1. Who we are

AutoMate is a trading name operated from the United Kingdom. We provide an AI-powered receptionist service for small and medium businesses ("the Service"). For the purposes of UK GDPR, AutoMate is the data controller for personal data we collect about our business customers (account holders), and the data processor when we handle personal data of your end-customers (callers) on your behalf.

You can contact us about anything in this policy at help@getautomateai.co.uk.

2. What data we collect

2.1 Account data (you, our customer)

• Name, business name, email address, phone number
• Business address and country
• Industry, opening hours, services offered, booking process
• Payment information (processed by Stripe — we never store full card numbers)
• Login credentials (passwords are stored as one-way salted hashes)

2.2 Configuration data

• Your business website URL (used at onboarding to generate the AI's knowledge base)
• Questionnaire answers (brand voice, booking authority, escalation rules, fallback behaviour)
• Integration credentials for connected services (calendar OAuth tokens, CRM webhook URLs)

2.3 Call data (your end-customers, the callers)

• Caller phone number (CLI)
• Audio recording of the call
• Transcript of the call (machine-generated)
• Time, duration, outcome (booking made, enquiry, hang-up, escalated)
• Any information the caller volunteers during the conversation (name, email, requested service, appointment preferences)

2.4 Technical data

• IP address, device type, browser, operating system
• Pages visited on our website, referring URL
• Cookie identifiers (see Section 12)

3. How we use your data

We process personal data only for the following purposes:

• Service delivery — operating your AI receptionist, routing calls, generating transcripts, sending bookings to your calendar and CRM.
• Onboarding — scraping your public website and using the content (combined with your questionnaire answers) to generate the AI assistant's instructions. This is a one-time automated process.
• Billing — taking payment via Stripe, issuing invoices, tracking usage against your plan's included minutes.
• Support — replying to your queries when you contact help@getautomateai.co.uk.
• Service improvement — aggregated and anonymised usage analytics. We do not use your call content to train third-party AI models.
• Legal compliance — keeping records required by HMRC, fraud prevention, responding to lawful requests from regulators or law enforcement.

4. Legal basis for processing

Under UK GDPR Article 6, we rely on the following lawful bases:

• Contract (Art. 6(1)(b)) — processing necessary to deliver the Service you have signed up for.
• Legitimate interests (Art. 6(1)(f)) — service security, fraud prevention, product improvement (always balanced against your rights).
• Legal obligation (Art. 6(1)(c)) — accounting records, tax reporting, responding to regulators.
• Consent (Art. 6(1)(a)) — non-essential cookies, marketing emails, call recording where this is the appropriate basis.

5. AI processing & automated decisions

AutoMate uses large language models from third-party AI providers (currently Anthropic for prompt generation and Bland AI for the voice agent) to operate the Service. You should know:

• Your website content and questionnaire answers are sent to Anthropic's Claude API at onboarding to generate the AI's instructions.
• Live call audio and transcripts are processed by Bland AI to enable the real-time voice conversation.
• Both providers process data under their own GDPR-compliant terms; we have data processing agreements in place with each.
• Neither provider is permitted to use your data or your callers' data to train their underlying AI models.
• The AI does not make legally significant automated decisions about callers under UK GDPR Article 22. It can take bookings, capture details, and escalate — it cannot deny service, set prices, or make binding contractual commitments without human ratification rules you configure.

6. Call recordings & transcripts

When AutoMate answers a call on your behalf, we record the audio and generate a transcript. This is essential for the Service: bookings, follow-up SMS, analytics and dispute resolution all depend on it.

• Consent notice: the AI announces at the start of each call that it is an automated assistant and the call may be recorded. Callers can decline and request a human callback.
• Storage: recordings and transcripts are stored in UK and EU regions only, encrypted at rest.
• Access: only you (the account holder) and authorised AutoMate engineers acting on a documented support request can access call data for your account.
• You are the controller of your callers' personal data; AutoMate is your processor. You are responsible for displaying any required call-recording notices to callers (e.g. in your IVR menu or on your website's privacy notice).

7. Who we share data with

We share your data only with the following categories of recipient, each under written contractual terms:

• Bland AI — voice agent infrastructure (call audio, real-time transcription).
• Anthropic (Claude API) — system prompt generation at onboarding; not used during live calls.
• Twilio — phone number provisioning and call routing (SIP).
• Firecrawl — scraping the public content of the business website URL you provide at onboarding.
• Supabase — database, authentication and file storage (UK/EU regions).
• Railway — application hosting.
• Stripe — payment processing.
• Your chosen integrations — calendar (Google / Microsoft), CRM webhooks, Zapier/Make — only the data you authorise these to receive.
• Professional advisers — accountants, lawyers, auditors, under duties of confidentiality.
• Regulators & law enforcement — only when legally required.

We do not sell personal data to anyone, and we do not share it with advertising networks.

8. International transfers

Some of our processors (notably Anthropic and Twilio) are based in the United States. Where personal data is transferred outside the UK, we rely on:

• The UK Government's data bridges and adequacy decisions (where they apply), or
• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, with supplementary measures including encryption in transit and at rest.

Call recordings and transcripts for UK customers are stored in UK/EU regions and not transferred to the US for storage.

9. How long we keep data

• Account data — for the lifetime of your account, plus 6 years after closure for accounting / HMRC purposes.
• Call recordings & transcripts — 90 days by default. You can adjust this in Settings, or delete individual records at any time.
• Billing records — 6 years (UK accounting law).
• Support tickets — 2 years after resolution.
• Marketing data — until you unsubscribe, then up to 12 months in a suppression list to honour your opt-out.

10. Security

We take security seriously. Measures include:

• TLS 1.2+ encryption for all data in transit
• AES-256 encryption at rest for databases and file storage
• Salted bcrypt password hashing — we never see your plaintext password
• Principle of least privilege for engineer access, with audit logging
• Regular dependency scanning and security patching
• Multi-factor authentication available on all customer accounts

No system is perfectly secure. If we ever suffer a personal data breach that is likely to result in a risk to your rights, we will notify you and the Information Commissioner's Office (ICO) within 72 hours as required by UK GDPR.

11. Your rights under UK GDPR

You have the following rights over your personal data, free of charge:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — ask us to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — ask us to delete your data, subject to legal retention obligations.
• Right to restriction — ask us to limit how we process your data while a question is resolved.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests, or to direct marketing at any time.
• Right to withdraw consent — where processing relies on consent, you can withdraw it any time without affecting prior lawful processing.
• Right not to be subject to solely automated decisions with legal or similarly significant effect.

To exercise any of these rights, email help@getautomateai.co.uk. We will respond within one month.

12. Cookies & tracking

Our website uses the following categories of cookies, in line with the Privacy and Electronic Communications Regulations (PECR):

• Strictly necessary — session and authentication cookies. No consent required; the Service won't work without them.
• Functional — remembering your preferences (e.g. cookie banner choice). Set only with your consent.
• Analytics — privacy-respecting usage measurement. Set only with your consent. We do not use cross-site advertising trackers.

You can change your cookie preferences at any time using the link in our cookie banner, or by clearing cookies in your browser.

13. Children's data

The Service is not directed at children. We do not knowingly collect personal data of anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top tells you when. For material changes (e.g. new processors, new categories of data), we will notify account holders by email at least 14 days before the change takes effect. Continued use of the Service after the effective date constitutes acceptance.

15. Contact & complaints

For any privacy question, data subject request, or complaint:

• Email: help@getautomateai.co.uk
• Subject line: "Privacy request" (we'll route it to the right person)

If you're not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF