Privacy Policy

1. Introduction

PaulSpeaks Ltd ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the PaulSpeaks Virtual Office service ("Service").

PaulSpeaks Ltd is a UK registered company. We operate in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

We collect the following types of information:

Personal Information

• Name and email address (when you create an account)
• Phone number(s) associated with your account
• Business name and address
• Billing information (processed securely via Stripe)

Service Data

• Call logs and metadata (date, time, duration, caller number)
• Call recordings (only when call recording is enabled by you)
• SMS messages received on your virtual numbers
• AI conversation transcripts
• Custom AI knowledge base content you provide

Technical Data

• IP address and browser type
• Device information
• Usage analytics and cookies

3. How We Use Your Information

We use your information to:

• Provide and maintain the Virtual Office service
• Process incoming and outgoing calls and messages
• Power the AI receptionist with your custom knowledge base
• Send call notifications via WhatsApp and email
• Process billing and payments
• Improve our AI models and service quality
• Send important service updates and communications
• Prevent fraud and ensure security
• Comply with legal obligations

4. Third-Party Services

We use the following third-party services to operate:

• Twilio – Telephony infrastructure for phone calls and SMS. Twilio processes call audio and SMS content. See Twilio's privacy policy at twilio.com/legal/privacy.
• OpenAI – AI processing for the receptionist conversations. Call transcripts may be processed by OpenAI's API. See OpenAI's privacy policy at openai.com/privacy.
• Stripe – Payment processing. We do not store your full card details. See Stripe's privacy policy at stripe.com/privacy.
• WhatsApp (Meta) – Notification delivery via WhatsApp Business API.
• Supabase – Database hosting for account data and call logs.

5. Data Retention

We retain your data for as long as your account is active, plus a reasonable period after cancellation:

• Account data: Retained while your account is active and for 30 days after cancellation.
• Call logs: Retained for 12 months, then automatically deleted.
• Call recordings: Retained for 90 days unless you request earlier deletion. You can delete recordings at any time from your dashboard.
• SMS messages: Retained for 12 months.
• Billing records: Retained for 7 years as required by UK tax law.

6. Your Rights (GDPR)

Under the UK GDPR, you have the following rights regarding your personal data:

• Right of access – You can request a copy of all personal data we hold about you.
• Right to rectification – You can request correction of inaccurate data.
• Right to erasure – You can request deletion of your personal data ("right to be forgotten").
• Right to restrict processing – You can request we limit how we use your data.
• Right to data portability – You can request your data in a machine-readable format.
• Right to object – You can object to processing based on legitimate interests.

To exercise any of these rights, please contact us at hello@paulspeaks.com. We will respond to your request within 30 days.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS/SSL), encrypted storage, access controls, and regular security reviews. However, no method of electronic storage is 100% secure, and we cannot guarantee absolute security.

8. Cookies

We use essential cookies to maintain your session and preferences. We may use analytics cookies to understand how you use our service. You can control cookie preferences through your browser settings.

9. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have collected data from a minor, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by email or through a notice on our website. Your continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: