GDPR Compliance
Last updated: 3 August 2026 — account data retention extended to up to 6 months after your account ends for fraud and chargeback prevention (previously 30 days)
1. Our Commitment
ShadowPartner is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how we handle personal data across our AI receptionist platform, and how our two-sided platform model works from a data protection perspective.
2. How Our Platform Works — Two Roles
This is important to understand.
ShadowPartner operates a platform used by business clients (e.g. a plumber, a salon) to handle calls from their customers (the callers). This creates two distinct data relationships with different rules applying to each.
| Role | Who | Responsibility |
|---|---|---|
| Data Controller (for business client data) | ShadowPartner | We control how we store and use your account data, billing data, and usage data as our customer |
| Data Processor (for caller data) | ShadowPartner | We process caller data on behalf of our business clients, following their configuration and instructions |
| Data Controller (for caller data) | Our business client (e.g. the plumber) | They decide what caller data to collect and are responsible for their callers' data protection rights |
3. What Data We Hold
3.1 About Our Business Clients (You, If You Have an Account)
- Name, email address, business name, phone number
- Business configuration — hours, services, FAQs, voice settings
- Subscription and billing status (card details held by Stripe, not us)
- Usage data — call counts, minutes used, plan usage
3.2 About Callers (Your Customers' Customers)
- Caller phone number and call timestamp/duration — always collected
- Call transcript — text record of the conversation, retained for maximum 30 days
- Caller name, appointment details, address — only when provided by caller and configured by client
- Custom fields — only when configured by the business client (e.g. vehicle registration for garages)
We do NOT store call audio recordings. Voice is processed in real time and not retained.
4. Lawful Basis for Processing
| Processing Activity | Lawful Basis | Article |
|---|---|---|
| Providing the AI receptionist service to clients | Contract performance | Art. 6(1)(b) |
| Processing caller data during and after calls | Legitimate interest (service delivery on behalf of client) | Art. 6(1)(f) |
| Sending transactional emails | Contract performance | Art. 6(1)(b) |
| AI-assisted customer support | Legitimate interest | Art. 6(1)(f) |
| AI-powered voice receptionist (call handling, transcription, response generation) | Contract performance | Art. 6(1)(b) |
| Fraud prevention and security | Legitimate interest | Art. 6(1)(f) |
| Financial record retention | Legal obligation | Art. 6(1)(c) |
5. Data Retention
| Data | Retained For | Risk Level if Exceeded |
|---|---|---|
| Call transcripts | 30 days maximum — auto-deleted | HIGH — contains conversation content |
| Caller phone numbers | 30 days — anonymised or deleted | MEDIUM — personal identifier |
| Booking contact details | 30 days after appointment | MEDIUM — personal contact data |
| Call metadata (timestamps, duration, cost) | 12 months | LOW — non-sensitive operational data |
| Account data | Duration of subscription, then up to 6 months after your account ends (fraud & chargeback prevention) | LOW — customer relationship data |
| Financial records | 7 years (legal requirement) | NONE — legally mandated |
6. Our Sub-Processors
The following third-party services process personal data on our behalf. All are bound by data processing agreements or standard contractual clauses.
| Provider | Role | Location | Data Protection Basis |
|---|---|---|---|
| Twilio | Call routing and telephony | Ireland (EU) | Automatic DPA with Terms of Service — UK GDPR addendum included |
| Stripe | Payment processing | EU / UK | Automatic DPA — GDPR compliant |
| Anthropic | AI language model — primary provider powering voice call conversations and customer support | USA | Direct agreement — DPA with UK IDTA — SCCs Module 2+3 |
| OpenAI | AI language model — fallback for voice call conversations during primary provider outages | USA | DPA with Standard Contractual Clauses — API data not used for model training |
| Deepgram | Speech-to-text — converts caller audio to text for AI processing (Twilio sub-processor) | USA | Covered under Twilio DPA |
| Google Cloud | Text-to-speech — converts AI responses to speech (Twilio sub-processor) | EU (EEA processing via Twilio IE1 region) | Covered under Twilio DPA |
| ElevenLabs | Text-to-speech — premium voice synthesis (available for select voice configurations) | EEA processing not yet confirmed | DPA available — EEA processing pending confirmation |
| Hostinger | Server hosting | EU — Paris, France | Data Processing Agreement |
| IONOS | Domain hosting, inbound and outbound email | EU — Germany | EU-based; DPA to be executed |
| Vercel | Website hosting | USA | Standard Contractual Clauses |
| Sentry | Error monitoring | EU — Frankfurt, Germany | Data Processing Agreement — EU data residency |
| Google / Microsoft | Calendar sync (optional) | USA | Customer-authorised OAuth — provider's own compliance |
7. International Transfers
Where data is transferred outside the UK, we rely on one or more of the following safeguards:
- Standard Contractual Clauses (SCCs) approved by the ICO
- EU-based infrastructure where possible (Twilio: Ireland, Hostinger: Paris, IONOS: Germany)
- Provider's own adequacy or certification framework
8. Your Rights
If you are a business client of ShadowPartner, you can exercise the following rights by contacting support@shadowpartner.co.uk:
- Access — request a copy of your personal data
- Rectification — correct inaccurate data
- Erasure — delete your account and associated data, except account data we keep for up to 6 months after your account ends to prevent fraud and payment chargebacks, a minimal record kept to prevent repeated free-trial misuse, and records we must retain by law — see our Privacy Policy for details
- Portability — download your data in JSON format
- Objection — object to processing based on legitimate interest
- Restriction — request we limit processing in certain circumstances
If you are a caller who interacted with one of our client's AI receptionists, please contact that business directly. They are the data controller for your call data.
To escalate a complaint to the UK regulator: ico.org.uk
9. Security
- All data encrypted in transit via HTTPS / TLS
- Passwords hashed using bcrypt
- Calendar OAuth tokens encrypted using PGP before storage
- Database access restricted by firewall and connection controls
- Rate limiting on all authentication endpoints
10. EU AI Act — Transparency
Article 50 — AI Disclosure to Callers
Under the EU AI Act (Article 50), which applies to AI systems deployed in the EU, callers must be informed when they are interacting with an AI system. Although the UK has not enacted equivalent legislation, we proactively support this transparency requirement for all calls. Our platform implements this through a configurable AI disclosure greeting. Business owners can enable an AI disclosure statement that is read to callers at the start of each call. We strongly recommend all business clients enable this disclosure. By default, clients are prompted to configure this setting during onboarding.
If you are a caller who interacted with one of our AI receptionists and were not informed it was an AI, please contact the business directly or reach us at privacy@shadowpartner.co.uk. The business client bears legal responsibility for their own disclosure obligations.
11. Contact
Data protection queries: privacy@shadowpartner.co.uk
Legal entity: ShadowPartner Ltd (registration pending in England and Wales), trading as ShadowPartner
This page will be reviewed by external legal counsel prior to full commercial launch.