Draft — to be checked by a solicitor before launch.
Privacy notice
In short:
- Calls are answered by an AI, and it says so at the start of the call.
- Calls may be transcribed. We do not store the call audio.
- For call data, the business you called (our customer) is the controller and Adria Technologies Limited is the processor.
1. Who we are
AI Receptionist is an AI phone receptionist for businesses. It is run by Adria Technologies Limited, trading as AI Receptionist, a company registered in England and Wales, company number 17543235, registered office 66 Paul Street, London, EC2A 4NA.
ICO registration number: [registration pending].
2. Our two roles
- Calls to a business: the business you called (our customer) is the controller. It decides why and how your details are used. Adria Technologies Limited is its processor: we handle the call for it and only on its instructions, under a Data Processing Agreement.
- Our own customers: for the account, contact and billing details of the businesses that use our service, and for visitors to our website, we are the controller.
3. If you called a business
When you call a business that uses our service, an AI receptionist may answer. It tells you at the start that it is an AI and that the call is transcribed.
What happens on the call
- Your voice is streamed live to turn speech into text, and the AI's reply is turned back into speech. We do not store a recording of the call audio.
- We store a written transcript of the call, a short summary, your phone number (if your phone shows it), the time, length and outcome of the call, and the number it was forwarded from, if any.
- If you leave a message, we store your name, phone number, what you said, and an address or call-back time if you gave one. The message may be texted to the business.
- If you make a booking, we store your name, phone number, the service, the time and any notes. We may text you a confirmation of your booking. If the business uses a booking system, the booking is also sent there.
- If you ask to speak to someone, the call may be put through to the business's own phone.
Tell the AI only what is needed for your request. Some callers mention health details (for example to a clinic); the business is responsible for having a lawful reason to use them.
Your choices
The business decides how your details are used and how long they are kept, within the limits in section 6. To see, correct or delete your details, please contact the business you called. If you contact us instead, we will pass your request to the business and help it answer. We can delete one caller's transcripts, messages and bookings for a business when it asks us to.
4. If your business uses the service
| What | Why | Lawful basis |
|---|---|---|
| Your email address | To sign you in (we email a one-time code) and to contact you about your account | Contract |
| Business details: name, type, address, phone, website, opening hours, the mobile for text alerts, the number to pass calls to | To set up and run your receptionist | Contract |
| Facts read from your website, and facts you add | So the receptionist can answer questions | Contract |
| Details the phone network needs for a UK number (business and address details, and documents it asks for) | To get you a phone number, as Ofcom rules require | Contract and legal obligation |
| Plan, minutes used and payment status (card details are held by Stripe, not by us) | To bill you | Contract and legal obligation (tax records) |
| Keys or links for a booking system you connect (stored encrypted) | To book into your own diary | Contract |
| Technical logs (for example times and errors) | To keep the service secure and working | Legitimate interests |
We do not sell your data. We do not use your callers' calls or transcripts to train AI models. We opt out of Deepgram's model-improvement programme on every call [to confirm: other providers' training settings]. We only send you service emails; any marketing email would follow PECR and you could stop it any time.
5. Our website and app
- We do not use advertising or analytics cookies.
- The app sets one cookie,
rcpt_session, only to keep you signed in (strictly necessary, so no consent banner). It holds a random token, lasts 30 days from your last visit, and ends when you sign out. Sign-in codes and sessions are kept for at most 7 days after they end. - Our pages load fonts from Google Fonts. Google sees your IP address when your browser fetches them [to confirm: or host them ourselves].
- If you try the demo receptionist in your browser, your voice is handled as on a phone call. The demo call's transcript is stored like any other call, for our demo business. There is no phone number with it.
6. What we keep, and for how long
Each business can change these times in its settings. A job deletes old data every night.
| Data | Kept for (default) | Business can set |
|---|---|---|
| Call audio | Not stored | — |
| Call transcripts, summaries, and the caller's number on the call log | 90 days | 7 days to 2 years |
| Messages | 365 days | 30 days to 6 years |
| Bookings | 365 days after the booking time | 30 days to 6 years |
| Call times, length and outcome (no transcript or number) | While the account is open, for billing [to confirm] | — |
| Account and business details | While the account is open, then deleted [to confirm: how soon] | — |
| Billing records | 6 years, for UK tax rules [to confirm] | — |
| Server logs | [to confirm] | — |
Our providers may keep their own short-term copies under their terms [to confirm: each provider's retention settings].
7. Who helps us (sub-processors)
We use these providers to run the service. Each one gets only what it needs: for example Twilio gets call audio, phone numbers and texts; Deepgram and Soniox get caller audio; Anthropic gets transcripts and the business's facts; Resend gets the email address and sign-in code.
| Sub-processor | Country | Purpose | Transfer tool |
|---|---|---|---|
| Supabase | EU (Frankfurt, Germany); US parent company | Database (including our own sign-in records) | Data stays in the EU, which the UK treats as adequate. For any access by the US parent: UK Addendum to the EU SCCs or UK IDTA; UK–US Data Bridge where certified [solicitor to confirm] |
| Render | EU (Frankfurt, Germany); US parent company | Runs our servers; calls pass through it | Data stays in the EU, which the UK treats as adequate. For any access by the US parent: UK Addendum to the EU SCCs or UK IDTA; UK–US Data Bridge where certified [solicitor to confirm] |
| Twilio | US | Phone numbers, calls and text messages | UK Addendum to the EU SCCs or UK IDTA; UK–US Data Bridge where the provider is certified [solicitor to confirm per provider] |
| Deepgram | US | Speech to text (we opt out of its model-improvement programme) | UK Addendum to the EU SCCs or UK IDTA; UK–US Data Bridge where the provider is certified [solicitor to confirm per provider] |
| Cartesia | US | Text to speech (the AI's replies, not caller audio) | UK Addendum to the EU SCCs or UK IDTA; UK–US Data Bridge where the provider is certified [solicitor to confirm per provider] |
| Anthropic | US | The AI language model | UK Addendum to the EU SCCs or UK IDTA; UK–US Data Bridge where the provider is certified [solicitor to confirm per provider] |
| Stripe | US | Payments (business billing details only) | UK Addendum to the EU SCCs or UK IDTA; UK–US Data Bridge where the provider is certified [solicitor to confirm per provider] |
| Resend | US | Sends our sign-in code emails (the email address and the code) | UK Addendum to the EU SCCs or UK IDTA; UK–US Data Bridge where the provider is certified [solicitor to confirm per provider] |
| Soniox | US | Speech to text and text to speech, only when Albanian is switched on for a line | UK Addendum to the EU SCCs or UK IDTA; UK–US Data Bridge where the provider is certified [solicitor to confirm per provider] |
If a business connects its own booking system or calendar (for example Cal.com or Cliniko), bookings go to that system for the business, under the business's own agreement with it. [to confirm: ElevenLabs only if it is switched on as a voice]
We will tell businesses before we add or change a sub-processor.
8. Data sent outside the UK
- Data sent to the EU (Supabase and Render in Frankfurt) is covered by the UK's adequacy rules for the EU.
- Some providers are in the US, and Supabase and Render have US parent companies. For them we use the UK Addendum to the EU Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA), and the UK–US Data Bridge where the provider is certified [solicitor to confirm per provider]. See the table in section 7.
- For business customers in the EU we would use the EU Standard Contractual Clauses [to confirm].
9. Security
- Data is sent over encrypted connections (TLS).
- Each business can only see its own data: the database checks this on every request.
- Keys and links for connected booking systems are stored encrypted.
- Access to our systems is limited to the people who run the service [to confirm: written access policy].
- Old data is deleted by a nightly job, as in section 6.
10. Your rights
Under UK GDPR you can ask to see your data, to correct it, to delete it, to limit or object to how it is used, and to get a copy to take elsewhere. Some rights depend on the reason we use the data.
- Callers: please ask the business you called first (see section 3). We will help it.
- Business customers: email us. We answer within one month.
11. Complaints
Please tell us first, and we will try to put it right. You can also complain to the UK regulator, the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or call 0303 123 1113.
12. Contact and changes
Email support@adriatechnology.com. Post: Adria Technologies Limited, 66 Paul Street, London, EC2A 4NA.
We will update this notice when things change, and tell business customers about important changes by email.