Data processing terms

You are the controller: they are your customers, calling your business, and you decide what happens to their information.

TradeFlow Assistant Limited, a company registered in England and Wales (no. 17478965). Registered office: Unit 2a Swordfish Business Park, Swordfish Close, Ormskirk, Lancashire, England, L40 8JW. is the processor: we handle that information only to provide the service, and only on your instructions.

We do not ask for card details, bank details, dates of birth or anything medical. The agent is instructed to refuse card numbers if a caller starts reading one out.

We process this data only to run the service, and only as your settings tell us to. We do not use your customers’ data for our own purposes, we do not sell it, and we do not use it to train AI models.

Running a phone line means other companies are involved. Each is bound by its own processing terms, and we stay responsible to you for them.

We will tell you before adding or replacing any of these, and you may object — in practice, by cancelling before the change takes effect.

Data is encrypted in transit and at rest. Every business’s records are separated by account, and each request is checked against the account it belongs to rather than trusting whatever it claims to be. Access to the production database is limited to the people who run TradeFlow. Passwords are hashed, never stored as text.

Call recordings and transcripts are deleted automatically once they reach the retention period set on your account — 365 days by default, which covers a full warranty year. Customer and job records are kept while your account is open. You can shorten the retention period in Settings.

If one of your customers asks for a copy of their data, or asks you to delete it, that request is yours to answer — but we will help. You can delete a contact and everything attached to them from the contact page, which removes the calls, recordings, transcripts and jobs with it.

If a request reaches us directly, we will point them to you rather than acting on it ourselves, and tell you it happened.

If we become aware of a breach affecting your data we will tell you without undue delay and in any case within 48 hours, with what we know, who is affected and what we are doing. Reporting to the ICO is your decision as controller; we will give you what you need to make it.

Export your data at any time from the dashboard. When an account closes we delete the data within 30 days, except anything we are legally required to keep — invoices, essentially.

Ask and we will answer reasonable questions about how we handle data in writing, once a year. For a full audit we would agree scope and timing with you first so it does not disturb other customers.