Privacy Policy

For subscriber account data we are the controller. For caller data — the recording, transcript and details of a call to a subscriber's number — the subscriber is the controller and we are their processor, handling it to run the service on their instructions.

If you are a caller and want a call removed, contact the business you rang; they can delete it themselves from their dashboard. You can also contact us and we will pass the request on.

From subscribers: name and email address (from Google sign-in or an emailed link), business name, opening hours, greeting script, the answers you configure, booking link, notification email, and billing status. Card details go to Stripe and are never stored by us.

From callers: the calling number, the time and duration of the call, keypad selections, the audio of the call, a transcript of it, an automated summary, and any details given during the call, such as a name or callback number.

Subscriber data is processed to perform our contract with you and, for service emails, on our legitimate interest in running the service. Caller data is processed on the subscriber's instructions under their own lawful basis — usually their legitimate interest in handling enquiries to their business.

SMS notifications to a subscriber are sent only where that subscriber has opted in. Consent is recorded with a timestamp and IP address, and withdrawing it stops future messages while keeping the record of the consent itself, which we are required to retain as evidence.

• Call recordings, transcripts and summaries: 90 days from the call, then deleted automatically. This is the same for every call — saving a call in the dashboard does not keep it longer.
• Copies a subscriber downloads: a subscriber can download a recording or transcript from their dashboard to keep it for longer. That copy is held by the subscriber, who decides how long to keep it under their own privacy information.
• Deleted by the subscriber: a recording, transcript and summary are deleted immediately when the subscriber deletes the call from their dashboard — the call's date, duration and calling number are kept for usage and billing history.
• After cancellation: call history stays available to export for 30 days, then is deleted. Recordings and transcripts never outlast the 90 days above.
• Consent records: kept as an audit trail, marked withdrawn where applicable.
• Account and billing records: as long as needed for tax and accounting obligations.

We use these providers, each only for its own part of the service: Supabase (database and authentication), Stripe (payments), Resend (transactional email), Vercel (hosting), and telephony and speech providers to carry, transcribe and summarise calls. Each is bound by contract to process data only on our instructions.

Some providers process data outside the UK. Where they do, transfers rely on UK adequacy regulations or standard contractual clauses. We do not sell personal data or use call content for advertising.

You can ask for a copy of your data, its correction or deletion, restriction of processing, or object to it. Subscribers can download and delete call data directly in the dashboard, which handles most requests without waiting on us.

Email [email protected] for anything else. If you are unhappy with how we have handled a request you can complain to the Information Commissioner's Office at ico.org.uk.

Access to call data is restricted to the subscriber's own account and to the staff who need it to operate or support the service. Data is encrypted in transit. Sign-in uses Google or a one-time emailed link, so we never store a password.

Private feedback you send from the Feedback tab in your dashboard is read only by the Canduit team, together with your account email so we can reply. It is never published.

A comment for our website is published only if you tick the box agreeing to it, and only after we have checked it. We keep the exact wording you agreed to, when you agreed, and the IP address you agreed from, as a record of that permission. A photo is optional; your browser shrinks it and removes hidden photo data — including the location a phone records — before it is sent, and it stays private until we approve it. You can remove your comment from the website at any time under Feedback, which also deletes the public copy of your photo. If your account is deleted, your comment, both copies of your photo and your private feedback are deleted with it.

We set one session cookie so you stay signed in, and nothing else. See the Cookie Policy.