Privacy Policy

1. Who is responsible for what

Callers to a business. When Pickuply answers calls for a business, that business decides why and how its callers' details are used. It is the controller, and we act as its processor under our Data Processing Agreement. If you called a business and want to ask about your details, contact that business; we will help it answer you.

Our customers and website visitors. For the people who sign up, use their dashboard, try a demo or visit getpickuply.com, we are the controller.

2. What we collect

• Account details: your name, email address, business name, address, phone number and company details we need to give you a UK phone number (UK telecoms rules require the number to be registered to your business).
• Business details: the public information on your website and, where we use it, your Google Business listing (hours, services, prices, FAQs), plus anything you add or correct.
• Calls answered for you: the caller's phone number, what they say during the call (as a text transcript), the summary we make of it, and any booking, message or callback request. Call audio is not recorded or kept.
• Billing: your plan and subscription status. Card details are handled by Stripe; we never see or store your full card number.
• Calendars and other tools you connect: the free and busy times and bookings we need to book appointments, only for the tools you choose to connect.
• Website use: pages visited, clicks and errors, through PostHog analytics run without cookies. Text you type into forms is masked and never sent to analytics.
• Prospect demos: if we built a private demo for your business, we used your business's public website and listing and its published business email address. See section 6.

3. Why we use it (and our lawful basis under UK GDPR)

• To provide Pickuply (answer calls, take messages, make bookings, send you summaries, run your account): performance of our contract with you, and for callers' data, the business's instructions.
• To bill you and keep accounting records: contract and legal obligation.
• To keep the service safe and working (error reports, preventing abuse, fixing bugs): our legitimate interests.
• To understand how the website is used so we can improve it: our legitimate interests, using cookie-free analytics.
• To contact businesses about Pickuply: our legitimate interests in telling relevant businesses about a service for them, with an opt-out in every email.

4. Who we share it with

We use these service providers (sub-processors) to run Pickuply. Each only gets what it needs for its job:

• Neon: our database, hosted in London (AWS eu-west-2).
• Vercel: hosts the website and app.
• ElevenLabs: the voice that answers calls (speech to text and text to speech). Audio is not recorded; conversation data is deleted after 30 days.
• Anthropic (through Vercel's AI Gateway): the AI model that understands the call and writes summaries. It does not use this data to train its models.
• Twilio: UK phone numbers and call routing.
• Stripe: payments and subscriptions.
• Resend: sends our emails, from Ireland (eu-west-1).
• PostHog: website analytics, hosted in the EU.
• Google: public business listing details when we build your receptionist, and Google Calendar if you connect it.
• Microsoft: Outlook calendar, only if you connect it.
• Composio: the secure connection to calendars and other tools, only if you connect one.
• Cloudflare: routes email sent to our addresses.

Some of these providers are based in, or may access data from, the United States. Where data leaves the UK, we rely on the safeguards the provider offers, such as the UK International Data Transfer Addendum or the UK–US data bridge. We will tell business customers before we add or replace a sub-processor (see the Data Processing Agreement).

We do not sell personal data, and we only disclose it to others where the law requires us to.

5. How long we keep it

• Call audio: not recorded.
• Call transcripts: deleted after 30 days, both by us and by our voice provider.
• Call summaries, messages and bookings: kept while your account is open so you can see your call history, then deleted within 30 days of you closing your account or asking us to.
• Prospect demos: delete themselves after 30 days, or straight away if you press “Delete it now” on the demo page.
• Billing records: kept for as long as tax and accounting law requires.

6. Private demos and emails to businesses

We sometimes build a private demo receptionist for a business from its public website and listing, and email the business's published address about it. Each demo is on a private link, is not connected to the business's phone, and deletes itself after 30 days. Every email lets you opt out by replying “no thanks”, and we then won't email you again. In the UK we only send these emails to limited companies and LLPs.

7. Your rights

Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, and ask for it in a portable format. Email hello@getpickuply.com and we will reply within one month. If you called a business that uses Pickuply, please contact that business first. You can also complain to the UK Information Commissioner's Office at ico.org.uk.

8. Security

Data is encrypted in transit and at rest with our hosting and database providers. Access is limited to the people who need it to run the service. Connections to your calendar and other tools are stored encrypted. If a breach affects your data, we will tell affected customers without undue delay, as set out in the Data Processing Agreement.

9. Changes

If we change this policy in a way that matters, we will update the date at the top and tell account holders by email.