Privacy Policy

Last updated: 24 September 2026 · Trades AI Operator Ltd (Companies House 17114582)

1. Who We Are

Trades AI Operator Ltd is the data controller for personal data processed through our platform. We are registered in England and Wales under Companies House number 17114582, registered office at 5 Brayford Square, London, E1 0SG.

ICO registration number: registration pending — to be updated on receipt.

Data protection contact: admin@tradesaioperator.uk

2. What Data We Process

Data about your customers (End Users — callers to your business):

• Full name and phone number
• Postcode and job type
• Call recordings processed via Retell AI
• Call transcripts and intent classification
• SMS message content (via Twilio)
• A record of numbers that asked not to be texted (so we never text them again)
• Booking details, scheduled dates, and job status
• Emergency severity flags

Data about you (the trade business operator / Customer):

• Name, email address, and phone number
• Business name and trade type
• Google Calendar ID and Google Sheets ID
• Twilio number allocated to your account
• Booking and revenue records
• Payment data via Stripe (when payment functionality is live)

3. Lawful Basis for Processing

• Art. 6(1)(b) — Contract performance: Processing necessary to deliver the AI receptionist service you have subscribed to.
• Art. 6(1)(f) — Legitimate interests: Processing call recordings and transcripts to detect emergencies, improve service quality, and ensure platform security, balanced against data subject rights.
• Art. 6(1)(c) — Legal obligation: Retaining financial records for 6 years as required by HMRC.

4. Retention Periods

• Active service data (call logs, bookings, transcripts): 12 months from creation, then purged. One exception: if a message is flagged by our AI provider’s trust-and-safety classifiers, that provider may retain it for up to 2 years under its own policy, which we cannot shorten or recall — see Section 6.
• Account and billing records: 6 years from the end of the relevant tax year (HMRC requirement).
• Marketing opt-outs: if someone replies STOP to a marketing text, we keep a record of that number, for as long as the business uses Trades AI Operator, so we never text them marketing again. It holds the phone number only and is not deleted on an erasure request, because honouring the request not to be contacted depends on it.
• Call recordings: Subject to Retell AI's own retention policy — see retellai.com/legal/privacy-policy.
• GDPR request logs: 3 years to demonstrate compliance.

5. Your Rights Under UK GDPR

• Right of access (Art. 15): Request a copy of all personal data we hold about you.
• Right to rectification (Art. 16): Ask us to correct inaccurate or incomplete data.
• Right to erasure (Art. 17): Request deletion where there is no overriding legal basis for retention.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests.
• Right to restrict processing (Art. 18): Ask us to limit how we use your data while a dispute is resolved.
• Right to withdraw consent: Where processing is consent-based, withdraw at any time without affecting prior processing.

We will respond to all requests within one calendar month. See Section 8 for how to submit a request.

6. Sub-Processors

We share data with the following sub-processors only as necessary to provide the service.

Anthropic is engaged directly by us, in addition to being engaged by Retell AI for the voice agent's replies. We send customer photos submitted by SMS to Anthropic for photo-based quote estimation (see the table above). Anthropic also processes call data via Retell — the AI model that generates the receptionist's replies — alongside ElevenLabs (voice synthesis) and the further providers published at trust.retellai.com/subprocessors. Retell is contractually required to keep that list current, and to give us at least 15 days' notice before any new provider processes personal data.

Anthropic's retention of our direct submissions: inputs and outputs are deleted within 30 days in the ordinary case. If a submission is flagged by Anthropic's trust-and-safety classifiers, Anthropic may retain it for up to 2 years. This exception can outlive the 12-month retention period we describe in Section 4 — a flagged item held by Anthropic under its own policy is not something we can shorten or recall.

Stripe is not a sub-processor. Stripe processes our own subscription billing and payment records — your business's account and card details — and never receives your customers' data. For that billing relationship we act as an independent controller, and Stripe's own published position is that certain of its entities act as joint controllers. Stripe's privacy policy governs that processing.

7. International Transfers

Several of the providers above are based in the United States. Every restricted transfer is made under a lawful mechanism, and the mechanism differs by provider:

Providers covered by the UK Extension to the EU–US Data Privacy Framework, which the UK Government has recognised as providing an adequate level of protection: Twilio, Google, Vercel, and Make (Celonis Inc.).

Providers covered by the UK Addendum to the EU Standard Contractual Clauses, together with a documented transfer risk assessment: Retell AI, and Anthropic, PBC — both as engaged by Retell for the voice agent, and as engaged directly by us for photo-based quote estimation. Anthropic is a direct US transfer in its own right, not only a transfer made on Retell's behalf.

Providers processing within the UK or EU, where no restricted transfer arises: Resend (Ireland) and Sentry (EU data storage region).

We keep the executed agreements and the transfer risk assessments on file, and we review each provider's status before its certification falls due. You may request a copy of the safeguards applying to any provider by emailing admin@tradesaioperator.uk.

8. Exercising Your Rights

Client account holders can exercise these rights as follows:

• Data export (Art. 15 / Art. 20): Sign in and use the Download my data button on your account page. It gives you a JSON file of your business details and the call, booking and emergency records held for your account.
• Account deletion (Art. 17): Email admin@tradesaioperator.uk from your registered address. Where we are able to erase, we anonymise your records rather than delete the rows outright, so that your own job and revenue history remains usable. Some records are kept where the law requires it — billing records for HMRC, for example.

For other requests or if you are an End User (caller) whose data was processed, email admin@tradesaioperator.uk. We will respond within one calendar month.

9. Complaints

If you believe your data has been mishandled you may lodge a complaint with the UK supervisory authority:

We would appreciate the opportunity to address concerns directly before an ICO referral.

10. Contact Us