Privacy Policy

Data Beam Limited (Company Number: 15741828), registered at Office 8763, 321-323 High Road, Chadwell Heath, Essex RM6 6AX, UK is the data controller for personal data collected through our website and dashboard. For personal data of your salon's callers, you (the salon owner) are the data controller and we act as your data processor.

Account data: your name, email address, salon name, and payment information (processed by Stripe — we do not store card details). Call data: phone numbers of callers, call recordings, transcripts, booking details, and call metadata (duration, time, outcome). Usage data: pages visited, features used, and interaction events (collected via PostHog EU Cloud — no PII included in analytics events). Technical data: IP addresses, browser type, and device information for security and fraud prevention.

To provide and improve the Service, including AI call handling, appointment booking, and dashboard features. To process payments and manage your subscription. To send transactional communications (booking confirmations, account alerts). To analyse usage patterns and improve the Service (using anonymised, aggregated data only). To comply with legal obligations and enforce our Terms of Service.

Contract: processing necessary to provide the Service you have subscribed to. Legitimate interests: improving the Service, preventing fraud, ensuring security. Legal obligation: complying with tax, accounting, and regulatory requirements. Consent: where required, such as for marketing communications (you can withdraw consent at any time).

We share personal data only with trusted third-party processors who help us deliver the Service: - Supabase (database hosting — EU region) - Stripe (payment processing) - Twilio (telephony and SMS) - Deepgram (speech-to-text and text-to-speech — zero data retention enabled) - Anthropic (AI language model — caller phone numbers are never sent to Anthropic) - PostHog (analytics — EU Cloud, no PII) - Hetzner (server hosting — London region) We do not sell personal data to third parties.

Account data: retained while your account is active, plus 30 days after deletion. Call recordings: retained for 90 days by default, then automatically deleted. Call transcripts and metadata: retained while your account is active. Payment records: retained as required by UK tax law (typically 6 years).

Under the UK GDPR, you have the right to: - Access your personal data - Rectify inaccurate data - Erase your data ("right to be forgotten") - Restrict or object to processing - Data portability - Withdraw consent at any time To exercise these rights, contact us at hello@glossivo.ai. We will respond within 30 days.

We implement appropriate technical and organisational measures to protect your data, including: - Encryption in transit (TLS) and at rest - AES-256 encryption for OAuth tokens - Signed, time-limited URLs for call recordings - Row-level security (RLS) on all database tables - Caller phone numbers are hashed (SHA-256) before being sent to AI services - Regular security reviews

Where data is processed outside the UK (e.g., by Anthropic or Stripe in the US), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

The Service is not intended for use by anyone under 18. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. We will notify you of material changes by email. The "Last updated" date at the top of this page indicates when it was last revised.

For privacy enquiries or to exercise your data rights: Data Beam Limited Company Number: 15741828 Office 8763, 321-323 High Road, Chadwell Heath, Essex RM6 6AX, UK Email: hello@glossivo.ai