Privacy Policy

1. Who we are

AutomateIT is a trading name of AutomateIT Online Ltd, a private company limited by shares incorporated in England and Wales (company number 17096237), with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. In this notice, "we", "us", "our" and "AutomateIT" all refer to AutomateIT Online Ltd.

We are registered with the UK Information Commissioner's Office (ICO) under registration number ZC129488 (Tier 1 fee payer). The director responsible for data protection matters is Ivan Aguilar Mari.

AutomateIT is an AI phone agent built for UK tradespeople. Plumbers, electricians, gas engineers and similar small business owners sign up, complete a short setup, and get a UK phone number. From then on, an AI receptionist answers their calls, books jobs, sends payment links, and escalates emergencies.

You can contact us about anything in this notice in one of three ways:

• Email Ivan directly: ivan@automateitonline.co.uk
• Email our customer inbox: hello@automateitonline.co.uk
• Write to us at the registered office address above, marked for the attention of the Director.

For data protection matters specifically you can also email privacy@automateitonline.co.uk. This is a function alias forwarded to the accountable person at the time.

We aim to acknowledge data protection enquiries within 5 working days and give you a full reply within 30 days. (This is the timeline UK GDPR sets in Article 12.)

AutomateIT is currently operated by a single director. We do not have a separate compliance team. The response time targets in this notice reflect that, and the Director is personally accountable for every commitment in it.

Our company name, place of registration, registered number and registered office are also displayed in the footer of every page on https://automateitonline.co.uk in line with the Companies (Trading Disclosures) Regulations 2008 (SI 2008/495), made under sections 82 to 85 of the Companies Act 2006.

1.1 Data Protection Officer

AutomateIT has assessed whether a Data Protection Officer is required under UK GDPR Article 37. We do not meet the mandatory thresholds: we are not a public authority; the volume of end-caller data we currently process is not "large scale" in the ICO sense at the present number of customer accounts; and we do not process special category data on a large scale by design. The Director, Ivan Aguilar Mari, is the accountable person. We will reassess this position annually, on any material change to the volume or nature of processing, and immediately on either of the following thresholds being crossed: (a) 50 active customer accounts on the platform, OR (b) 5,000 inbound end-caller calls processed in any rolling 30-day window. The reassessment outcome is recorded in this notice's change log. We will appoint a DPO (internal or contracted) before reaching the relevant Article 37 threshold.

2. Scope of this notice

AutomateIT wears two legal hats and this notice covers both. (1) For tradespeople who sign up as our customers, and for visitors to the marketing site, AutomateIT is the data controller: we decide what data we collect and why. (2) For members of the public who phone a tradesperson's AutomateIT number, AutomateIT is a processor acting on the tradesperson's instructions; the tradesperson is the controller of those calls. Section 3 covers each group separately.

This notice does not cover external websites you reach by following a link from ours. Each of those will have its own privacy notice.

3. The personal information we collect, and why

We have grouped this section by the relationship you have with us. Each subsection lists the categories of data, the source, why we use it and where it is stored. Section 5 maps each purpose to a UK GDPR lawful basis.

3.1 Marketing-site visitors

If you simply browse the marketing site, we collect very little. Our hosting provider and our visit statistics handle some technical data automatically:

If you fill in our contact form to request a demo, we collect the following directly from you and store it in our contact_submissions table in our application database:

• Your name
• Your email address
• Your business name and the trade you operate in
• A phone number we can call you back on
• Optional: your business website URL or Google Place identifier
• Your typical weekly call volume (a rough banding you choose from a dropdown)
• The frustration that prompted you to contact us (a short choice from a list)
• Any free-text message you choose to add
• If you reached the form through one of our tagged links (for example from our business emails, a printed card, our social media posts, our guides or our tools), a short tag saying which one, such as facebook or guides. It comes from the link you followed and is read only when you send the form; nothing is stored on your device

We use this to call you back, run a personalised demo and follow up. When you submit the form we generate a unique signup token tied to your submission so we can pre-fill your account if you decide to sign up.

If you accept a demo call, we then create a row in our demo_bookings table covering:

• The booking type (immediate or scheduled), the scheduled time, and a reschedule token for the public reschedule link we email you
• Attempt count and the latest call status (whether we reached you, were sent to voicemail, etc.)
• A copy of the call transcript, summary, outcome and duration that our AI demo agent ("Lucy") returns after the conversation
• Whether and when we sent you a signup link by SMS or email

If you accept a demo call, your end of the conversation is recorded by Retell on the same basis as live calls. The recording is held at Retell for up to 6 months and the transcript on demo_bookings for up to 12 months.

PECR Regulation 19. PECR Regulation 19 requires specific prior consent for unsolicited automated calls. The AutomateIT contact form records explicit consent at submission, including the version of the consent text the customer agreed to and the timestamp. Automated demo calls are placed only where this consent is on file. Consent can be withdrawn at any time by emailing privacy@automateitonline.co.uk. AutomateIT demo calls are solicited (the prospect submitted the contact form to request the callback), so Regulation 19 may not strictly apply; the explicit consent is captured nonetheless as a defensive overlay and as the UK GDPR Article 6(1)(a) basis for the recording.

Caller-identification opener. Lucy's very first utterance on every demo call is a warm greeting that identifies her and the brand, verbatim: "Hi! This is Lucy from Automate I.T. How are you doing today?" (the brand "AutomateIT" is spoken as "Automate I.T." with dots so the text-to-speech reads each letter individually; the controller is AutomateIT Online Ltd). She then waits for the recipient to reply. In her very next turn, immediately after the recipient replies and before any substantive discussion of their business, Lucy discloses that the call is recorded for quality and that the recipient is welcome to hang up at any time, and confirms with one question that this is the demo call they requested via the website form. If the recipient does not recall requesting it, Lucy briefly reminds them who Automate I.T. is (AI phone agents for tradespeople) and that a demo request came through from their number; if it is genuinely not them, a wrong number, or they are not interested, she apologises and ends the call. So caller identity is given in the greeting, and the purpose of the call, the recording disclosure and an immediate verbal opt-out all follow in the immediately-following turn, within the opening seconds. The greeting is set as the Retell begin_message in scripts/setup-retell-demo-agent.mjs and pinned in Lucy's system prompt at src/lib/lucy-prompt.mjs, so it is always Lucy's first words and cannot be skipped. The recording disclosure, opt-out, purpose and demo-call confirmation are pinned as mandatory call-flow steps in that same system prompt at src/lib/lucy-prompt.mjs that Lucy is required to complete in her next turn, before any substantive discussion of the recipient's business. The demo is openly acknowledged: the prospect requested a demo call, and near the end of the call Lucy explicitly explains that she is an AI agent and that the call demonstrates exactly what the prospect's own customers would experience. Separately, if at any point a caller sincerely asks whether they are speaking to a person or a machine, Lucy is required by her system prompt to confirm honestly and immediately that she is an AI. If a caller asks where to find this notice or how to contact us during the call, Lucy directs them to automateitonline.co.uk/privacy or to ivan@automateitonline.co.uk.

PECR Regulation 24's caller-identification information requirements (postal address or freephone number) apply to unsolicited calls. As above, AutomateIT demo calls are solicited (the prospect submitted the contact form to request the callback) and Regulation 24 does not strictly engage. The call nonetheless meets the underlying transparency goal Regulation 24 protects: the greeting identifies the caller (Lucy, calling for AutomateIT Online Ltd, with the brand "AutomateIT" spoken as "Automate I.T."), and the immediately-following turn states the purpose of the call (the demo the prospect requested via the website form), discloses recording, and gives an immediate verbal opt-out, all within the opening seconds and before any substantive discussion of the recipient's business. A caller can be directed to this notice at automateitonline.co.uk/privacy or to ivan@automateitonline.co.uk on request.

The card demo line. If you ring the number on one of our printed cards (01482 267563), you reach Lucy, our AI receptionist, on a demo line. She tells you at the start that she is an AI and that calls are recorded, and the card says so too. On that call we collect:

• The number you ring from (or that it was withheld) and when you rang
• The trade and business name you tell her
• The made-up job you give her while you play one of your own customers: a name, an address and postcode, a phone number and the work needed, whatever you choose to say (please use made-up details)
• The call recording and transcript, held by Retell, and how long the call lasted
• Whether we sent you the text described below, and when

We use this to run the demo you rang for, to keep the line within its limits (a few calls per number and a set number per day), and to count how many calls and sign-ups the cards bring in. If you say yes when Lucy offers it at the end, we send one text to the mobile you rang from: the job she took, laid out like the texts our customers get, and a link to our plans. Before sending it we check with our phone provider, Twilio, that the number is a UK mobile. It only ever goes to the number you rang from, each number only ever gets one, and we will not text you again. We keep the record in our card_demo_calls table for 12 months from the call; the recording is held at Retell for up to 6 months. If you sign up through one of the card's links, your account notes that you came from the card.

3.2 Customer accounts

Once you sign up to AutomateIT we collect more, because we need it to run the product. The categories below are split into three sub-tables for readability.

3.2.1 Account and login

3.2.2 Business profile and configuration

3.2.3 Integrations, billing, files and feedback

We do not collect special-category data (health, race, religion, political opinions, biometric or genetic data) for customer accounts. If you tell us such information voluntarily in feedback or a support email, we treat it as ordinary personal data and do not use it for anything other than responding to you.

We do not collect or store payment card data. Customer billing payments to AutomateIT itself, when self-serve billing is added, will run through Stripe Checkout; we will only store the Stripe Customer ID and the metadata Stripe returns to us.

All of the customer-account fields above are necessary for AutomateIT to operate. If you do not provide them you will not be able to complete onboarding or use the service. Optional fields are clearly marked in the form.

3.3 End-caller data (AutomateIT acts as a processor)

When someone phones your AutomateIT number, the information from that call belongs to your business, not to us. In data protection terms, you are the "controller" (you decide what the information is used for) and we are your "processor" (we handle it for you on your instructions). In practice that means:

• You decide why the data is collected (to take a booking, take a payment, escalate to you, etc.).
• You set the retention period within the limits we make available to you.
• We process the data only on your documented instructions, which are the configuration choices you make during onboarding and in Settings.

The categories we process on your behalf include:

• The caller's phone number (as supplied by Twilio in the call signalling)
• Their name, where they say it
• Their address or postcode, where they share it for routing or service-area validation
• The full audio recording of the call, the speech-to-text transcript, and the AI's post-call summary, outcome label and sentiment classification
• Job details captured during the call (service requested, scheduled date and time, deposit status)
• Outbound SMS we send on your instructions (booking confirmation, payment link, etc.)
• A one-off deposit-payment receipt email we send to the caller on your instructions, where the caller shared an email address, after they pay a deposit through a Stripe payment link
• Cost and duration metadata for billing and analytics

The AI agent plays a short call-recording disclosure at the start of every call so callers know the call is being recorded. The disclosure currently says: "One quick thing, calls are recorded for quality." This is delivered in the agent's first spoken message before the agent takes any details from the caller. You as the controller are responsible for any further notice obligations to your callers, for example a written privacy notice on your own website that explains how you use the recording, transcript and any onward processing.

We sign or commit to UK GDPR Article 28 processor terms with you as part of our customer agreement. Those terms include sub-processor disclosure (section 6 of this notice), security obligations (section 11), assistance with data subject requests (section 9), and breach notification.

Joint-controller note (Article 26). For most aspects of the call (recording, transcription, routing, job creation, post-call analytics) AutomateIT acts as the customer's processor and the customer is the controller. There is one specific element where the design choice is AutomateIT's own and materially affects callers' rights: the auto-injected pre-call recording disclosure ("One quick thing, calls are recorded for quality.") is determined by AutomateIT, not the customer, and the customer cannot remove it. For that one element AutomateIT and the customer are joint controllers. The essence of the arrangement is that AutomateIT determines the disclosure wording (to satisfy UK GDPR Article 13 and PECR transparency), while the customer determines who is called, when, and what the call is about. Either party can be approached for a data subject rights request and the parties cooperate to respond.

3.3.1 Special category data in calls

Live phone conversations sometimes capture information that falls within Article 9 of the UK GDPR, most commonly health information shared by a caller during an emergency. We do not solicit such information and the AI agent is not configured to ask for it. Where it is volunteered we process it only to the extent necessary to (a) help the AI agent route the call appropriately and (b) provide the customer with the recording and transcript they need to do their job. To the limited extent AutomateIT itself processes special category data as a controller (for example, when an admin reviews a call transcript to support a customer or to investigate a service incident), we rely on Article 9(2)(c) of the UK GDPR for vital interests in emergencies involving risk to life, Article 9(2)(f) for the establishment, exercise or defence of legal claims, and Article 9(2)(g) substantial public interest read with paragraph 10 of Schedule 1 to the Data Protection Act 2018 (preventing or detecting unlawful acts) and, for any criminal-offence content under Article 10 of the UK GDPR, paragraph 33 of Schedule 1 (legal claims). An Appropriate Policy Document is maintained as required when relying on the Schedule 1 substantive paragraphs above (DPA 2018 Schedule 1 paragraph 39 sets the required content). Customers (acting as controllers) are responsible for ensuring they have a corresponding Article 9(2) condition for any onward use of the recording or transcript and for telling their callers what they will do with the information.

3.3.2 Member-of-the-public requests

If you are a member of the public who has called a tradesperson using AutomateIT and you have a question about your data, you can either contact the tradesperson directly or email us at ivan@automateitonline.co.uk. Where we hold your data only as the tradesperson's processor, we will route your request to them within 5 working days and copy you on the routing. We will help the tradesperson respond and, where they fail to respond within a reasonable period, we will respond ourselves to the extent permitted under our processor obligations.

3.3.3 No direct relationship with end-callers

End-callers have no contractual or commercial relationship with AutomateIT. They dialled the tradesperson's published number and reached our infrastructure as a consequence. This is why our role is processor-only, why the recording disclosure is mandatory and auto-injected by our backend, and why we publish this notice in language that is meaningful to a member of the public who has just had their voice recorded.

3.3.4 Recording disclosure as a built-in control

Unlike many call-recording setups where the disclosure depends on the customer remembering to read it, AutomateIT injects the disclosure into every customer's begin_message server-side at call start, by way of applyRecordingDisclosure() in src/lib/retell-recording-disclosure.ts. The customer cannot accidentally remove it from their saved greeting; the helper re-applies it on every call. This is a deliberate compliance-by-design control under UK GDPR Article 25.

3.3.5 Vulnerable callers

We recognise that emergency callers may include vulnerable adults, callers in distress, callers with hearing or cognitive impairments, and (occasionally) minors using a parent's phone. The recording disclosure played at the start of every call is short and clear by design. The customer (tradesperson) remains the controller and is responsible for any further accessibility-of-notice obligations under the Equality Act 2010. We do not perform automated profiling of caller vulnerability and we do not sell or share end-caller data with anyone outside the sub-processors listed in section 6, other than the tradesperson's own CRM where they have connected one and asked us to send it there (section 3.3.10).

3.3.6 Stripe Checkout payment-link flow

When the agent sends a payment link during a call, AutomateIT also creates a Stripe Checkout Session on the customer's connected Stripe account containing the deposit amount, a reference to the job, and (depending on session config) the caller's phone or email so they can be sent a receipt. AutomateIT does not store any card data.

When the caller completes that payment, Stripe notifies AutomateIT through a signature-verified webhook. On a confirmed payment, AutomateIT marks the job's deposit as paid and, where the caller gave an email address during the call, sends the caller a one-off deposit-payment receipt by email through our transactional email provider, Resend (section 6). The purpose is simply to confirm to the caller that their deposit reached the business. The receipt contains the business name, the service (where captured), the date and the deposit amount; it contains no card data. It is a best-effort courtesy, so if the caller gave no email, or email delivery is not configured, no receipt is sent. AutomateIT sends this receipt as the customer's processor, on the customer's instructions, so the customer's own lawful basis for the call applies (see section 5.2) rather than a separate AutomateIT basis. AutomateIT also emails the business owner that the deposit has landed and, subject to the business's SMS preferences, texts them. If the business later refunds the deposit in full from their own Stripe account, the same webhook marks the job's deposit as refunded; no email is sent to the caller for a refund, because the caller's bank notifies them. This deposit webhook is built but dormant at the time of this version.

3.3.7 Where the call audio lives

Call audio is held at Retell. AutomateIT proxies the audio on demand from Retell to the authenticated customer's browser via /api/calls/[id]/recording. The proxy streams the bytes through; AutomateIT does not write the audio to disk or to any persistent store.

3.3.8 Job rows

Each booked job is stored on the jobs row with customer_name, customer_phone, customer_email, service, description, postcode, scheduled_at, deposit_amount, deposit_status, stripe_session_id, stripe_payment_intent_id and google_event_id. The stripe_payment_intent_id is a nullable Stripe reference written only when a deposit is actually paid; it lets a later full refund be matched back to the right job (it is empty for any deposit taken before the deposit webhook shipped). The deposit_status records the deposit lifecycle and can read paid, failed or refunded. We retain those rows for 6 years from job completion to align with HMRC accounting record requirements (see retention policy section 4.7).

3.3.9 International transfers of end-caller data

Where end-caller data is transferred outside the UK to a sub-processor (currently Retell AI in the United States, and onward to Retell's own infrastructure provider), we transfer it under the UK-US Data Bridge (where the sub-processor is DPF/UK-Extension certified) or under the UK Addendum to the EU SCCs (where it is not), in each case as the customer's authorised sub-processor under their processor agreement with us. The customer is the controller of those onward transfers and our processor agreement records the customer's general authorisation under UK GDPR Article 28(2) for us to engage the sub-processors listed in section 6. Where you connect your own CRM, the job and client details we send to it on your instruction go to ServiceM8 (Australia) or Jobber (operated from Canada, with hosting that includes the United States). That provider looks after the data for you under your own agreement with it, so it is not one of our sub-processors, and any safeguard for sending the data abroad is part of that agreement (see section 3.3.10). The same applies to an Apple iCloud or Microsoft Outlook calendar you connect (see section 3.3.11).

3.3.10 CRM push (optional)

If you connect a field-service CRM (currently ServiceM8 or Jobber), AutomateIT pushes the booked job and the caller's contact details into your own CRM account on your instruction. This is push-only: we write the job and client record to your CRM and do not read your CRM data back into AutomateIT, save that one connector (ServiceM8) makes a minimal lookup by client name at the moment of writing so it can match an existing client rather than create a duplicate; we do not import or store any CRM data from that lookup. The fields pushed are the booked-job fields already described above: the caller's name, phone and email, the full street address (or the postcode where no street address was captured), the postcode, the service, any free-text booking notes, the scheduled time and its duration, and a derived price line item. We never push the call audio or the transcript to a CRM. The connector is not designed to send special-category information, but, as with any free-text field, it may be incidentally present where a caller has volunteered it in the free-text booking notes that are pushed. Once the record is in your CRM it lives there under your own account and your own relationship with that provider, and you manage it with them.

The push does not run during the live call. It runs afterwards on a separate scheduled job, so a slow CRM can never hold up answering a caller. The CRM connection tokens are stored in our database (encrypted at rest by our database provider) and written only by a server-side database function; they never reach your browser.

When you connect, you are asking us to send these details to your own account. The CRM provider looks after them for you under your own agreement with it, so it is your processor, not one of our sub-processors, and any safeguard needed for sending the data abroad (ServiceM8 is Australian; Jobber is run from Canada and its hosting includes the United States) is part of that agreement. Make sure your own privacy notice to your callers covers this. You can disconnect at any time: we then stop sending and delete our connection tokens straight away. ServiceM8 is not yet offered to customers while we finish testing it.

3.3.11 Apple iCloud and Microsoft Outlook calendars (optional)

You can connect an Apple iCloud or Microsoft Outlook calendar (Outlook.com, Hotmail and Microsoft 365) instead of Google Calendar. The AI agent then uses it the same way: before offering a time it checks when you are busy, it writes each appointment it books into the calendar you chose (the caller's name and phone number, the job address and postcode, the service, any booking notes and the appointment time), and it moves or removes that entry if the caller reschedules or cancels. To see when you are busy we read the events in the time being checked, but we use only their times and whether each is marked busy or free, and we do not store their titles or details. We never send the call audio or transcript to your calendar.

For Apple iCloud you give us your Apple ID email and an app-specific password that you create in your Apple account for this purpose; your main Apple password is never asked for. For Outlook you sign in on Microsoft's own page. The app-specific password or Microsoft token is stored encrypted and never reaches your browser.

When you connect, you are asking us to do this with your own account. Apple (for iCloud) or Microsoft (for Outlook) looks after your calendar for you under your own agreement with it, so it is your processor, not one of our sub-processors, and any safeguard for data it holds outside the UK is part of that agreement. Make sure your own privacy notice to your callers covers this. You can disconnect at any time from Integrations: we then delete the stored login straight away, and you can also switch off the app-specific password in your Apple account, or remove AutomateIT's access in your Microsoft account.

3.4 Where we got your data from (Article 14)

Most of the data we hold about you comes directly from you. The exceptions are:

• Your business name, address, business phone, opening hours and Google Place identifier may be pre-filled from the public Google Places record you confirm during onboarding. The source is the public Google Places API.

• A candidate list of services and service areas may be extracted from the public homepage of the business website you give us. The source is your own public website. We perform this extraction once at onboarding using Anthropic Claude as described in section 4. The fetched HTML is not retained after the extraction completes.

• A 128px favicon may be fetched from your Google Places record if you have not uploaded a logo.

• During onboarding, your typed company-name search is sent to the public Companies House API for a register lookup.

• If you posted in an online group our director belongs to, or on one of our social media pages, the source is that post or comment (section 3.6). If you are a journalist or a possible partner, the source is your public request or the contact details you or your organisation publish (section 3.7).

For end-callers (people who dial your AutomateIT number), the caller's phone number is supplied by Twilio in the call signalling. We do not look up the caller in any external database. All other end-caller data is supplied by the caller themselves during the conversation.

3.5 Business outreach

This part explains how AutomateIT Online Ltd uses business contact details to email UK businesses that may want an AI phone agent. If we emailed your business from an automateitonline.uk address, this is the part that applies to you. AutomateIT Online Ltd is the controller (see section 1).

Who we email. Only corporate subscribers: companies (limited or unlimited, including PLCs), LLPs, Scottish partnerships and other incorporated bodies that we have confirmed as active on the Companies House register, at an email address on the business's own website domain. We do not send these emails to sole traders, ordinary partnerships, personal or freemail addresses (such as Gmail or Outlook) or members of the public. Anything we cannot confirm is left out. If we contacted you in error, tell us and we will stop straight away.

What we hold. The business name; a contact person's name, where the business publishes one; its business email address; its trading or registered address, website and public phone number; its trade and area; its public Google rating and number of reviews; its company details from Companies House (company number, type and status); and a note of how we confirmed the company (for example, its company number or the legal name shown on its website). We do not take the names of directors or officers from Companies House. A named contact, or a business email address that names a person (for example jane.smith@company.co.uk), is personal data and we protect it accordingly. We also keep a record of the emails we send, any replies, any request to stop, and any business we have decided not to email.

Where it comes from. Public sources where businesses publish their details so that they can be contacted: Google Maps business listings, the business's own website, and the Companies House public register. We use no other sources for these emails.

Why, and our lawful basis. To tell businesses that are likely to benefit about our service, and to follow up if they reply. Our lawful basis is legitimate interests (Article 6(1)(f)): promoting a relevant business service to other businesses, by email, at a business address, with a simple way to say no. We have weighed this against your interests and rights in a Legitimate Interests Assessment; you can ask us for a summary. Keeping a record of opt-outs, so that we never email you again, relies on our legal obligations (Article 6(1)(c)). The Privacy and Electronic Communications Regulations (PECR) allow this kind of email to corporate subscribers without prior consent, provided every email says who it is from and gives you a free and simple way to opt out. Ours always do.

Automated steps and AI. An automated check decides whether a business is in scope: it must match an active incorporated body on Companies House and use a business email address. The only effect is whether that business receives an email from us, so it is not a decision with legal or similarly significant effects under Article 22. We may use an AI service (Anthropic's Claude, see sections 4, 6 and 7) to help word an email to your business, using only its business name, contact name, email address, town, trade and website. It never uses them to train its models.

No tracking. We do not put tracking pixels in these emails, we do not measure whether you open them, and we do not record who clicks their links: any link to our demo page or to our sample call recording is the same for everyone. The unsubscribe link carries a code only so that we know which address to stop emailing.

No automated calls. We never make automated or AI marketing calls to businesses we email. Our AI demo agent only rings someone who has asked for a demo through the form on our website and agreed to the call (section 3.1).

How long we keep it. If we never contact a business, we delete its details 12 months after collecting them. If we do contact you, we delete the record 12 months after our last email or your last reply, whichever is later. If you become a customer, your account is covered by section 3.2 instead. If you opt out, or an email to you bounces, we keep only your business email address and when, how and from which of our emails you opted out (or that it bounced), so that we never email you again, for as long as we send business emails. This includes the emails we sent you and your replies in our mailbox, which we delete on the same timetable.

Backups. We back up these records once a day, on the same encrypted computer that holds them, and delete each backup automatically after 14 days. Something we delete, or cut down after an opt-out, can stay in a backup for up to 14 days. We use backups only to recover lost records, and if we ever restore one we re-apply every deletion and opt-out before sending anything. We also keep one copy of the list of addresses we must never email again (opt-outs, bounced addresses and businesses we have chosen not to email) in our business mailbox with Google (section 6), replaced daily, so that an opt-out is never lost if that computer fails. It holds only the email address or domain, the date, how, and which of our emails it relates to, and we keep it for as long as we send business emails.

Saying no. You can stop our emails at any time, free of charge and without giving a reason: use the unsubscribe link in any of our emails, reply STOP, or email privacy@automateitonline.co.uk. We act on it before we send anything else. An objection to direct marketing covers all marketing from AutomateIT Online Ltd, not only these emails (Article 21(3)).

Your other rights. You have the rights in section 9, including access, correction and deletion, and you can complain to the Information Commissioner's Office as set out in section 14.

3.6 Community groups and our social media pages

This part applies if you post in an online group that our director, Ivan Aguilar Mari, belongs to (for example a Facebook group for UK tradespeople or Hull businesses), or if you comment on or message one of AutomateIT's own social media pages. AutomateIT Online Ltd is the controller (see section 1).

What we do. Ivan takes part in these groups to answer questions about phones, missed calls, bookings and admin for trade businesses, and to mention AutomateIT where a group allows it and where it would genuinely help. AI tools help us find the questions we can answer and write our replies (section 4). Replies are posted from Ivan's own profile or from our pages, and any reply that mentions AutomateIT says that it is his company.

What we hold. Only when a post or comment is about something we can help with, we note: a link to it and the group or page it is in; the date; a short summary of what was asked, written without surnames (we do not copy whole posts and never keep photos); our reply, with its link and date; and, if you invite us to contact you (for example "send me the details"), your first name or username, a link to your profile and the words you used. We do not collect member lists or profiles, and we do not look up your contact details anywhere else.

Where it comes from. Your post or comment in that group or on our page. A post in a members-only group is used only to reply to you in that group, or privately if you ask us to.

Private messages. We send one only when you have asked for it, and only with what you asked for. We do not send sales messages to anyone who has not asked.

Why, and our lawful basis. To answer questions where we can help, and to tell people about AutomateIT when they ask, or when it is relevant and the group allows it. Our lawful basis is legitimate interests (Article 6(1)(f)): helping trade businesses with the problems AutomateIT exists to solve, in the places where they ask about them. We have weighed this against your interests and rights in a Legitimate Interests Assessment; you can ask us for a summary.

Sorting posts. To decide whether and how to reply, our tools sort posts by topic and note whether a post asks for recommendations. This has no legal or similarly significant effect on you (Article 22).

How long we keep it. We delete these notes 6 months after the post. If you ask us to stop, we keep only your name or username, the platform and the date, so that we never contact you again.

Our own pages. If you follow, comment on or message AutomateIT's pages (for example on Facebook, Instagram, LinkedIn, Threads or Bluesky), we see what the platform shows us and reply in the same way. Each platform's own privacy policy also applies. For our Facebook and Instagram pages, AutomateIT and Meta Platforms Ireland Limited are joint controllers for the page statistics ("Page Insights") that Meta gives us; Meta's Page Insights Controller Addendum sets out who does what, and Meta answers requests about that data.

Your right to object. You can object at any time, without giving a reason, to us using your details in this way, and we will stop. Reply "stop" to us, or email privacy@automateitonline.co.uk.

3.7 Journalists, press and partners

If you are a journalist or producer who has asked publicly for expert sources (for example through a journalist request service or the #journorequest tag), or you work at a publication, podcast, trade body or business we would like to work with, we may hold your name, your organisation and role, your work email address or the contact details your organisation publishes, the request you posted, and the emails we exchange.

Where it comes from. Your public request, or contact details that you or your organisation publish for this purpose.

Why, and our lawful basis. To answer your request with relevant information, to offer a story or guide we think fits, or to suggest working together. Our lawful basis is legitimate interests (Article 6(1)(f)). We email work addresses only. If you are a sole trader or in a partnership, we only reply to a request you made yourself (PECR Regulation 22). Every email says who it is from and how to say no, and if you say no we will not contact you again.

How long we keep it. 12 months after our last email or your last reply. If you ask us to stop, we keep only your email address, the date and how you asked, so that we never contact you again.

4. How we use AI and automated processing

Several parts of the product are powered by third-party AI services. The table below summarises each one. None of these systems make decisions that produce a legal effect on you or anything similarly significant within the meaning of UK GDPR Article 22.

When you generate an agent avatar we send Gemini (a) your typed description (after sanitising by Claude Haiku to remove crude language and content-policy violations), (b) your uploaded business logo as a reference image, and (c) the gender you selected. Gemini returns a generated image that we resize and store. We never send Gemini your customer or call data.

The auto-classifier on feedback has a manual override built in. If the classifier picks the wrong category, our admin can change it from a dropdown. The classifier output is metadata only and does not change what we send to you.

4.1 Article 22 and significant decisions

None of the AI features in AutomateIT currently produces a "significant decision" within the meaning of Articles 22A to 22D of the UK GDPR (as inserted by Section 80 of the Data (Use and Access) Act 2025). They suggest, polish, summarise, transcribe or classify, and a human or the customer's own pre-configured rules drive the customer-facing outcome. The Retell agent makes automated routing decisions during a live call (whether to treat a call as an emergency, whether to escalate to a human, whether to send a payment link). We treat these as decisions with potentially similar significance and apply the following safeguards: a human (the tradesperson or their nominated escalation contact) is always reachable as a fallback; the agent does not finalise a payment without explicit caller confirmation; a caller who is unhappy with how the agent handled their call can ask for human review by contacting the tradesperson or AutomateIT directly. If we ever introduce a feature that would amount to a significant decision based solely on automated processing, we will tell the affected data subject, give them a route to make representations and to contest the decision, and enable meaningful human intervention.

4.2 No training on your data

None of our AI sub-processors are permitted to use your customer or call data to train or improve their general models. Anthropic's Commercial Terms exclude commercial API inputs and outputs from training. Google's paid Gemini API does not use prompts to improve products. Retell does not train on customer data. We monitor each provider's training-default position and will switch off any flag or stop using the provider for the affected workflow if a change would put customer or end-caller data into training without an opt-in.

5. Lawful bases for processing

In plain English: most of what we do with your data is to provide the service you signed up for. Where that's not the legal hook, the table below shows what is.

5.1 Special category and criminal-offence data

To the limited extent AutomateIT processes special category data as a controller (see section 3.3.1), we rely on Article 9(2)(c) of the UK GDPR for vital interests in emergencies, Article 9(2)(f) for legal claims, and Article 9(2)(g) substantial public interest read with paragraph 10 of Schedule 1 to the Data Protection Act 2018 (preventing or detecting unlawful acts). For criminal offence data under Article 10 of the UK GDPR (for example where a call recording happens to capture an allegation of an unlawful act), we rely on paragraph 33 of Schedule 1 (legal claims) and paragraph 36 read with paragraph 10 of Schedule 1 (preventing or detecting unlawful acts), and only to the extent strictly necessary. An Appropriate Policy Document is maintained as required when relying on the Schedule 1 substantive paragraphs above (DPA 2018 Schedule 1 paragraph 39 sets the required content).

5.2 Article 6 lawful bases

Apart from one text, all SMS sent by AutomateIT, both to prospects and to customers, are transactional under PECR, and we do not send SMS marketing. The exception is the one-off text a caller to our card demo line can ask Lucy for on the call (section 3.1). It includes a link to our plans, so we treat it as marketing: it is sent only with the consent the caller gives on the call (PECR Regulation 22), it says who we are and that it is the only text we will send, and each number only ever gets one. If we ever introduce any other SMS marketing in future, we will obtain prior consent under PECR Regulation 22 and update this notice and our forms before doing so.

PECR Regulation 22 boundary for prospect follow-up emails. Regulation 22 governs unsolicited commercial email. AutomateIT sends two types of email to prospects who have submitted the contact form but not yet signed up:

(a) Transactional follow-up of a demo the prospect explicitly requested. Examples: the signup link sent after Lucy successfully demos; the rescheduling email sent if Lucy could not reach the prospect; the "we missed you, here is your signup link" email sent after the third failed call attempt. These are continuations of the demo the prospect actively requested. They contain no promotional content beyond the link to complete the signup the prospect already initiated. Lawful basis: Article 6(1)(b) UK GDPR (steps at the prospect's request prior to entering into a contract). PECR Regulation 22 does not engage because these are not unsolicited marketing communications.

(b) Marketing emails to prospects (e.g. promotional newsletters, product update announcements, re-engagement campaigns). AutomateIT does not currently send these. If we ever did, Regulation 22 would require prior consent (the soft opt-in only covers existing customers, not prospects). The contact form would need an additional, unbundled consent checkbox before any such marketing could be sent.

AutomateIT operates on the strict (a) basis only. Any future move to (b) requires a privacy notice update, a contact-form consent change, and a written scope decision recorded in section 13.

The two paragraphs above are about people who used our contact form. Business outreach to companies (section 3.5) is different: it goes only to corporate subscribers, which Regulation 22 does not cover. Regulation 23 applies instead (every email must say who it is from and give a valid address for opting out), and every outreach email meets it.

The lawful-basis row above ("Sending you transactional emails ... Article 6(1)(f) legitimate interests for prospects") should be read together with this boundary paragraph: the legitimate-interests language reflects an operator-side balancing test for the residual logging and abuse-prevention layer around the email send, while the customer-facing communication itself rests on the Article 6(1)(b) pre-contractual basis described in (a) above.

6. Sharing and sub-processors

We never sell personal information. We do share it with carefully chosen sub-processors who run parts of the platform on our behalf. Each one is contractually bound to use the data only for the purpose we set, to keep it secure, and to delete it when we ask. Our error-monitoring provider (Sentry) has been switched on since 22 September 2026, after we accepted its data processing agreement and set it to store its data in its EU region. It is set up to collect no personal data about you (details in its row below).

The list below is current at the effective date of this notice. We will update it when it changes.

AI tools for our own marketing. For the work in sections 3.6 and 3.7 we use Claude (Anthropic, PBC, US) through a Claude subscription, and ChatGPT with Codex (OpenAI; OpenAI Ireland Limited contracts with UK users) through a ChatGPT subscription, under each company's terms for those plans. Both process data in the United States (section 7). They see the group and page content described in sections 3.6 and 3.7, never customer or call data.

CRMs you connect (not our sub-processors). If you connect your own ServiceM8 account (ServiceM8 Pty Ltd, Australia) or Jobber account (Octopusapp Inc., Canada, with hosting that includes the United States), we send the details of each job the AI agent books to that account on your instruction (section 3.3.10). The provider looks after that data for you under your own agreement with it, so it is your processor, not ours, and it is not on the list above.

Calendars you connect (not our sub-processors). If you connect your own Apple iCloud calendar (Apple Distribution International Ltd, Ireland, for UK users; Apple Inc., United States) or Microsoft Outlook calendar (Microsoft Ireland Operations Limited; Microsoft Corporation, United States), we read when you are busy and write the appointments the AI agent books into that calendar on your instruction (section 3.3.11). The provider looks after that data for you under your own agreement with it, so it is your processor, not ours, and it is not on the list above. Google Calendar is covered by the Google entry above.

For clarity, the categories of recipients of your personal data are: (a) the sub-processors listed above; (b) our professional advisers (accountants, solicitors, insurers) under professional confidentiality; (c) regulators, courts and law-enforcement bodies where we are legally required to disclose; (d) a buyer of our business in the event of a sale, on terms at least as protective as these; and (e) where a business connects its own CRM or its own Apple iCloud or Microsoft Outlook calendar, that provider, on the business's instruction (see the notes above). Other AutomateIT customers do not see your data; the application enforces row-level security on every customer-facing table so each customer can only see their own rows.

We will notify customers at least 30 days before adding or changing a sub-processor that processes their personal data, and customers may object on reasonable data-protection grounds during that window.

Several sub-processors above use their own infrastructure providers (typically Amazon Web Services, Google Cloud Platform or Microsoft Azure). Each sub-processor publishes its own sub-processor list and is contractually required to flow our transfer protections down to those onward recipients. Links to the relevant sub-processor lists are available on request.

7. International data transfers

In short: data we send abroad goes to the EEA (covered by UK adequacy) or to the US (covered by the UK-US Data Bridge where our provider is certified, otherwise by a contractual safeguard). If you connect your own CRM, what we send to it on your instruction goes to Australia (ServiceM8) or Canada and the US (Jobber), under your own agreement with that provider (see below). The same goes for an Apple iCloud or Microsoft Outlook calendar you connect.

The UK has made adequacy regulations for the European Economic Area (the Data Protection (Adequacy) (European Union) Regulations 2021 and the Data Protection (Adequacy) (European Economic Area) Regulations 2021). Transfers to providers in Ireland, Germany or any other EEA state therefore do not need additional safeguards. We will update this policy if the EEA adequacy regulations are not extended beyond their current sunset date.

The UK Government has made adequacy regulations (in force from 12 October 2023) covering transfers to US organisations that are self-certified under the EU-US Data Privacy Framework and have opted into the UK Extension. Where a US sub-processor is so certified, we rely on the UK-US Data Bridge.

The AI tools we use for our own marketing (section 6) process the community, press and partner data in sections 3.6 and 3.7 in the United States under the providers' terms for the plans we use.

For transfers to US providers where we rely on the UK IDTA or the UK Addendum to the EU SCCs (rather than on the UK-US Data Bridge), we will complete and document a Transfer Risk Assessment in line with ICO guidance, considering the laws of the destination country, the supplementary measures in place, and the practical likelihood of access by foreign public authorities. The current TRA register is held by the Director and available to the ICO on request.

CRMs you connect (optional). If you connect your own ServiceM8 or Jobber account, we send each booked job to it on your instruction. ServiceM8 is an Australian company (ServiceM8 Pty Ltd), and the UK has no adequacy decision for Australia. Jobber is operated from Canada (Octopusapp Inc.), which the UK treats as adequate only for data covered by Canada's PIPEDA, and its hosting includes the United States. Because the provider is your own processor under your own agreement with it, any safeguard needed for that transfer is part of your agreement with the provider, not a safeguard we put in place.

Calendars you connect (optional). If you connect your own Apple iCloud or Microsoft Outlook calendar, the appointments we write go to your own account with Apple or Microsoft, which may hold them in the EEA, the United States or elsewhere under your agreement with it. As with a CRM, the provider is your own processor, so any safeguard needed for that transfer is part of your agreement with the provider, not a safeguard we put in place.

We do not rely on the Article 49 derogations as a routine transfer mechanism. They are reserved for occasional, non-systematic transfers where neither adequacy nor an Article 46 safeguard is available.

The UK Addendum we use is the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, Version B1.0, in force from 21 March 2022.

If you would like a copy of the relevant transfer mechanism for any sub-processor, ask using the contact details in section 1.

8. How long we keep information

Detailed retention periods, trigger events and disposal methods are in the AutomateIT Data Retention Policy at docs/legal/data-retention-policy.md.

9. Your rights under UK GDPR

If you're a tradesperson who has signed up: these rights apply to your account data. If you're a member of the public who phoned a tradesperson on an AutomateIT number and want a copy of the call: ask the tradesperson, they're the controller. We will help them respond.

To exercise any of these rights, email ivan@automateitonline.co.uk or write to the registered office. We may need to verify your identity before we act, particularly for access and erasure requests. We will respond within one calendar month, and we will tell you within that period if we need to extend by a further two months because the request is complex.

There is no fee for exercising your rights, except in the rare cases UK GDPR allows (for example if a request is "manifestly unfounded or excessive").

Some of these rights are subject to exemptions in Schedule 2 to the Data Protection Act 2018. We do not routinely rely on any Schedule 2 exemption. We may, on a case-by-case basis, rely on paragraph 2 of Part 1 (prevention or detection of crime) when responding to a lawful police or HMRC request, and on paragraph 5 (legal proceedings) to the extent strictly necessary to defend a legal claim. We will record our reasoning whenever we do so. We do not rely on the immigration exemption in section 23 of the DPA 2018 in any context.

AI assistant memory access and erasure. Customers can view their AI assistant memory facts and request deletion of any individual fact at any time from /settings/agent/memory in their dashboard. Deletion requests soft-delete the row immediately (so the assistant stops using the fact on the next turn) and a daily retention cron hard-deletes within 24 hours. Subject access requests covering the wider AI assistant chat history can be made by emailing ivan@automateitonline.co.uk.

10. Cookies and similar technologies

We try to keep cookies to the minimum necessary to run the site. The current set is:

We do not set advertising, analytics or tracking cookies. Our visit statistics (Cloudflare Web Analytics, section 3.1) use no cookies and store nothing on your device. If we ever set any non-essential cookie, we will do so only with your prior consent through a clear cookie banner.

11. Security

Phone calls and customer data need real protection. Here is what we do:

• Live call audio is carried over encrypted SIP between Twilio and Retell; the recording is stored at Retell, encrypted at rest, and only fetched on demand by our backend (never the customer's browser) when a tradesperson plays it back through /api/calls/[id]/recording.
• Transcripts, AI summaries, business profile data and feedback rows live in Supabase (Dublin), encrypted at rest by Supabase. Logos and generated avatars sit in Supabase Storage with the same encryption.
• All transport between browser, our app on Railway, and every sub-processor is TLS 1.2 or higher.
• Row-level security is enforced on every customer-facing table. Each customer can only see their own rows. Service role keys are server-only and never reach the browser.
• Admin access from developer endpoints is restricted to the Director, MFA-protected, and logged.
• Dependency vulnerability scanning runs on every deploy. Access logs are reviewed monthly.

No system can be guaranteed completely secure. If you discover a security issue with AutomateIT please email ivan@automateitonline.co.uk rather than disclosing it publicly, and we will work with you to fix it.

11.1 Privacy by design and by default

We bake the following controls into the product so they are always on:

• The recording disclosure is server-injected into every customer's begin_message (section 3.3.4) so it cannot be turned off by accident.
• Row-level security on every customer-facing table prevents cross-tenant data access.
• End-caller transcripts are scrubbed at 24 months without admin action (see retention policy).
• We do not collect a "caller name" field by default; the agent only captures it if the caller volunteers it during the conversation.

11.2 Breach process

Internal breach process: any AutomateIT person who detects or suspects a personal data breach must report it to the Director within one working hour. The Director assesses the risk against the Article 33 and Article 34 thresholds, notifies the ICO via the online form within 72 hours where required, notifies affected data subjects where the risk to their rights and freedoms is likely to be high, and notifies any affected customer-controllers within 24 hours so they can meet their own 72-hour ICO notification deadline. Every breach (including those that did not require notification) is recorded in our internal breach log per Article 33(5).

All time periods in this section are calendar hours, not working hours. The 72-hour ICO notification clock and the 24-hour customer-controller commitment run over weekends, bank holidays and Christmas Day. The internal 1-hour-from-becoming-aware reporting target is also calendar hours.

12. Children

AutomateIT is built for adults running their own trade business. Our customer-facing surfaces (signup, onboarding, dashboard) are not directed at anyone under 18. Under UK law, the age at which a child can consent to an information society service is 13 (Article 8 of the UK GDPR as retained in UK domestic law). The phone agent itself may incidentally record a call from a child (e.g. a teenager dialling the plumber on a parent's phone). We treat any such recording as ordinary call data under section 3.3, and the customer-controller is responsible for handling it appropriately under their own privacy notice. If you believe we hold personal data of a child where there is no legitimate reason to, contact us and we will delete it.

In particular: an end-caller dialling a tradesperson on AutomateIT's number may incidentally be a child (e.g. using a parent's phone in an emergency). The customer (tradesperson) is the controller of those calls; AutomateIT, as processor, ensures (a) the recording disclosure is played at the start of every call regardless of caller age, (b) the AI agent is not configured to ask for age, identity verification, or any data category that would treat a child differently, (c) the customer-controller is responsible for any further age-aware decisions on what to do with the recording (e.g. seeking parental consent if they decide to retain it for their own purposes).

13. Changes to this notice

We will update this notice when our processing changes, when we add or remove a sub-processor, or when the law requires us to. The current version and effective date are at the top and bottom of the document. We will tell you about material changes by email if you have an active customer account, and by updating the version note on this page in any case. The previous version remains available on request.

For material changes that affect how your data is used, we will update this notice within 30 days of the change taking effect, and notify active customers by email.

Change log.

• Version 1.15 (2026-10-16): New sections 3.6 (community groups and our social media pages: what we note when someone asks a question we can help with, why, for how long, the right to object, and the joint controller arrangement with Meta for page statistics) and 3.7 (journalists, press and partners). Section 3.1: cookie-free visit statistics by Cloudflare Web Analytics; the link tag on the contact form now covers all our tagged links; the chat widget paragraph, the Cloudflare edge logs and the preview-access cookie are removed because none of them is used any more. Matching rows in sections 3.4, 4, 5.2, 6 (the Cloudflare row now covers DNS and visit statistics; the ElevenLabs row is removed; a note on the AI tools we use for our own marketing), 7, 8 and 10 (the preview-access and __cf_bm rows removed). Approved in the MarketPilot design by the Director on 2026-10-15.
• Version 1.14 (2026-10-13): Sections 3.1, 5 and 8: the card demo line (01482 267563). What we collect when you ring it, why, the one-off text you can ask for on the call (sent with your consent, once per number), the lawful bases, and how long we keep the record (12 months) and the recording (up to 6 months at Retell). The paragraph on SMS marketing now names that one text as the only exception.
• Version 1.13 (2026-10-13): Section 3.5: we keep one copy of our never-email list (opt-outs, bounced addresses and businesses we have chosen not to email) in our business mailbox with Google, replaced daily, so that an opt-out is never lost if our computer fails; the list of what we hold now names businesses we have decided not to email. Section 8 matches.
• Version 1.12 (2026-10-04): Section 3.5: the emails we sent you and your replies in our mailbox are deleted on the same timetable as the rest of the record; new paragraph on backups (daily, deleted after 14 days, used only to recover lost records); the tracking paragraph now says any link to our demo page or to our sample call recording is the same for everyone. Section 8 matches.
• Version 1.11 (2026-10-04): Sections 3.5 and 8: an opt-out record also keeps how you opted out (unsubscribe link, STOP reply or email) and which of our emails it related to, so that it matches exactly what we hold.
• Version 1.10 (2026-10-03): Section 3.1: a demo request now records whether it came from one of our business emails (a campaign tag in the link you followed, read only when you send the form; nothing is stored on your device).
• Version 1.9 (2026-10-03): New section 3.5, Business outreach: AutomateIT emails UK companies (corporate subscribers only, confirmed as active on Companies House, at business email addresses) under legitimate interests, from automateitonline.uk, with an opt-out in every email, no tracking and no automated calls. Matching rows added in sections 4, 5.2, 6 and 8; section 5.2 now separates this from marketing to contact-form prospects, which still needs consent. Scope decision: approved by the Director on 3 October 2026.
• Version 1.8 (2026-09-28): Apple iCloud and Microsoft Outlook calendars can now be connected instead of Google Calendar. Like the CRM connections, a calendar a business connects with its own Apple or Microsoft account is the business's own processor, not our sub-processor. New section 3.3.11 (what we read and write: busy times only, never stored; each booked appointment written, moved or removed), two rows in section 3.2.3 (the encrypted Apple app-specific password or Microsoft token), and notes in sections 3.3.9, 6 (with the categories of recipients) and 7, and the OAuth cookie row. Google Calendar is unchanged. No change to lawful bases or retention periods.
• Version 1.7 (2026-09-27): The optional CRM connections (ServiceM8 and Jobber) are now treated as the business's own processors: a business that connects its own account asks us to send each booked job to it, and the provider looks after that data under the business's own agreement with it, so it is no longer listed as our sub-processor. Updated sections 3.3.5, 3.3.9 and 3.3.10, section 6 (the two CRM rows replaced by a note under the table, and the CRM provider added to the categories of recipients) and section 7 (the business arranges any transfer safeguard with its provider). Jobber is being opened to customers; ServiceM8 is not yet offered while we finish testing it. No change to lawful bases or retention periods.
• Version 1.6 (2026-09-27): Google's Routes API added to the Google row in section 6: for a service a business prices by the mile, the start and end places a caller gives on the call are sent to Google to work out the road distance, so the agent can quote the price.
• Version 1.5 (2026-09-22): Sentry (error monitoring) switched on. Section 6 now describes it as active: Sentry's Data Processing Addendum (version 5.1.0) accepted on 22 September 2026, error data stored in Sentry's EU region (Frankfurt), kept 30 days on our current plan, and configured to collect no personal data (no IP addresses, cookies, headers, request bodies, query strings or user identifiers; phone numbers and email addresses blanked in error messages, by us and again by Sentry; no session replay; no performance tracing). Added its once-a-minute uptime check of our home page, whose results hold no personal data and may be stored outside the EU. No new sub-processor (Sentry has been listed since version 1.4) and no change to lawful bases or to retention of existing data.
• Version 1.4 (2026-07-05): Added Sentry (Functional Software, Inc. d/b/a Sentry) as a platform-wide error-monitoring sub-processor in section 6, listed for transparency but currently dormant (the integration is switched off with no DSN configured, so it processes no data yet; sendDefaultPii: false, no session replay). Event data will be stored in Sentry's EU region (Frankfurt) and Functional Software, Inc. is certified under the EU-US Data Privacy Framework with the UK Extension, so the transfer relies on the UK-US Data Bridge with EU SCCs and the UK Addendum as fallback; the Sentry data processing agreement will be counter-signed and the EU project created before the scaffold is switched on. No change to lawful bases or retention periods for existing data.
• Version 1.3 (2026-07-03): Documented the Stripe deposit webhook (built but dormant at this version). Added a new recipient class and purpose: a deposit-payment receipt email sent to the end-caller, on the customer's behalf, where the caller gave an email address (the end-caller data list in section 3.3, section 3.3.6, and the Resend role in section 6). Added the jobs.stripe_payment_intent_id column and the refunded deposit status, plus full-refund handling, in section 3.3.8. No change to lawful bases, retention periods or the sub-processor inventory.
• Version 1.2 (2026-06-25): Added the optional CRM connectors (ServiceM8 and Jobber) throughout: a CRM-token row in section 3.2.3, a new section 3.3.10 (CRM push), two sub-processor rows in section 6, and a CRM paragraph in section 7 on the Australia and Canada/US transfers. Recorded that the CRM connections are customer-optional, push-only, and not yet enabled for customers, pending an executed Article 46 transfer safeguard for each provider. No change to lawful bases or retention periods for existing data.
• Version 1.1 (2026-06-18): Updated section 3.1's description of the demo-call ("Lucy") caller-identification disclosures to match the current call flow. Caller identity is now given in the opening greeting, and the purpose of the call, the recording disclosure and an immediate verbal opt-out follow in the immediately-following turn, within the opening seconds and before any substantive discussion of the recipient's business. The demo call is openly acknowledged and Lucy gives an explicit AI demonstration near the end of the call; the honesty-when-asked obligation is unchanged. No change to lawful bases, retention periods or sub-processors.
• Version 1.0 (2026-05-04): Initial publication.

14. Complaints

If you are unhappy with how we have handled your personal data, please contact us first using the details in section 1 so we have a chance to put it right.

You also have the right to complain to the UK Information Commissioner's Office. The ICO's contact details are:

Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF

Helpline: 0303 123 1113 Online complaint form: https://ico.org.uk/make-a-complaint/

The ICO is the UK's independent regulator for data protection. It can investigate complaints, require us to provide information through an information notice, audit our processing through an assessment notice, require us to take or stop a particular action through an enforcement notice, and impose monetary penalties of up to £17.5 million or 4% of our worldwide annual turnover (whichever is higher) for serious breaches of UK GDPR or the DPA 2018.

You can go straight to the ICO without contacting us first, but we'd appreciate the chance to put things right ourselves.

15. Effective date and version

Version: 1.15 (AI-drafted) Effective date: 2026-10-16 Document owner: Ivan Aguilar Mari, Director, AutomateIT Online Ltd.

16. Data Protection Impact Assessment

Because the AutomateIT platform involves call audio recording, AI sentiment classification, and innovative AI technology applied to UK consumer voice data, we have committed to carrying out a Data Protection Impact Assessment in accordance with UK GDPR Article 35. The DPIA covers (a) the systematic description of the processing, (b) the necessity and proportionality assessment, (c) the risks to the rights and freedoms of data subjects (in particular UK end-callers), and (d) the technical and organisational measures we have adopted to mitigate those risks. The DPIA is reviewed when processing materially changes and at minimum annually. A redacted summary is available to customers and to the ICO on written request.