a reply, we send up to 4,000 characters of the message body with its sender (or reply-to) address and subject, the name of the job it matched, your name and company, and up to 800 characters of the details already extracted. HTML and attachments are never sent. We guard against instructions hidden in emails (prompt injection) by screening messages and strictly checking what the AI returns, and nothing an AI model reads from your email changes your compliance record until you confirm it. Anthropic may not train its models on this data.

Voltara’s other AI features (voice capture, finance dictation, photo checks, meter photo reading, document import, the compliance assistant and the audit assistant) send what you dictate, photograph or upload for that action to Anthropic, and for some features details from the job such as its name and address. That can include customer names, addresses, meter numbers and photos of a site. Some of them, such as voice dictation, fill job fields as you speak; you can review and change every value. The same Anthropic terms apply, including no training on this data.

How we protect your data

• Encrypted at rest. A message’s text, HTML, subject, sender and headers, and your refresh token, are encrypted with AES-256-GCM using a key unique to your mailbox, which is itself protected by AWS KMS. Stored ciphertext is bound to your mailbox so it cannot be moved or substituted across accounts. The original message file, including any attachments, is kept in a private storage bucket that only Voltara’s servers can reach, encrypted at rest by our storage provider. Some message metadata (the sender’s domain, message identifiers, thread and date) and the compliance details extracted from a message are stored in our database without this extra layer, protected by the database’s own encryption at rest.
• Where your data is processed. Voltara’s server functions run in London (Vercel lhr1); the database and files are in Ireland (Supabase eu-west-1); encryption keys are in London (AWS eu-west-2); error monitoring is in Germany (Sentry). Two processors handle message content outside the UK and EU: Anthropic, which stores data in the United States and may process it in other countries, and Inngest, in the United States. Some of the lookup and voice providers listed below, such as Google, may also process data outside the UK and EU. We rely on the transfer safeguards in each provider’s data processing terms (for Anthropic and Inngest, standard contractual clauses, which are approved international transfer terms, with the UK addendum).
• Least privilege and auditing. We use read-only scopes, and Voltara reads only your Inbox. Viewing message content in Voltara is recorded in an audit log, which you can see in Settings › Privacy (linked from Settings › Inbox).

Other personal data in Voltara

Voltara also holds the details you enter to run your jobs: your account and company details, and for each job the customer’s name, address, contact details and meter number (MPAN), plus the photos, measurements, dictation and documents you capture. We use them only to provide Voltara to you, for example to prepare certificates and, when you ask, to submit applications. We process them because we need them to provide Voltara to you under our contract with you (Article 6(1)(b)). They are stored in our database and file storage in Ireland (Supabase). Voltara uses only the cookies and browser storage it needs to run the app (signing you in, remembering your settings such as dark mode, connecting a mailbox and diagnosing errors), and no advertising or marketing trackers. Voice capture uses your browser’s own speech recognition, and notifications, if you turn them on, use your browser’s push service; both are provided by your browser’s maker under its own terms.

Who we share it with

We do not sell your data and we do not use it for advertising. We share it only with the service providers below, who help run Voltara on our behalf, and with the recipients you tell Voltara to send it to (described after the lists).

Mail providers you connect, and service providers that run the platform

• Google LLC Mail provider (Gmail / Google Workspace mailboxes you connect).
• Microsoft Mail provider (Outlook / Microsoft 365 mailboxes you connect).
• Supabase Encrypted database, sign-in and file storage for your account, jobs and mailbox data (Ireland, eu-west-1).
• Amazon Web Services (KMS) Management of the keys that protect your mailbox data (London, eu-west-2).
• Vercel Application hosting and compute. Our server functions run in London (lhr1).
• Anthropic Ireland, Limited (with Anthropic, PBC) AI processing of limited message content to extract compliance details and, when you ask, to draft a reply, and of what you send to Voltara’s other AI features (dictation, photos and documents). Anthropic stores this data in the United States and may process it in other countries. It may not train its models on it and normally deletes it within 30 days.
• Inngest Runs our background jobs. Message content is encrypted on our servers before it reaches Inngest, so Inngest holds only encrypted content, internal identifiers (such as mailbox and message IDs) and run details in its job history, for a limited period (United States).
• Sentry Operational error monitoring (Germany). Error reports carry your account ID. Email addresses, postcodes, meter numbers and tokens are scrubbed automatically before they are sent, which catches most but not every detail, so a report can still include something like a street address or map position. Any screen recording attached to an error has all text and images masked and may be linked to your account, including your email address and name. If you send feedback from inside Voltara, a copy goes to Sentry with your name, your email address and the page you were on.

Address, property and mapping lookups

When you create a job or open its property card, Voltara’s servers send the property’s address, postcode or map position to these services to fetch addresses, energy certificates, roof and solar data, planning constraints and tariffs. Voltara does not add the customer’s name or contact details to these requests.

• Ideal Postcodes Address search. Receives the address or postcode text you type when you create a job, and the address you choose.
• Ordnance Survey (OS Places and OS NGD) Back-up address search if Ideal Postcodes is unavailable, property reference numbers and building outlines for site plans. Receives the address text, or the property’s map position.
• postcodes.io Turns a postcode into a map position. Receives the postcode (the property’s, or your office’s for a travel-time estimate), and your IP address when your browser asks it directly.
• GOV.UK Energy Performance of Buildings Data service Energy certificate (EPC) lookup. Receives the property’s postcode, or its unique property reference number (UPRN).
• Google Maps Platform (Solar API, Static Maps, Street View, Distance Matrix) Roof and solar potential, satellite and street imagery, and travel-time estimates. Receives the property’s map position and, for the travel-time estimate, your starting point (your phone’s location if you allow it, otherwise your office postcode’s position).
• European Commission PVGIS Solar yield estimates. Receives the property’s map position and the system size, roof angle and roof direction you entered.
• GOV.UK Planning Data Planning constraint checks such as conservation areas. Receives the property’s map position or an area around it.
• Octopus Energy Export tariff lookup. Receives the property’s postcode.
• ElevenLabs Spoken replies. While AI Voice is on (it is on by default; you can switch it off in Settings) and you are using a computer, the text Voltara reads aloud, such as a read-back of what you just dictated or an answer from the compliance assistant, can be sent to ElevenLabs to turn into speech, using our key or one you add in Settings. Phones use your browser’s built-in voice instead.

Where you tell Voltara to send it

When you submit a connection application to an electricity network operator, Voltara sends the application to the operator through Energy Networks Association’s Connect Direct service. It includes the details you entered, such as the customer’s name, address, contact details and meter number (MPAN), your company’s details and your own name, phone number and email address, plus the documents and photos you attach, such as the single line diagram, site plan and meter cutout photo. You start each submission; Voltara may retry one that failed and send later updates to the same application, such as commissioning details. The operator and Energy Networks Association handle that data under their own privacy notices.

If you connect your own Easy PV account and choose Push to Easy PV, Voltara sends that job’s name and reference, the customer’s name, address, postcode and contact details, and your email address, to Easy PV, which handles them under its own terms.

If you share a customer portal link, the customer can see their job’s progress, address and your contact details, and can send you messages, their meter number and feedback. Anyone who has the link can open it, so send it only to the customer.

How long we keep it

• Raw message content (the original email file, its attachments, and the encrypted sender, subject, body and headers) is deleted automatically 12 months after the message arrives, except emails you have added to a job as evidence (see below). Non-content details are kept until you disconnect the mailbox or delete your account: the sender’s domain, message identifiers, thread, dates, a content hash, and whether the message was matched to a job.
• Compliance details extracted from a message are kept while a job they relate to exists, and deleted when that job is deleted. Extracted details not linked to a job are deleted with the raw content.
• Emails you add to a job as evidence, and status updates written to a job’s timeline, become part of that job’s compliance record rather than a copy of your mailbox. They stay with the job for as long as its records are kept, including after you disconnect the mailbox or the 12-month period ends.
• Inbox security and administrative audit logs are kept for up to 7 years. They record when message content was accessed and when a mailbox was disconnected, and contain no message content. Other integration logs are kept for 90 days; records of each message we ingested are kept until you disconnect the mailbox.
• When you disconnect a mailbox, Voltara stops syncing immediately and deletes the messages, files, attachments, extracted details and pending job matches it copied from the mailbox, except emails you have added to a job, along with the stored token and mailbox details. For Google, it also revokes its access; if Google cannot be reached, we keep only the mailbox address, your Google account identifier and the encrypted refresh token with its encrypted key (no email content), and retry daily for up to 30 days, after which those details are deleted too. If any part of a deletion fails, we retry daily until it is done. Microsoft does not support an app revoking its own access, so for Microsoft we delete our stored token and subscription; remove Voltara from your Microsoft account to withdraw consent there too.
• Job records (customer details, photos, measurements and documents) are kept while your account is open. Saved documents and evidence on a job are kept as part of its compliance record, so a job that holds them can be archived but not deleted from inside Voltara. If you ask us to delete your account, we delete it and the data held with it, except anything we are required to keep by law.
• Copies held by our processors are deleted on their own schedules: Anthropic normally within 30 days, Inngest when its job history expires, Sentry when its error history expires, and database backups on our provider’s backup cycle.

Your rights

Under UK GDPR you have the right to access, correct, erase, restrict, port, and object to our processing of your personal data. You can disconnect a mailbox at any time from Settings › Inbox; our guide to managing and deleting your inbox data explains exactly what is deleted. You can also remove Voltara’s access from your Google Account or your Microsoft account (personal or work or school); that stops syncing, and to delete what is already stored, disconnect in Voltara or email us. To delete your Voltara account, email us from the address you sign in with; we will delete it and the data held with it, except anything we are required to keep by law, and respond within one month. You can exercise any of these rights by emailing privacy@voltarahq.com. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk.

Changes and contact

We may update this policy as the product evolves; we will revise the “last updated” date above when we do. For any privacy question, contact Voltara HQ Ltd (company number 17211528; registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ) at privacy@voltarahq.com.