Privacy Policy

1. Who we are

Deflectly is a trading name of SUPERVISIA LTD, a company registered in England and Wales (company number 17018774). Our registered office is 167–169 Great Portland Street, 5th Floor, London, W1W 5PF.

SUPERVISIA LTD also trades as Elite Rose Digital (website design and care for small businesses, eliterose.digital). Where this policy talks about emailing businesses (section 6f), "we" includes Elite Rose Digital.

In this policy, "Deflectly", "we", "us" and "our" mean SUPERVISIA LTD.

You can contact us about anything in this policy at support@deflectly.com. We have not appointed a data protection officer, because the law does not require us to. The email address above is the right contact for every privacy question.

SUPERVISIA LTD is registered with the Information Commissioner's Office.

2. The short version

• Deflectly answers phone calls for small businesses when they can't pick up. The person who answers is an AI assistant, and it says so.
• Calls are recorded and transcribed, so the business can see what was said and we can make the booking.
• If you called a business that uses Deflectly, that business is in charge of your data. We handle it for them, on their instructions.
• If you called Deflectly itself, emailed us, booked a call with us or became a customer, we are in charge of your data.
• We don't sell personal data and we don't use it for advertising.
• We sometimes email limited companies whose work keeps them away from the phone, to tell them about Deflectly and, briefly, about our sister service Elite Rose Digital (website design). We use details the business publishes itself, send at most three emails, and stop the moment you ask. See section 6f.
• Our website uses no tracking cookies. Our analytics are cookieless. We set one small functional cookie to remember your UK or US choice (see section 13).
• You have rights over your data, including getting a copy or having it deleted. Email support@deflectly.com.

3. What Deflectly does

Deflectly answers calls for small UK businesses when the owner can't. Our AI voice assistant:

• picks up and tells the caller it is an AI assistant;
• finds out who is calling and what they need;
• where the enquiry can be booked, books an appointment in the business's booking calendar (currently provided through Cal.com);
• texts the caller a confirmation and, before the appointment, a reminder; and
• sends the business owner a text alert about the enquiry.

If the voice assistant can't take a call, the caller may be texted instead, and the text conversation is handled by an AI text assistant. Deflectly also replies to some text messages sent to the business.

Deflectly uses the same service on its own business line.

4. Our two roles: processor and controller

Data protection law gives us a different role depending on whose behalf we are acting on.

If you called or texted a business that uses Deflectly, that business is responsible for your data. Its own privacy notice applies, and requests about your data are best sent to it. If you contact us instead, we will pass your request to the business promptly and help it respond.

5. Calls are answered by an AI, recorded and transcribed

When our assistant answers a call (for a business customer or on Deflectly's own line):

• the assistant tells you at the start that it is an AI assistant;
• the call audio is recorded by our voice provider;
• a written transcript and a short summary of the call are made and stored; and
• the details you give (such as your name and what you need) are used to make a booking or pass your enquiry on.

On Deflectly's own line, the assistant also tells you at the start that the call is recorded. Recordings and transcripts of calls to our own line may be reviewed to improve and train the Deflectly service. They are not used to train third-party AI models. For calls to a business that uses Deflectly, we use the recording and transcript only on that business's instructions (see section 7a).

If you would rather not speak to an AI assistant, you can end the call and contact the business another way.

6. What we collect

6a. Callers and people who text (including callers to Deflectly's own line)

• Your phone number, and the date, time, length and outcome of the call or message.
• What you tell the assistant, such as your name, what you need, the type of job or appointment, your postcode or area, and how urgent it is.
• A recording of the call, a written transcript and a short summary.
• The text messages exchanged with you, including the booking confirmation and appointment reminders.
• Booking details: the appointment time, the service booked and the booking reference.
• If your number can't receive texts, the assistant may ask you to key in a mobile number on your keypad, so it can text you. We use the number you key in in the same way.

We do not ask for health information, financial details or other sensitive ("special category") information. If you mention it during a call, it will appear in the recording and transcript.

You don't have to give us any of this information. If you don't give a name and a number we can text, the assistant may not be able to book an appointment or pass on your enquiry.

6b. Business customers

• Account details: business name, your name, email address, phone numbers, business type, and the services, opening hours and booking rules you want the assistant to use.
• Sign-up details: if you sign up on deflectly.com, the details you enter in our sign-up and setup forms (including your role in the business and anything you tell us about how you want calls handled), how you found us (for example a partner or event link), and your answer to our short question about how your business currently handles missed calls, even if you don't go on to become a customer.
• A record of your acceptance of our terms: your name, the business, the date and time, your IP address, your browser type, and which version of our terms and this policy you were shown.
• Names and contact details of your staff you ask us to send alerts to.
• Billing records: invoices and payment records.
• Correspondence: emails and messages you send us.

6c. People who book a call with us or email us

• If you book a call with us through our booking page (provided by Cal.com), we collect the details you enter, such as your name, email address, phone number and any notes, plus the time you choose, and Cal.com emails us the booking details.
• If you email us, we collect your email address and whatever you write.

6d. Website visitors

• deflectly.com uses Vercel Web Analytics and Vercel Speed Insights to understand, in aggregate, how the site is used and how fast it loads.
• Web Analytics does not use cookies to identify you. Vercel identifies a visit using a hash created from the incoming request, and discards it after 24 hours. The page views it records are not tied to any individual or IP address.
• Speed Insights records page performance data that is not tied to any individual visitor or IP address.
• Our hosting provider processes your IP address in server logs, so that it can deliver the site and keep it secure.
• Our site has no advertising or social-media trackers. Its only forms are our sign-up and setup forms (see 6b).
• To keep automated spam out of those forms, we use Cloudflare Turnstile. It checks signals from your browser, such as how the page was loaded, to tell people from bots. It does not use advertising cookies and we do not use it to track you.

6e. Where we get data from

Most data comes directly from you. We also receive some data from others:

• from business customers and people signing up: details of their staff for alerts, and their booking settings;
• from our phone provider: the number you call from and call details;
• from our booking provider: details of bookings made through our booking page;
• from the Companies House register (a public register): company details for businesses we contact about Deflectly and Elite Rose Digital (see 6f); and
• from businesses' own websites (publicly available): the contact details a business publishes for enquiries (see 6f).

6f. Businesses we contact about Deflectly and Elite Rose Digital

We sometimes email limited companies that we think could use Deflectly: usually trades and service businesses whose work keeps them away from the phone. Those emails may also include a short note about our sister service, Elite Rose Digital (website design and care), which is another trading name of SUPERVISIA LTD. We contact limited companies only, not sole traders or partnerships.

For each business we keep:

• from the Companies House register: the company's name, number, status, nature of business (SIC code) and registered office area;
• from the business's own website: its web address, the business email address and phone number it publishes for enquiries, its trading area, and a short note of something on the site that is relevant to missed calls (with the page address);
• our contact record: which of our emails were sent and when, whether they were delivered, any reply, and whether you have asked us to stop.

We do not collect directors' or employees' names for this. If the email address the business publishes contains a person's name, that address is personal data and we treat it that way.

We don't use tracking pixels or tracked links in these emails, so we don't know whether you opened them. We use your published phone number only to recognise a call from you to our own line. We never phone you to sell to you.

We send at most three emails in total, covering both services. Each one says who we are and how to stop them, and one "stop" ends emails about both services.

7. Why we use it, and our lawful basis

7a. When we are a processor (callers to our business customers)

We use callers' data only to:

• answer the call or message;
• understand the request;
• check availability and book the appointment;
• send the caller a confirmation and appointment reminders;
• alert the business owner by text message; and
• keep a record the business can review.

The business customer is the controller, so it decides its own lawful basis. For a caller asking to book, this will usually be steps taken at the caller's request before entering into a contract, or the business's legitimate interests (UK GDPR Article 6(1)(b) or (f)).

We do not use callers' data for our own marketing, and we do not sell it.

7b. When we are a controller

Automated decisions. We do not make decisions about anyone based solely on automated processing that have legal or similarly significant effects. The assistant books appointments within rules the business sets. If it can't help, it takes the details for the business to follow up.

AI training. Calls to Deflectly's own line are recorded, and the recordings and transcripts may be reviewed to improve and train the Deflectly service. We do not use callers' data to train third-party AI models. We do not use the data of callers to our business customers to train or improve AI models (see our Data Processing Terms).

Children. Deflectly is a service for businesses and is not aimed at children.

8. Who we share data with

We use the following providers to run Deflectly. Each processes personal data only to provide its service to us, under its terms with us.

We also share data, where needed, with:

• our professional advisers, such as accountants and lawyers, for billing records and legal matters;
• law enforcement, regulators or courts, if the law requires it; and
• a buyer of our business, if Deflectly is ever sold, under the same protections as this policy.

We will tell business customers before we add or replace a provider that processes their callers' data (see our Data Processing Terms).

9. International transfers

Some of the providers above are in the USA. When personal data leaves the UK, we rely on one of the following safeguards:

• UK adequacy regulations. For the USA, this is the "UK-US data bridge": since 12 October 2023, personal data can flow to US organisations certified under the UK Extension to the EU-US Data Privacy Framework. We checked each provider's certification on the official Data Privacy Framework list. For Ireland and the rest of the European Economic Area, UK adequacy regulations also apply.
• Contract terms approved for UK transfers, such as the UK International Data Transfer Agreement, or the Addendum to the EU standard contractual clauses.

You can ask us for more detail, or a copy of the relevant safeguards, at support@deflectly.com.

10. How long we keep data

We keep personal data only as long as we need it. Callers to business customers: we keep call records for the business customer's contract and delete or return them at the end of it, as set out in our Data Processing Terms. Callers to Deflectly's own line: we keep call recordings for 90 days, and call records, transcripts and any booking made on the call for 12 months after the call or appointment, then delete them automatically. People who email us or book through our booking page: we keep your emails and booking details for up to 12 months after our last contact with you, and delete them in a review we carry out at least once a year. Businesses we contact about Deflectly: if you don't reply, we delete your business's details 6 months after our last email. If you reply, we treat it like any other email to us (kept for up to 12 months after our last contact). If you ask us to stop, we keep only the minimum (email address, web domain, company number, date and reason) on our "do not contact" list for as long as we send marketing emails, so that we can keep to it. Business customers: account and billing records for the contract plus 6 years, as tax law requires. People who sign up but don't become customers: we keep your sign-up details and acceptance record for up to 12 months after our last contact with you, then delete them automatically. If you become a customer, your acceptance record is kept with your account records. We delete earlier if you ask and we have no legal reason to keep the data.

11. Your rights

Under UK data protection law you have the right to:

• be told how we use your data (this policy);
• get a copy of your data;
• have inaccurate data corrected;
• have your data deleted;
• restrict how we use it;
• data portability, where we rely on contract or consent; and
• withdraw consent, where we rely on it.

Your right to object. Where we use your data on the basis of legitimate interests, you have the right to object at any time. We will then stop, unless we have compelling legitimate grounds that override your interests, or we need the data for legal claims.

Stopping marketing emails. You can tell us to stop emailing your business at any time, by replying "stop" or emailing the unsubscribe address in our email or support@deflectly.com. This right is absolute: we will stop, and we don't need a reason. We add your business to our "do not contact" list straight away.

To use any of your rights, email support@deflectly.com. We will reply within one month. In some cases the law lets us extend this, and we will tell you if so. We may need to confirm your identity first.

If you called or texted a business that uses Deflectly, that business is the controller. We will pass your request to it without undue delay and help it respond.

12. Security

We protect personal data with measures that include:

• encryption in transit (HTTPS/TLS);
• access limited to the people who need it; and
• per-call security tokens and rate limits on our booking tools.

No system is perfectly secure. If a breach affects your data and is likely to result in a high risk to you, we will tell you, and we will tell the ICO where the law requires it.

13. Cookies and analytics

deflectly.com does not set advertising, tracking or social-media cookies. Our analytics don't set cookies or read information stored on your device (see section 6d), so you won't see a cookie banner.

If you choose the UK or US version of this site, we remember your choice in one small cookie called market (value uk or us, kept for a year). It contains no identifier and is not used for tracking or analytics.

On our sign-up forms only, Cloudflare Turnstile reads some information from your browser to check you're not a bot. This is strictly necessary to keep the forms secure, so it doesn't need consent.

Our booking page is provided by Cal.com on its own website. If you use it, Cal.com's own cookie and privacy notices also apply.

14. Complaints

If you are unhappy with how we have handled your data, please tell us first at support@deflectly.com. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:

• online: https://ico.org.uk/make-a-complaint/
• by phone: 0303 123 1113

15. Changes to this policy

We will update this page when our practices change, and change the effective date at the top. If a change materially affects how we use business customers' data, we will tell those customers by email before it takes effect.

16. Contact

SUPERVISIA LTD (trading as Deflectly)
167–169 Great Portland Street, 5th Floor, London, W1W 5PF
support@deflectly.com