Privacy
Policy.
DRAFT v0.2 — for legal review. Unresolved placeholders remain. This policy is not legally approved or final.
Effective date: [Effective Date]
This policy explains how GoPro Consultants Ltd, trading as GoBOT AI ("GoBOT", "we"), uses personal data. We are registered with the Information Commissioner's Office (ICO) under number [ICO Registration Number]. Contact us about privacy at [Privacy Email] or by post at [Registered Office].
1. Our two roles
GoBOT has two different roles, depending on whose data it is:
- We are the controller for data about our own customers and their staff, people who visit our website, people who contact us, and people who report misuse. We are also the controller where we process call and message data for our own legal, regulatory, security and fraud-prevention purposes.
- We are a processor for data about the people who call, text or book with our customers ("callers"). The business you called is the controller of that data. GoBOT handles it only on that business's instructions, under our Data Processing Agreement.
If you called or texted a business that uses GoBOT: that business decides how your data is used. You should read its privacy notice and send requests to it first. We will help the business respond to you. You can also contact us at [Privacy Email] and we will pass your request on.
2. Data we collect as controller
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | Name, business name, email, phone, job title, login details, two-step login settings | You, at sign-up and in the dashboard |
| Verification (KYC) data | Business type, registration number, registered and trading address, website or Google Business Profile, authorised person's name, mobile number and email, date of birth, photo ID and proof of address for sole traders, verification results, sanctions/PEP screening results, risk flags | You; Companies House; our screening provider; our telecoms provider |
| Trial-eligibility data | Email domain, phone number, device and browser identifiers, IP address, business name and payment-card fingerprint (from Stripe), used to enforce one trial per person, business, number, email domain, device or organisation | Our systems; Stripe |
| Billing data | Plan, invoices, payment status, last four digits and expiry of card (full card details are held by Stripe, not us) | You; Stripe |
| Usage and technical data | Log-ins, device and browser, IP address, sign-in location, settings changes, feature use, allowance usage, error logs | Our systems |
| Communications | Support tickets, emails, calls with our team, survey answers | You |
| Traffic and misuse data | Call and SMS metadata (numbers, times, durations, volumes, destinations, delivery results), misuse reports and investigation notes | Our systems; Twilio; people reporting misuse; regulators |
| Website and marketing data | Pages visited, cookie identifiers, ad-campaign data (only with consent where the law requires it), marketing preferences | Our website; cookies (see the Cookie Policy); advertising platforms |
3. Why we use it and our lawful bases
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Create and run your account, provide the Services, bill you | Contract |
| Verify your business before assigning phone numbers; screen for sanctions; keep verification records | Legal obligation and legitimate interests (meeting Ofcom numbering rules and our telecoms provider's requirements, preventing fraud) |
| Run the free trial: reserve and release temporary numbers, verify the card added within 48 hours, and prevent duplicate trials | Contract and legitimate interests (preventing abuse of free allowances and temporary numbers) |
| Detect, prevent and investigate fraud, scams, spoofing, spam and number misuse; respond to misuse reports and regulators | Legitimate interests (protecting callers, customers, our platform and the public) and legal obligation |
| Secure our systems, keep audit logs, detect unauthorised access | Legitimate interests and legal obligation (security duties) |
| Customer support and service messages (for example allowance alerts, incident notices) | Contract and legitimate interests |
| Improve the Services using aggregated or de-identified statistics | Legitimate interests |
| Marketing emails to business contacts | Legitimate interests, with a simple opt-out in every email (and consent where PECR requires it) |
| Keep accounting and tax records | Legal obligation |
| Establish or defend legal claims | Legitimate interests |
Where we rely on legitimate interests, we have balanced our interests against yours. You can ask us for details. If sanctions or fraud screening returns information about criminal offences, we process it only as permitted by the Data Protection Act 2018, Schedule 1 (for example, preventing or detecting unlawful acts and preventing fraud).
4. Data about callers (processor role)
To provide the Services to our customers, we process on their behalf:
- callers' phone numbers;
- names and other details callers give;
- what they asked for and appointment details;
- vehicle registrations (where the business uses the MOT lookup);
- call recordings (if the business enables recording);
- transcripts, AI summaries, sentiment results and SMS content.
Every call starts with an announcement that the caller is speaking to an AI assistant. We do not sell caller data, and we do not use it to train third-party AI models.
5. Who we share data with
We share data only as needed with:
- service providers acting for us, listed in the Data Processing Agreement (Annex 3). These include:
- Twilio (telephony and SMS);
- Google Cloud (hosting and AI speech/language processing in the London region);
- Stripe (payments);
- [Email Provider], [Screening Provider] and [Support Tool];
- our telecoms provider and the UK networks that carry calls and messages, including for number assignment, verification and misuse investigation;
- regulators such as Ofcom and the ICO, law enforcement and courts, where the law requires or allows it (for example to prevent fraud or respond to a misuse investigation);
- professional advisers (lawyers, accountants, insurers);
- a buyer or investor in our business, under confidentiality, if the business is sold or restructured.
6. International transfers
We host the platform in Google Cloud's London (europe-west2) region. Some providers (for example Twilio and Stripe) may process data outside the UK, including in the USA and EU. Where they do, we use a lawful transfer mechanism, such as:
- UK adequacy regulations;
- the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses;
- the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified.
7. How long we keep data
| Data | Retention |
|---|---|
| Account and support data | For the life of the account, then 2 years |
| Billing and tax records | 6 years after the end of the financial year |
| Verification (KYC) records and screening results | For the life of the account plus 6 years (supports Ofcom and telecoms-provider record requirements and potential legal claims) |
| Misuse reports and investigation records | 6 years from closure of the investigation |
| Security and audit logs | 12 months (longer if needed for an investigation) |
| Caller data processed for customers (processor role) | As set by the customer: call recordings 90 days by default (configurable); transcripts, messages and call logs while the account is active. All deleted within 30 days of account closure (backups within a further 30 days) unless the customer exports it first |
| Traffic metadata kept for fraud prevention | 24 months |
| Trial-eligibility data (for duplicate-trial checks) | 24 months from the trial start |
| Website analytics and marketing cookies | See the Cookie Policy |
8. Your rights
You have the right to:
- access your data;
- have inaccurate data corrected;
- have data erased;
- restrict or object to processing (including direct marketing, at any time);
- data portability;
- not be subject to solely automated decisions with legal or similarly significant effects.
Automated verification decisions. Our verification checks are largely automated. If an automated check blocks your number assignment, you can ask for a person to review the decision, give your point of view and contest it by writing to [Support Email]. We aim to review within 1 business day.
To exercise your rights, contact [Privacy Email]. We may need to confirm your identity. We normally respond within one month.
If you are unhappy, please contact us first. You can also complain to the ICO: ico.org.uk, 0303 123 1113.
9. Security
We protect data with:
- encryption in transit and at rest, with customer-managed encryption keys for sensitive stores;
- UK-region hosting;
- network isolation, role-based access and two-step login;
- audit logging and least-privilege staff access;
- a data-loss-prevention inspection of recordings and transcripts.
No system is completely secure. If a personal data breach occurs we will act promptly. We will notify the ICO and affected people where the law requires, and our customers without undue delay where we act as their processor.
10. Children
GoBOT is a business service and is not directed at children. Customers must not configure the Services to target children.
11. Changes
We will post updates here and tell customers about material changes by email or in the dashboard.