Privacy notice
Last updated: TODO: date
1. Who we are
Cloudflux Limited ("Cloudflux", "we", "us") runs the "Never miss a job" AI receptionist service for tradespeople. A private limited company registered in England and Wales, company number 16552311. Registered office: Mansion House, Manchester Road, Altrincham, Cheshire, WA14 4RW. ICO registration number: TODO. Contact: privacy@cloudflux.uk.
2. Our two roles
- We are the controller for personal data about our own prospects and customers, for example the tradespeople who contact us through this website, sign up for a trial or buy the service.
- We are a processor for personal data about the people who call or message our clients' businesses, such as a householder ringing a plumber. The tradesperson (our client) is the controller of that data. We process it only on their instructions, under a written Data Processing Agreement (UK GDPR Article 28). If you called a business that uses our service, please contact that business first about your data. We'll help them respond.
3. Website enquiries and trial signups (we are controller)
| What we collect | Why | Lawful basis |
|---|---|---|
| Name, business name, trade, phone, email, and anything you write to us | To reply to you, set up a trial and talk to you about the service | Steps at your request before entering a contract; legitimate interests in responding to business enquiries |
| Account, billing and contract details | To provide and bill the service | Contract; legal obligation (tax and accounting records) |
| Trial feedback and testimonials | To improve the service and, with your agreement, publish your testimonial | Legitimate interests; consent for publishing your name or business in a testimonial |
| Occasional service and marketing emails to business contacts | To tell you about updates and offers | Legitimate interests / PECR rules for business contacts. You can opt out at any time. |
| Basic technical data (server logs) | Security and keeping the site running | Legitimate interests |
This site does not use advertising or tracking cookies. TODO: update this if you add analytics or a form provider that sets cookies.
4. The receptionist service (we are processor)
For our clients, the service may process: the caller's name, phone number, address and postcode, details of the job or problem, call audio recordings, transcripts and summaries, message content, and booking details. Callers are told at the start that they're speaking to an AI assistant and that the call may be recorded. Our clients decide whether recording is on, and they're responsible for having a lawful basis (usually legitimate interests, or steps at the caller's request before a contract). We don't use callers' data for our own marketing, and we don't sell it.
5. Who we share data with (sub-processors)
We use trusted suppliers to run the service. Where possible we pick UK or EU data hosting.
| Supplier | Purpose | Location / safeguards |
|---|---|---|
| ElevenLabs | AI voice agent: speech recognition, conversation and voice | TODO: confirm region (EU residency option) / transfer safeguard |
| Twilio | Phone numbers, call routing and SMS | US/EU. UK IDTA / Addendum to EU SCCs TODO confirm |
| Google (Workspace / Calendar) | Email, calendar bookings and documents | TODO confirm region. Google data processing terms. |
| Make.com or n8n (as applicable) | Automations that send lead summaries, bookings and follow-ups | Make: EU hosting option. n8n: self-hosted TODO: confirm which one and where |
| TODO: LLM provider, website host, form provider, accounting software |
If data leaves the UK, we rely on UK adequacy regulations or appropriate safeguards such as the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
6. How long we keep it
- Website enquiries that don't go further: up to 12 months after our last contact.
- Customer and contract records: for the contract, then 6 years for tax and legal purposes.
- Caller data (processor role): call recordings TODO e.g. 30 days, and transcripts and lead summaries TODO e.g. 12 months, unless the client tells us otherwise. Everything is deleted or returned when the client's contract ends.
7. Your rights
Under UK GDPR you have the right to access your data, have it corrected or erased, restrict or object to processing (including direct marketing, at any time), data portability, and to withdraw consent where we rely on it. To use these rights, email privacy@cloudflux.uk. We'll reply within one month. If we process your data for one of our clients, we'll pass your request to them and help them respond.
8. Security
We use access controls, encryption in transit, two-factor authentication on our accounts, least-privilege access and supplier due diligence. If there's a personal data breach, we'll handle it as the law requires, and we'll tell affected clients without undue delay.
9. Automated decisions
The receptionist sorts enquiries by urgency and offers appointment slots. It does not make decisions with legal or similarly significant effects. Our clients make the final decisions on jobs and prices.
10. Complaints
Please contact us first and we'll try to fix it. You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or call 0303 123 1113.
11. Changes
We may update this notice from time to time. The date at the top shows when it last changed.