What we do with personal data

Who we are

DeskCaller Ltd, registered in England and Wales, company number 15482207. We are the controller of the personal data described here. For anything on this page, write to contact@deskcaller.com.

If you rang a business that uses DeskCaller

When you ring a business that uses DeskCaller, that business is in charge of what happens to your call: it is the controller and we process your data for it, under our data processing terms. Its receptionist tells you it is an AI, and that the call is recorded if the business records calls. To see, correct or delete what was taken from your call, ask the business; if you write to us instead, we pass your request on.

What we hold, and why

• Your account: your name, email address, phone number if you give it, your password (stored only as a hash), two-factor settings, and the devices and times you sign in. To run your account and keep it secure. Basis: our contract with you, and our legitimate interest in security.
• Your business: its name, kind, legal name and company number, address, website, what it does, its opening hours and services, and the agreement accepted for its number: who accepted it, when and from which internet address. To provide the service and give it a number, as the telecoms regulator expects. Basis: our contract, and our legal obligations.
• Billing: the billing name, email address, postal address and VAT number, and what was paid. Card details are taken by our payment provider; we see only the card’s brand, last four digits and expiry. To charge you and keep the records tax law requires. Basis: our contract, and our legal obligations.
• Calls your receptionist answers: the caller’s number, what they said as a transcript, the audio if you switch recording on, the summary, the lead and any booking. We hold these for you as your processor: see the data processing terms.
• Messages to us: what you send us by email or through Help in your account. To answer you. Basis: our legitimate interest in answering you, or our contract.
• Ask DeskCaller, the assistant on this site, and DeskCaller’s own receptionist on our phone number: what you type or say to it, and the details you choose to give it, such as your name, email, phone number and business, and any demo you book. To answer your questions, book the demo and get back to you. Basis: our legitimate interest in answering enquiries, and steps you ask us to take before a contract.
• A call you ask us for: your first and last name, email, business if you give it, and the number you type on this site for our receptionist to ring, when, and what became of the call, including if you tell it you did not ask. To ring it, to pass your details to the team as an enquiry, to ring a number at most once a day, and never again once someone says they did not ask. Basis: steps you ask us to take, and our legitimate interest in not ringing anyone who did not ask.
• Notifications: the address your browser gives us for notifications, only if you allow them. Basis: your consent, which you withdraw by turning notifications off.
• Security records: internet addresses, sign-in attempts, and a record of who did what in each account. To keep accounts secure and investigate misuse. Basis: our legitimate interest in security, and our legal obligations.

Reading this website records nothing about you: there are no analytics, tracking or advertising tags. What is kept in your browser is on cookies.

Who receives it

We use specialist suppliers to run DeskCaller, each under a written contract that limits them to doing that work for us:

• hosting for our servers, database and stored files, in the UK;
• the voice AI service that holds the conversation on each call and writes it up;
• the telephone carrier that provides and routes the numbers;
• the payment provider that takes card payments;
• the email and notification services that deliver our messages.

A business’s data also goes wherever it chooses to send it: the calendar it connects, and the webhooks and automations it sets up. We share personal data with the police, the telecoms regulator or others only where the law requires it, and with a buyer if DeskCaller is ever sold. We never sell personal data, and never use it for advertising.

Where it is kept

DeskCaller is hosted in the UK, and that is where we store your data. Some of our suppliers process data outside the UK, including in the United States, to provide their part of the service. When they do, the transfer is protected as UK data protection law requires: by UK adequacy regulations, or by the International Data Transfer Agreement or Addendum approved by the Information Commissioner.

How long we keep it

• Your account: while it is open. When you delete it, it is erased 14 days later, unless you sign in meanwhile to keep it.
• A business’s data: while the business uses DeskCaller. A business that closes is erased at the end of what it has paid for, and never sooner than 14 days after asking.
• Call recordings: only when a business switches recording on, and then for the 7 to 365 days it chooses (90 unless it changes it), then deleted.
• A caller’s details from a call: until the business deletes them, which it can do for any caller at any time, or closes.
• A number typed for a call: with what became of the call, for as long as it keeps that number from being rung again. The details given with it are kept as those given to Ask DeskCaller.
• Conversations with Ask DeskCaller: the text for 30 days. The audio is not kept unless we have switched recording on for the assistant, and then it tells you so as the call starts. Details you give it are kept until no longer needed to follow up.
• Exports of a business’s data: deleted once downloaded, or after 7 days.
• Technical logs: 30 days.
• Invoices and payments, the record of who did what in an account, and the agreement accepted for a number: for as long as the law requires, even after an account is closed.

Deletion is carried out by our systems on its date. When a caller’s details are deleted, they are deleted at our suppliers too, and checked.

How it is protected

Data is encrypted in transit. Tokens for connected calendars and other systems, and the secrets for two-factor sign-in, are encrypted with keys of their own and opened only when used. Passwords are stored only as hashes. Call audio, transcript text, passwords and card details are never written to our logs. Each business’s data is kept apart in the database. Every time our staff open a business’s conversations, recordings or account, it is recorded in an audit log.

Your rights

Under UK data protection law you can ask for a copy of your personal data, ask us to correct it, delete it, or limit what we do with it, object to what we do with it on the basis of our legitimate interests, and ask for data you gave us in a form you can take elsewhere. Where we rely on your consent you can withdraw it at any time. Write to contact@deskcaller.com and say what you want. You can also complain to the Information Commissioner’s Office at ico.org.uk.

No decision with legal or similarly significant effects on you is made by our systems alone. The receptionist answers calls for a business; what happens next is the business’s decision.

Children

DeskCaller is for businesses and is not meant for anyone under 18.

Changes

When this notice changes, the date at the top changes with it.