Privacy Policy

For subscriber account data we are the controller. For caller data — the recording, transcript and details of a call to a subscriber's number — the subscriber is the controller and we are their processor, handling it to run the service on their instructions.

If you are a caller and want a call removed, contact the business you rang; they can delete it themselves from their dashboard. You can also contact us and we will pass the request on.

From subscribers: name and email address (from Google sign-in or an emailed link), business name, opening hours, greeting script, the answers you configure, booking link, notification email, and billing status. Card details go to Stripe and are never stored by us.

From callers: the calling number, the time and duration of the call, keypad selections, the audio of the call, a transcript of it, an automated summary, and any details given during the call, such as a name or callback number.

Subscriber data is processed to perform our contract with you and, for service emails, on our legitimate interest in running the service. Caller data is processed on the subscriber's instructions under their own lawful basis — usually their legitimate interest in handling enquiries to their business.

SMS notifications to a subscriber are sent only where that subscriber has opted in. Consent is recorded with a timestamp and IP address, and withdrawing it stops future messages while keeping the record of the consent itself, which we are required to retain as evidence.

• Call recordings, transcripts and summaries: while the subscription is active.
• After cancellation: 30 days, so you can export what you need, then deleted.
• Individual transcripts: deleted immediately when a subscriber deletes them from the dashboard — the call's date, duration and number are kept for billing history.
• Consent records: kept as an audit trail, marked withdrawn where applicable.
• Account and billing records: as long as needed for tax and accounting obligations.

We use these providers, each only for its own part of the service: Supabase (database and authentication), Stripe (payments), Resend (transactional email), Vercel (hosting), and telephony and speech providers to carry, transcribe and summarise calls. Each is bound by contract to process data only on our instructions.

Some providers process data outside the UK. Where they do, transfers rely on UK adequacy regulations or standard contractual clauses. We do not sell personal data or use call content for advertising.

You can ask for a copy of your data, its correction or deletion, restriction of processing, or object to it. Subscribers can export and delete call data directly in the dashboard, which handles most requests without waiting on us.

Email [email protected] for anything else. If you are unhappy with how we have handled a request you can complain to the Information Commissioner's Office at ico.org.uk.

Access to call data is restricted to the subscriber's own account and to the staff who need it to operate or support the service. Data is encrypted in transit. Sign-in uses Google or a one-time emailed link, so we never store a password.

We set one session cookie so you stay signed in, and nothing else. See the Cookie Policy.