1. Overview
We are a UK company. Your account, chats and memory are stored on our own servers in the UK, and the images and documents you create or upload are also stored in the UK, so storing them involves no transfer. Emails we send you go through our mail server, and web search queries through our search server, both hosted by Hetzner in Germany. Some of the providers we use are in other countries, mainly the USA, or pass data on to their own providers there.
UK data protection law restricts transfers of personal data outside the UK. This page lists each transfer route, with the country and the data, and the position on safeguards for each. It also sets out where our transfer risk assessments stand.
AI providers are listed by category and country. Their names are available on request from privacy@voltaservices.co.uk, or under a data processing agreement.
2. How transfers are protected
UK data protection law recognises these ways of protecting a transfer:
- Adequacy: the UK recognises some countries as giving adequate protection for personal data, including every EU and EEA country. Transfers to them need no further safeguard.
- UK-US data bridge: transfers to a US organisation certified to the UK Extension of the EU-US Data Privacy Framework are covered by UK adequacy regulations. This applies only to certified organisations, and only while they stay certified.
- Contract safeguards: the UK International Data Transfer Agreement, or the EU standard contractual clauses with the UK Addendum, included in a recipient's data processing terms.
The tables below show which routes use them.
Some recipients, such as GoCardless and Google Play billing, are independent controllers: they decide for themselves how they use your data and are responsible for their own transfers.
3. Transfer routes: named providers
Your account, chats and memory stay on our own servers in the UK, so they are not transferred. The routes below are for data that leaves those servers.
| Provider | What it receives | Where | Safeguard |
|---|---|---|---|
| Hetzner (hosts our mail server) | Every email we send you, such as verification and sign-in emails with their codes and links, multi-factor authentication codes and support replies | Germany | UK adequacy regulations for the EEA |
| Hetzner (hosts our search server) | The web search queries written from your request | Germany | UK adequacy regulations for the EEA |
| Wasabi (file storage) | Images you generate and documents you upload | Stored in the UK. The company is based in the USA | The data stays in the UK. Wasabi's data processing terms include the standard contractual clauses with the UK Addendum |
| Stripe (card payments) | Your email address, name and user ID | Contract with Stripe in Ireland; data processed by Stripe, LLC in the USA | UK-US data bridge, with contract safeguards in Stripe's data processing terms |
| GoCardless (Direct Debit) | Your email address, first name, surname and user ID | UK | Not a transfer by us. GoCardless is an independent controller |
| Google Play billing (purchases in our mobile app) | Google Play handles the purchase. We receive the order reference, purchase token and your country | USA | Independent controller. The company that runs Google Play is certified to the UK-US data bridge |
| Vonage (SMS sign-in codes) | Your phone number and the code | UK company; processing in the UK, EEA and USA | Standard contractual clauses with the UK Addendum. Vonage's US parent company is certified to the UK-US data bridge |
| Postmark (email replies to support tickets) | The sender address, subject, body and attachments of your email replies | USA | UK-US data bridge, through its certified parent company, with contract safeguards in its data processing terms |
| StudID (student verification) | Your institution, affiliation and a pseudonymous identifier | Germany | UK adequacy for the EU |
Web search. When a model searches the web for you, the search queries go from our own search server in Germany to public web search engines, some of them in the USA. The search engines receive only the query text, not your account details or your IP address.
4. Transfer routes: AI providers
| Category | What it receives | Where | Safeguard |
|---|---|---|---|
| AI model provider, EU (Estonia), with onward processing in the EEA and USA | Conversation content for chat and images; web search requests and results; message text for memory search copies; titles, summaries and image analysis when the US provider is unavailable | Estonia, with onward processing in the EEA and USA | UK adequacy for our transfer. The provider's own standard contractual clauses for its onward transfers |
| AI model provider, USA | Conversation content; first choice for titles, summaries and image analysis | USA | Being put in place. We have asked this provider to sign a data processing agreement that includes the UK International Data Transfer Addendum. Until it is signed, transfers on this route are not covered by a UK transfer safeguard |
| AI model router, USA (free models) | Conversation content for the free models it serves | USA, with onward transfer to the providers that serve each model | Standard contractual clauses with the UK Addendum |
| Image model provider, EU (Spain), for some image models | Image prompts | Spain, with onward processing by model hosts in adequate and non-adequate countries | UK adequacy for our transfer. The provider's own standard contractual clauses with its model hosts for its onward transfers |
| Embeddings provider, reached through the EU AI model provider | The text of your messages, to make memory search copies | USA, with a fallback in Sweden | Onward transfer by the EU AI model provider. The embeddings provider is certified to the UK-US data bridge |
When your browser loads an image hosted by an AI provider, that provider receives your IP address. See our cookies page.
Our AI governance page explains in detail what AI providers receive.
5. Transfer risk assessments
We are assessing the risks of each transfer that relies on contract safeguards, following the Information Commission's guidance. Transfers covered by adequacy, including the UK-US data bridge, do not need an assessment while the recipient stays certified. Stripe, LLC's certification is due for renewal by 11 May 2027. The notes below set out the facts we are taking into account for each route.
Wasabi (file storage). Files are stored in the UK, so the transfer risk is access by Wasabi from the USA. Wasabi's data processing terms include the standard contractual clauses with the UK Addendum. Wasabi is not certified to the UK-US data bridge. Our application deletes stored files after 30 days, which limits what is held at any time.
Vonage (SMS sign-in codes). Vonage receives your phone number and a one-time code, and only when you use SMS codes. Processing can take place in the UK, the EEA and the USA. Its data processing terms include the standard contractual clauses with the UK Addendum, and its US parent company is certified to the UK-US data bridge. Vonage keeps SMS logs for up to 1 month and other records for 13 months.
AI model router, USA (free models). The router receives conversation content for the free models it serves. Its data processing terms include the standard contractual clauses with the UK Addendum. It is not certified to the UK-US data bridge. It says it does not store prompts unless the account opts in, and does not train on them itself. We ask our AI model router to send requests only to providers that do not use your prompts for training. It keeps metadata about requests.
AI model provider, USA. This provider receives conversation content and is our first choice for titles, summaries and image analysis. Safeguard: being put in place. We have asked this provider to sign a data processing agreement that includes the UK International Data Transfer Addendum. Until it is signed, transfers on this route are not covered by a UK transfer safeguard. It does not state where it hosts data or whether it trains on content. It keeps submitted content for abuse prevention, without stating a period, and keeps logs. We asked the provider for the agreement in October 2026.
Onward transfers by the EU AI model provider. Our transfer to this provider is covered by UK adequacy. It passes requests on to model hosts in the EEA and the USA under its own standard contractual clauses. It does not use data for training without opt-in, although community providers it uses may differ. It keeps response caches for up to 30 days and usage metadata for about 24 months. We have not yet received a full list of the providers it uses.
Embeddings provider. We reach it through the EU AI model provider. It processes data in the USA, with a fallback in Sweden, and is certified to the UK-US data bridge. It does not use the data for training, and it carries out abuse monitoring in the region where it processes the data.
Onward transfers by the image model provider in Spain. Our transfer is covered by UK adequacy. The provider passes prompts to model hosts in adequate and non-adequate countries. It states that it has standard contractual clauses in place with every model provider it offers, for its transfers outside the EEA. It does not use prompts to train its own models, but may use them for security and to improve its services. It keeps prompts and outputs for the term of its contract, and its model hosts keep them for up to 30 days.
Where the assessments stand.
- Adequacy: our transfers to Hetzner, StudID, the EU AI model provider and the image model provider in Spain go to the EU, which the UK recognises as adequate, so they need no further safeguard.
- UK-US data bridge: Stripe, Google Play billing, Postmark and the embeddings provider rely on the bridge while they stay certified.
- Contract safeguards: for Wasabi, Vonage and the AI model router, our assessments so far conclude that the transfers can continue under the contract safeguards in their data processing terms. For the router, this depends on our asking it to send requests only to providers that do not use your prompts for training.
- Onward transfers: the EU AI model provider and the image model provider in Spain rely on their own standard contractual clauses for their onward transfers. We are still confirming the details of each provider's onward chain.
- AI model provider, USA: pending the data processing agreement we have asked for. Until it is signed, this route is not covered by a UK transfer safeguard.
6. If you are in the EU or EEA
The EU recognises the UK as giving adequate protection for personal data until 27 December 2031. Personal data can therefore flow from the EU and EEA to us in the UK without further safeguards. Onward transfers from us follow the routes on this page.
7. Getting a copy of the safeguards
You can ask for a copy of the transfer safeguards described on this page, or for the names of our AI providers, by writing to privacy@voltaservices.co.uk. We may remove commercially sensitive terms from the copy we send.