Privacy notice
Last updated 1 November 2026
This explains what personal information aiflo collects, why, who sees it and how long we keep it. In short: we only collect what we need to answer calls for our clients, run their accounts and reply to enquiries. We don't sell your data and we don't use advertising or tracking cookies.
1. Who we are
aiflo is a UK sole trader business, and aiflo is our legal name. We provide a virtual receptionist service: we answer phone calls for other businesses, take messages and send them a summary by email. In this notice "aiflo", "we" and "us" mean that business.
For any privacy question or request, email info@aiflo.co.uk. We aim to reply within one month.
2. If you called a business that uses aiflo
When you ring a business that uses aiflo, your call may be answered by our virtual receptionist on their behalf. In that case the business you called is in charge of your information (the "controller") and we handle it only on their instructions (as their "processor").
We collect your phone number, the call recording, a written transcript and a short summary of your message, and send these to that business so they can get back to you. If you'd like to see, correct or delete this information, contact the business you called. You can also email us and we'll pass your request on and help them deal with it.
3. What we collect and why
| Information | Why we use it | Legal basis |
|---|---|---|
| Calls we answer for clients: caller's phone number, call recording, transcript and summary, call time and length | To answer the call, take the message, email it to our client and show it in their portal | We act for our client, who decides the basis (usually their legitimate interests in handling their calls) |
| Enquiries from our website form or email: name, business, phone, email and message | To reply to you and talk about the service | Our legitimate interests in answering enquiries, or steps you ask for before a contract |
| Client portal accounts: email address, a scrambled (hashed) password, login and security records, and the business details and script you add | To give you secure access to your calls, script and invoices | Our contract with you |
| Invoices and payments: billing name and email, invoice details and payment status | To bill for the service and keep proper accounts | Our contract with you, and our legal duty to keep tax records |
Payments (card, Pay by Bank, bank transfer and Direct Debit) are handled by Stripe. We never see or store your full card details. For Direct Debit we keep only the last four digits of the account, the sort code and the mandate reference, so we can show them in your portal. We don't make decisions about anyone using only automated means that have legal or similarly significant effects.
4. Who we share it with
We use a small number of trusted providers to run the service. They only use the information to provide their service to us:
- Retell (USA): runs the virtual receptionist, and processes and stores call recordings, transcripts and summaries.
- Twilio (USA): connects phone calls.
- Netlify (USA): hosts this website and the client portal, and stores portal accounts, invoices and enquiries.
- Stripe: processes top-ups and invoice payments (card, Pay by Bank, bank transfer and Direct Debit).
- IONOS: our email provider, used to send call summaries and invoices and to receive your emails.
- Google Fonts: supplies the font this website uses, so your browser connects to Google, which sees your IP address.
We also share information with our clients (for calls made to them), and if the law requires it, for example with HMRC. We never sell personal information.
5. Data outside the UK
Some of our providers store or process data in the USA. When that happens we rely on the protections UK law requires, such as the UK–US "data bridge" for certified companies, or the UK's approved contract terms (the International Data Transfer Agreement or Addendum).
6. How long we keep it
- Call recordings, transcripts and summaries: kept for 2 years from the date of the call, then deleted. We delete them sooner if our client asks us to, or when the client leaves.
- Enquiries: up to 12 months after we last heard from you, unless you become a client.
- Portal accounts: while the account is open. We delete it when you or your business stop using the service.
- Invoices and payment records: for 6 years, as UK tax law requires.
7. Cookies
The website itself sets no cookies. The client portal uses one essential cookie to keep you logged in securely. It's removed when you log out or after it expires. We don't use analytics, advertising or tracking cookies, so we don't ask for cookie consent.
8. Security
The site and portal only use encrypted connections. Passwords are stored scrambled, never in plain text. Each client can only see their own calls, and recordings are streamed from our call provider rather than copied elsewhere. Access to client data is limited to aiflo.
9. Your rights
Under UK data protection law you can ask us to:
- give you a copy of your personal information
- correct anything that's wrong
- delete it
- limit how we use it, or object to us using it
- send it to you or another organisation in a reusable format
Email info@aiflo.co.uk. It's free, and we'll reply within one month. We may need to check who you are first. If your request is about a call you made to one of our clients, see section 2.
10. Complaints
If you're unhappy with how we've handled your information, please tell us first at info@aiflo.co.uk so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.
11. Changes to this notice
We'll update this page if anything changes, and change the date at the top. If a change is significant, we'll tell our clients by email.