Privacy Policy

Last updated: [DATE]

1. Who We Are

We are KindPhone Ltd, a company registered in England and Wales. We provide an automated telephone answering service on behalf of our customers (individuals who subscribe to the Service).

2. Our Role

When processing personal data of people who call numbers handled by our Service ("Callers"), we act as a data processor on behalf of our customer (the "Subscriber"), who is the data controller.

For the personal data of Subscribers themselves (account information, billing), we act as the data controller.

This privacy policy primarily addresses our processing as a controller. For information about how Caller Data is processed, Callers should refer to the privacy policy of the Subscriber whose number they called.

3. How the Service Works

When someone calls a Subscriber's number:

1. The call is carried by our telephony provider (Twilio)
2. Twilio's speech recognition (provided through its speech partner, currently Deepgram) turns the caller's words into text as they speak. This processing takes place on Twilio's infrastructure in the United States; the audio is processed to produce the text and is not stored by Twilio's speech partners. Our own servers in the United Kingdom receive only the text
3. Before any of those words go further, names are swapped for stand-ins (this is called pseudonymisation). This reduces what the AI provider could link to a named person, though the words of the conversation are themselves personal data and are protected by the no-storage commitments below
4. An AI model (Anthropic's Claude, run through Amazon Web Services in its London and European regions) composes a reply, staying within the conversation plan the Subscriber has designed: the facts it knows, the topics it may talk about, and where the conversation can go
5. Every reply is automatically checked before it is spoken; if a check fails, the Service plays a fallback message written by the Subscriber instead
6. The stand-in names are swapped back on our servers, and the checked reply text is sent to Twilio, whose text-to-speech (provided through its speech partner, currently ElevenLabs) speaks it to the caller
7. The call is recorded and transcribed. The recording and full transcript are sent to the Subscriber by email, so they see everything that was said. The recording is then deleted from Twilio, and we do not keep a copy on our servers

Nothing is stored by the AI provider. The words of the conversation are processed to compose each reply and immediately discarded, never kept, never used to train AI models. This is a contractual commitment from the provider, not just a setting. The AI processing takes place in the United Kingdom and Europe, under the same cloud safeguards used by UK hospitals for patient data.

4. Deciding on Behalf of the Person Who Calls

Many of the people this Service is designed for cannot realistically weigh up a decision like this for themselves. UK law recognises that situation. The Mental Capacity Act 2005 expects decisions for a person who lacks capacity to be made in that person's best interests, by the people who know them best and care for them.

If the Subscriber holds a registered Lasting Power of Attorney for the Caller, or is a court-appointed deputy, they have formal legal authority to make decisions of this kind on the Caller's behalf.

Many family carers do not hold a power of attorney. Our position, held in good faith, is that a family member providing day-to-day care is exactly the person the law expects to make everyday welfare decisions in the person's best interests, and deciding how their calls are answered when nobody can pick up is such a decision, in the same family as setting up voicemail, call forwarding, or a carephone on their behalf. In data protection terms, the Subscriber, as controller, relies on the legitimate interests of the Caller and their family in staying connected, reassured and safe (UK GDPR Article 6(1)(f)), applied with the safeguards this policy describes: the family controls everything the Service knows and can say, sees the recording and full transcript of every call, the Service never asks the Caller for information, and the arrangement can be stopped at any time.

We ask every Subscriber to confirm that they are either the Caller's attorney or deputy, or a family member or carer making this decision in the Caller's best interests.

This is our honest understanding of UK law applied to an unusual situation. It is not legal advice, and if you are unsure of your own position, the Office of the Public Guardian's guidance on the Mental Capacity Act is a good place to start.

5. Data We Process as Controller (Subscriber Data)

6. Data We Process as Processor (Caller Data)

On behalf of our Subscribers, we process the following Caller Data:

• Telephone numbers of Callers
• Voice recordings of calls
• Transcripts of conversations (generated by speech recognition)
• Call metadata (date, time, duration)
• Caller names (where the Subscriber has configured known callers)

This data is processed solely to provide the answering service to the Subscriber. We do not use Caller Data for our own purposes, including AI training.

Whether we look at or learn from your family's calls

By default, we do not review your family's calls and we do not use them to improve or train the Service. The transcripts and recordings exist for you, not for us. There are exactly two situations in which that changes, and both are under your control:

• If you report a problem, we will look at the specific calls needed to investigate it, and only those.
• If we ever wanted to use your family's calls to improve the Service (for example, testing an improvement against real conversations), we would discuss it with you first and proceed only with your explicit permission. You can say no, and you can withdraw permission at any time.

Separately from KindPhone's own practices, the AI providers we use are contractually prevented from training on any of this data, as described in the sub-processor table below.

If you are a Caller and wish to exercise your data protection rights (access, deletion, correction, etc.), please contact the individual whose number you called. They are the data controller for your data.

7. Sub-processors

Twilio, Audio and Speech Processing

All voice calls handled by the Service are carried by Twilio's telecommunications infrastructure. We also use Twilio's ConversationRelay feature during calls: Twilio and its speech partners turn the caller's speech into text in real time and speak the Service's checked replies. This means the caller's voice is processed by Twilio and its speech partners (currently Deepgram for recognition and ElevenLabs for the voice) on infrastructure in the United States. Our own servers receive and send only text.

The audio is transient: it is processed to produce text (and speech) during the call and is not stored by Twilio or its speech partners. We chose this arrangement because Twilio's speech recognition is substantially more reliable for elderly callers on telephone lines than what we could run on our own servers, and a call that falls silent fails the caller more badly than this trade-off does. Our technical page explains the same decision in more detail.

Call recordings. Every call is recorded. Twilio makes the recording during the call; after the call ends we download it, send it to the Subscriber by email along with the transcript, and then delete the recording from Twilio. We do not keep a copy of the recording on our servers.

Under Twilio's Data Protection Addendum, Twilio processes Caller Data as a data processor acting on our instructions. Twilio's DPA provides that:

• Customer data is processed only as necessary to provide the telecommunications service
• Twilio implements appropriate technical and organisational security measures
• Data is deleted within 30 days of service termination, with backups deleted within 60 days
• Transfers are protected by Standard Contractual Clauses and the EU-US Data Privacy Framework

Important note: Twilio's DPA also permits Twilio to process certain data as an independent controller for limited business purposes (such as billing, capacity planning, and abuse prevention). This is comparable to how a traditional telephone company may process call metadata. Beyond the ConversationRelay speech processing described above, we do not enable Twilio analytics features that would process call audio content.

Browser-Based Help Calls

Our website includes an optional "Try it" feature that lets visitors experience the Service through their browser. These calls also route through Twilio's infrastructure using the Twilio Client SDK, which provides proper audio channel separation (the same technology used for WebRTC-based telephony). The same data handling practices described above apply to browser-based calls.

AI During Calls

During a call, the text of what the caller has said (and the conversation so far) is sent to an AI model (Anthropic's Claude, run through Amazon Web Services (Bedrock) in its London and European regions) so that it can compose each reply. Before any words are sent, names are replaced with stand-ins (pseudonymisation) and swapped back only on our own servers. The AI is never sent phone numbers or voice recordings, only text.

Nothing is stored by the AI provider. The words are processed to compose the reply and immediately discarded. They are never kept and never used to train AI models. This is a contractual commitment, not just a setting. Amazon Web Services is the same cloud infrastructure used by UK hospitals for patient data, and the processing stays in the United Kingdom and Europe.

Replies are turned into speech using Amazon Polly, Amazon's speech synthesis service, also in UK/European regions.

Every reply is automatically checked before it is spoken. If a check fails, the Service plays a fallback message written by the Subscriber instead. The Subscriber receives the full transcript of every call.

8. International Transfers

Caller Data may be transferred to the United States for telephony connectivity (Twilio). These transfers are protected by the UK International Data Transfer Agreement (IDTA), EU Standard Contractual Clauses with the UK Addendum, and the EU-US Data Privacy Framework (where applicable).

AI processing and speech synthesis take place in Amazon Web Services regions in London and Europe. The words of a call do not leave the United Kingdom or Europe for that processing. Hosting is on our own servers in the United Kingdom.

9. Data Retention

• Caller Data: Retained for the period configured by the Subscriber, up to a maximum of 90 days, then automatically deleted.
• Subscriber account data: Retained for the duration of the subscription plus 30 days.
• Billing records: Retained for 6 years as required by HMRC.

10. Your Rights (Subscribers)

As a Subscriber, you have the right to access, rectify, erase, restrict, port, or object to the processing of your personal data. You may also withdraw consent where processing is based on consent, and complain to the ICO (ico.org.uk).

11. Your Rights (Callers)

As a Caller, please contact the individual whose number you called to exercise your data protection rights. They are the data controller. We will assist them in fulfilling your request.

12. Security

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS 1.2+), encryption at rest, access controls, pseudonymisation of names before AI processing, automated data deletion after retention periods, and regular security reviews.

13. Speech Recognition and Transcripts

Speech recognition runs on our own servers in the United Kingdom: the caller's voice is turned into text there, and the audio is not sent to any third party for recognition. The full transcript of every call is made available to the Subscriber, so the Subscriber can always see exactly what was said, by the caller and by the Service.

14. Children

The Service is not directed at children. We do not knowingly process personal data of children under 13.

15. Changes to This Policy

We may update this policy from time to time. Material changes will be notified to Subscribers by email.