Privacy Policy
In short. If you visit our website, send an enquiry or use an ansame account, we decide how your data is used and this policy explains it (Part A). If you phone a business that uses ansame, that business decides how your data is used and we handle it on its behalf (Part B). We use only essential cookies. We never sell personal data.
1. Who we are
ansame is a trading name of YNT Advisory Ltd, a company registered in England and Wales with company number [COMPANY NUMBER], registered office [REGISTERED ADDRESS] ("we", "us"). We are registered with the Information Commissioner's Office (ICO) under registration number [ICO REGISTRATION NUMBER].
ansame provides an AI receptionist ("Sophie") that answers phone calls for businesses. This policy explains how we use personal data under the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
Contact us about privacy at hello@ansame.uk, or by post to YNT Advisory Ltd, [REGISTERED ADDRESS]. We have not appointed a Data Protection Officer because we are not required to; questions go to the same address.
2. Part A: website visitors, enquirers and account users
For this data, we are the controller.
2.1 What we collect
| Who | Data | Where it comes from |
|---|---|---|
| Website visitors | Technical data our hosting provider processes to deliver and protect the website (IP address, browser type, pages requested, date and time). We do not use analytics or advertising trackers. | Your browser |
| People who send an enquiry or request a demo | Name, business name, email address, phone number, number of sites, your message. A one-way scrambled (hashed) form of your IP address, used only to stop spam. | You, through the form |
| Business customers and their account users | Name, work email, role, the business you belong to, a securely hashed password (we never see or store your actual password), login times, session data, settings you enter, support messages, and billing details. | You, your employer, or us when we set up your account |
| People who accept our terms | A record of acceptance: who accepted, for which business, which document versions, a fingerprint (hash) of the exact text accepted, the date and time, your IP address in full and your browser's user agent. | Your browser when you tick "I agree" |
| Login security | Hashed IP addresses and email addresses of login and setup attempts, to block password-guessing. | Your browser |
2.2 Why we use it and our lawful basis
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Replying to your enquiry, arranging a demo and following up about it | Legitimate interests (responding to people who contact us about our service), or steps at your request before entering a contract |
| Creating and running accounts, providing the Service, support, service emails (such as setup links, alerts and changes to terms) | Performance of a contract with your business, and our legitimate interests in providing the Service to your employer |
| Billing, invoices, accounting and tax records | Contract and legal obligation |
| Recording acceptance of our terms, including your full IP address and browser, and emailing a receipt to you and to us | Legitimate interests (keeping reliable evidence of who agreed to what and when, so we can prove the agreement and defend legal claims) |
| Keeping the Service and accounts secure, preventing fraud and spam | Legitimate interests (security) |
| Occasional emails about new ansame features to business contacts | Legitimate interests, and PECR's "soft opt-in" where it applies. You can opt out at any time by replying or clicking unsubscribe. We do not send marketing to callers. |
| Meeting legal duties and responding to lawful requests | Legal obligation |
Where we rely on legitimate interests, we have weighed them against your rights and you can object (see section 8).
2.3 How long we keep it
- Enquiries: up to 24 months after our last contact with you, unless you become a customer.
- Account data: while the account is active, then up to 90 days after it closes.
- Acceptance records, invoices and contract records: 6 years after the contract ends (the period in which legal claims can be brought), then deleted.
- Login security records: normally up to 90 days.
- Hosting and security logs held by our hosting provider: for the short period set by that provider.
3. Part B: people who call a business that uses ansame
When you phone a business that uses ansame (for example a tradesperson, clinic, salon, agency or care home), your call may be answered by Sophie, an AI receptionist. For this data, the business you called is the controller and decides how your data is used. We are its processor: we handle your data only on the business's instructions, under a written contract that meets Article 28 of the UK GDPR. The business's own privacy notice applies, and you should contact the business first to exercise your rights. If you contact us, we will pass your request to the business.
3.1 What is collected during a call
- Your phone number (caller ID) and the date, time and length of the call.
- A written transcript of the call. An audio recording is made only if the business has switched call recording on, and is kept only if you agree (see 3.4).
- A summary of the call, and the details you give: your name, contact details, why you called, any message, how urgent it is, and any appointment, booking or quote details (for example address, the job or service needed, preferred times).
- Anything else you choose to say. Depending on the business, this can include sensitive information such as health or care needs. Please share only what is needed.
3.2 What it is used for
To answer your call, give you information the business has provided, take your message, book appointments, prepare a draft quote, alert the business to urgent matters, and send the business a summary so it can call you back. Your voice is processed in real time by speech-recognition, AI language and speech-synthesis services so that Sophie can understand and reply to you. The business's lawful basis is normally its legitimate interests in handling calls, or steps you ask for before a contract; for sensitive information the business must have an additional condition, which it explains in its own notice.
3.3 How long it is kept
The business decides. By default, call records (transcript, summary, message, booking and quote) are kept while the business has an ansame account and are deleted within 90 days after it leaves, unless the business deletes them sooner or asks us to keep them for a shorter period. Call recordings you agreed to are deleted 12 months after the call, or sooner if the business deletes them or leaves ansame. Copies sent to the business by email or to its own systems are kept under the business's control.
3.4 Call recording: your choice
Call recording is off by default. Each business decides whether to switch it on. If it is off, no audio of your call is kept; only the written record above.
If the business has switched it on, Sophie tells you at the very start of the call that the call is recorded and asks whether that is OK. You can say no.
- If you say yes, the recording is kept and the business can listen to it, for example to check details of your message. It is deleted 12 months after the call (or sooner, as above).
- If you say no (or don't clearly agree, or hang up before answering), Sophie confirms that recording is off and carries on helping you as normal. No recording of your call is kept. Because the phone system may have captured the first few seconds before you answered, that audio is deleted from our voice provider's systems straight after the call; it is never stored by us or given to the business. The written transcript, summary and message are still kept so the business can help you.
- Your answer (yes or no) is noted against the call, so the business and we can show what you chose.
You can change your mind during the call: tell Sophie you don't want it recorded and no recording will be kept.
3.5 Being told it's an AI
Businesses that use ansame agree to tell callers that they are speaking to an AI. Sophie is designed to answer honestly if you ask whether she is a person. If you would rather speak to a person, say so and Sophie will take a message for the team to call you back.
Sophie is not an emergency service. In an emergency, hang up and ring 999.
4. Who we share data with
We share personal data only with service providers who help us run ansame (sub-processors), under contracts that require them to protect it and use it only to provide their service to us:
| Provider | What they do | Location |
|---|---|---|
| Cloudflare, Inc. | Website hosting, database, security and storage | Global network; may process in the US and elsewhere |
| Vapi (Vapi, Inc.) | Voice AI platform that runs the calls and holds transcripts, and call recordings where the caller agreed to recording | US |
| Twilio Inc. | Phone numbers and call connection | US and other regions |
| OpenAI, L.L.C. | AI language model used during calls (through Vapi) and, when used, to read business websites and pick quote items | US |
| Deepgram, Inc. | Speech recognition (turning speech into text), through Vapi | US |
| ElevenLabs (Eleven Labs, Inc.) | Speech synthesis (Sophie's voice), through Vapi | US |
| Resend (Plus Five Five, Inc.) | Sending emails such as call summaries, setup links and receipts | US |
| Calendly, Google, Microsoft | Only if a business connects its calendar: booking details are sent to that calendar | US and other regions |
We may also share data with professional advisers, with a buyer of our business (who must protect it in the same way), or where required by law, a court or a regulator. We do not sell personal data, and we do not use callers' data to train our own AI models.
5. Transfers outside the UK
Some of our providers are based in, or process data in, the United States or other countries outside the UK. When personal data is transferred outside the UK, we make sure it is protected by one of the following safeguards: (a) the country has UK "adequacy regulations"; (b) the provider is certified under the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"); or (c) we use the ICO's International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. Contact us for more information about the safeguard used for a particular provider.
6. How we keep data secure
Data is encrypted in transit (HTTPS/TLS) and stored with providers that encrypt it at rest. Passwords are stored only as salted, slow hashes; session tokens and API keys are stored only as hashes. Each business can see only its own data, and access is protected by login and rate limits. Webhooks are signed. Access by our staff is limited to what is needed to provide and support the Service. No system is perfectly secure, but if a breach affecting your data occurs we will act quickly and tell the ICO, the business concerned and you where the law requires.
7. Cookies
We use only one strictly necessary cookie, and only when you log in:
| Name | Purpose | Duration |
|---|---|---|
__Host-ansame_sid | Keeps you securely logged in to your ansame account. It holds a random session token and nothing else. | Up to 14 days, or until you log out |
Because this cookie is strictly necessary to provide the service you have asked for, PECR does not require consent for it, so we do not show a cookie banner. We do not use analytics, advertising, social media or tracking cookies, and our website fonts are hosted by us, not by a third party. If we ever add non-essential cookies, we will ask for your consent first and update this policy.
8. Your rights
Under UK data protection law you have the right to: be informed about how your data is used; access a copy of your data; have inaccurate data corrected; have data erased in some circumstances; restrict how it is used; object to processing based on legitimate interests and to direct marketing at any time; data portability; and not be subject to decisions based solely on automated processing that have legal or similarly significant effects.
To use these rights for Part A data, email hello@ansame.uk. For Part B data (calls), contact the business you called; if you contact us we will forward your request to it promptly and help it respond. We will reply within one month, and may ask you to prove your identity. There is normally no charge.
9. Automated decisions and AI
Sophie uses AI to understand callers and to write summaries, bookings and draft quotes. She does not make decisions that have legal or similarly significant effects on callers: she takes messages and books appointments within the rules a business sets, and people at the business review messages, bookings and quotes and make the decisions.
10. Children
Our website and accounts are for businesses and are not aimed at children. Children may sometimes call a business that uses ansame; their data is handled in the same way as other callers' data, under the business's control.
11. Complaints
If you have a concern about how we use personal data, please contact us first at hello@ansame.uk so we can try to put it right. You also have the right to complain to the UK regulator, the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
12. Changes to this policy
We may update this policy. The version and date at the top show when it last changed, and we will tell account users about significant changes by email or in the dashboard.
See also our Terms of Service and Data Processing Agreement.