Privacy Policy
Last updated: 19 March 2026
1. Data controller
The data controller is AI Reception, operating the website aireception.biz (the "Controller"). Contact: hello@aireception.biz.
For data protection queries, please contact us at hello@aireception.biz with the subject line "Data Protection".
2. Scope and purposes of processing
We process personal data for the following purposes:
| Purpose | Data scope | Legal basis | Retention |
|---|---|---|---|
| Providing AI agent service | Name, email, phone, company name, website | Art. 6(1)(b) GDPR — contract performance | Duration of contract + 3 years |
| Handling phone calls | Caller phone number, voice recording, transcription, data given in call | Art. 6(1)(f) GDPR — legitimate interest (customer service) | Duration of client contract |
| Payments and invoices | Company details, VAT number, address, payment data (processed by Stripe) | Art. 6(1)(c) GDPR — legal obligation (accounting) | 6 years (HMRC requirement) |
| Demo (presentation) | Name, phone, email, company name, website, industry | Art. 6(1)(b) GDPR — pre-contractual steps | 90 days or until consent withdrawn |
| Contact (email, form) | Name, email, message content | Art. 6(1)(f) GDPR — legitimate interest | End of correspondence + 1 year |
| Analytics and service improvement | IP address, device data, visit time, pages viewed | Art. 6(1)(f) GDPR — legitimate interest | 26 months |
3. Call data processing
As part of the Service, the AI Agent conducts phone calls on behalf of the Client. During calls, we process:
- Caller phone number
- Call recording (voice)
- Call transcription (text)
- Data provided by the caller (name, email, preferences)
- AI-generated call summary
The data controller for caller data is the Client (the business using AI Reception). AI Reception processes this data as a data processor under a Data Processing Agreement (DPA).
The AI Agent informs callers at the start of each call that the conversation is conducted by an AI system and may be recorded.
4. Data sources
Data may come directly from users (form, phone call, email) or be collected automatically during use of the website or phone conversation with the AI Agent.
The Controller also processes technical data including system logs, IP addresses and device identifiers for security and proper service operation.
5. Use of artificial intelligence
The Service uses AI in the following ways:
- ElevenLabs — speech synthesis (TTS) and speech recognition (STT). Caller voice is sent to ElevenLabs servers for text conversion.
- Google Gemini / OpenAI — language models (LLM) generating agent responses based on conversation context and Client business data.
Call data is not used to train third-party AI models. AI providers process data solely for Service delivery, in accordance with their privacy policies and data processing agreements.
The AI Agent does not make automated decisions with legal effects under Art. 22 GDPR. All AI responses are informational and advisory.
6. Data recipients — processors
Personal data may be shared with the following processors:
| Processor | Purpose | Location |
|---|---|---|
| ElevenLabs, Inc. | Speech synthesis and recognition, AI conversations | USA |
| Twilio Inc. | Telephony, phone numbers, SMS | USA |
| Google LLC (Gemini) | AI language model | USA/EU |
| OpenAI, Inc. | AI language model (alternative) | USA |
| Stripe Payments Europe Ltd. | Payment processing | Ireland/USA |
| Vercel Inc. | Website hosting | USA |
| Cloudflare, Inc. | CDN, DDoS protection, Turnstile (anti-bot) | USA/EU |
| Resend, Inc. | Transactional email delivery | USA |
7. International data transfers
Some personal data is transferred to the USA. Transfers are based on:
- EU-US Data Privacy Framework — for participating entities (Stripe, Google, Cloudflare, Twilio)
- Standard Contractual Clauses (SCCs) — approved by the European Commission — for other processors
- UK International Data Transfer Agreement (IDTA) — for UK-specific transfers
Each processor is required to implement appropriate technical and organisational safeguards in line with UK GDPR.
8. Data retention periods
- Client account data: duration of contract + 3 years (limitation period)
- Call recordings: duration of client contract, max. 12 months from recording
- Call transcriptions: duration of client contract
- Demo data: 90 days from presentation
- Invoices and billing data: 6 years (HMRC requirement)
- Analytics data: 26 months
- Contact data (correspondence): 1 year after end of correspondence
9. Your rights
Every individual whose data we process has the right to:
- Access their data (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure — "right to be forgotten" (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Object to processing based on legitimate interest (Art. 21 GDPR)
- Withdraw consent at any time — without affecting the lawfulness of prior processing (Art. 7(3) GDPR)
- Lodge a complaint with the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Requests should be sent to: hello@aireception.biz with the subject "Data Protection". We respond within 30 days.
10. Cookies
The website aireception.biz uses the following cookies:
| Type | Purpose | Provider |
|---|---|---|
| Essential | Site functionality, session, Turnstile (anti-bot) | Cloudflare |
| Analytics | Visit statistics, user behaviour | Vercel Analytics |
Analytics cookies are only used after obtaining user consent via the cookie banner displayed on first visit. You can change your cookie preferences at any time via the banner settings or your browser settings.
11. Data security
We implement the following security measures:
- Encryption in transit (TLS/SSL) on all pages and APIs
- Password hashing (bcrypt)
- Role-based access control (client / admin)
- Regular database backups
- DDoS protection (Cloudflare)
- Bot protection (Cloudflare Turnstile)
- Access monitoring and logging
12. Data sharing
We do not sell user data and use it solely for providing and improving our services. We share data only with the processors listed in section 6 and as required by law.
13. Changes to this policy
The Controller reserves the right to amend this Privacy Policy. We will notify users of significant changes via a notice on the website or by email. The current version is always available at aireception.biz/privacy-policy.