Privacy Policy

1. Who We Are

Trade Receptionist Ltd is the data controller for personal data collected directly from Subscribers (business owners who use our service). For personal data collected from callers on behalf of a Subscriber, we act as a data processor — the Subscriber is the data controller for that data.

For questions about this policy or to exercise your rights, contact our privacy team at privacy@tradereceptionist.co.uk.

2. Personal Data We Collect

We collect personal data in two distinct contexts:

2A. Subscriber data (business owners)

When you register and use Trade Receptionist, we collect:

• Name, email address, and phone number
• Business name, trade type, and postcode
• Payment and billing information (processed by Stripe — we do not store card numbers)
• Account preferences and configuration (greetings, availability hours, emergency keywords)
• Usage data (call counts, plan type, login history)

2B. Caller data (collected on behalf of Subscribers)

When the AI receptionist handles an inbound call to a Subscriber's number, we collect and process on the Subscriber's behalf:

• Caller's phone number (CLI)
• Caller's name and postcode (if provided during the call)
• Nature of the job or enquiry
• Urgency level (as classified by the AI)
• Call recording and transcript
• Post-call summary

This data is processed under our Data Processing Agreement with the Subscriber. The Subscriber is responsible for ensuring they have a lawful basis for collecting and processing caller personal data under the UK GDPR.

3. How We Use Personal Data

The table below sets out our purposes and lawful bases for processing Subscriber personal data:

4. Call Recordings and Transcripts

All calls handled by our service are recorded and transcribed using Retell AI to generate call summaries. Our AI receptionist discloses this to callers at the start of each call.

• Call recordings are retained for 90 days and then permanently deleted.
• Transcripts and call summaries are retained for the lifetime of the Subscriber's account, plus 12 months after cancellation.
• Subscribers may request early deletion of specific call records by contacting our support team.

As a Subscriber, you act as a data controller for caller recordings and transcripts. You must not disable the AI disclosure that informs callers their call may be recorded and handled by an AI system.

5. Third-Party Processors

We share personal data with trusted third-party processors to deliver the service. All processors are bound by data processing agreements:

• Twilio (United States) — telephony, SMS delivery, phone number provisioning. Transfers rely on Standard Contractual Clauses (SCCs) with a UK Addendum.
• Retell AI (United States) — AI voice agent, call transcription and analysis. Transfers rely on SCCs with a UK Addendum.
• Supabase (United States/EU) — database hosting and authentication. EU region selected where available; transfers rely on SCCs.
• Stripe (United States) — subscription billing and payment processing. Transfers rely on SCCs with a UK Addendum.
• Resend (United States) — transactional email delivery. Transfers rely on SCCs.
• Sentry (United States) — error monitoring and application performance. Aggregate/anonymised data only where possible.

We do not sell personal data to third parties. We do not share personal data with any party other than those listed above, except where required by law.

6. International Data Transfers

Several of our processors are based outside the UK. We ensure that any transfer of personal data to a third country is protected by an appropriate safeguard under UK GDPR Article 46, specifically Standard Contractual Clauses (SCCs) incorporating the UK International Data Transfer Addendum (UK IDTA) issued by the ICO.

You may request a copy of the relevant transfer mechanisms by contacting privacy@tradereceptionist.co.uk.

7. Data Retention

• Subscriber account data: retained for the duration of the account plus 12 months after cancellation, then deleted.
• Call recordings: 90 days from the date of the call, then automatically deleted.
• Call transcripts and summaries: retained for the lifetime of the account plus 12 months.
• Billing records: 7 years from the transaction date (UK legal requirement).
• Marketing consent records: retained until consent is withdrawn, plus 3 years.

8. Your Rights Under UK GDPR

As a data subject, you have the following rights:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — request deletion of your personal data where there is no overriding legal reason to retain it.
• Right to restriction — request that we restrict processing of your data in certain circumstances.
• Right to data portability — receive your data in a structured, commonly used, machine-readable format.
• Right to object — object to processing based on legitimate interests, or to direct marketing at any time.
• Rights related to automated decision-making — request human review of any solely automated decisions that significantly affect you.

To exercise any of these rights, contact us at privacy@tradereceptionist.co.uk. We will respond within one calendar month. We may ask you to verify your identity before processing your request.

If you are a caller whose data has been collected by a Subscriber, please contact the Subscriber directly — they are the data controller for that data. We will assist Subscribers in fulfilling data subject requests where we are able to do so.

9. Cookies and Tracking

Our website uses the following cookies and tracking technologies:

• Strictly necessary cookies — session management, CSRF protection, and authentication state. These cannot be disabled.
• Analytics (Vercel Analytics) — anonymous, cookieless page-view tracking. No personal data collected.
• Error monitoring (Sentry) — captures application errors. Session replay is masked to prevent capture of personal data.

We do not use advertising cookies or share data with advertising networks. You can control cookie preferences through your browser settings. Blocking strictly necessary cookies may prevent the service from functioning correctly.

10. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, and destruction. These include:

• Encryption in transit (TLS 1.2+) and at rest for all stored data.
• Row-level security (RLS) in our database — Subscribers can only access their own data.
• HMAC-SHA256 signature verification on all inbound webhooks.
• Access controls and audit logging on administrative systems.
• Regular security reviews of third-party integrations.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO within 72 hours of becoming aware of it.

11. Children's Privacy

Our service is intended solely for business use by adults aged 18 and over. We do not knowingly collect personal data from children under the age of 13. If you believe a child has provided us with personal data, contact privacy@tradereceptionist.co.uk and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 14 days before they take effect. The date at the top of this page reflects the date of the most recent update. Continued use of the service after that date constitutes acceptance of the updated policy.

13. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at privacy@tradereceptionist.co.uk. If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

14. Contact

For any questions about this Privacy Policy or our data practices, contact: privacy@tradereceptionist.co.uk.

For general enquiries about the service, see our Terms of Service.