Privacy Policy | Dialogue Flow

1. How Our Services Work

Our clients purchase and maintain their own subscriptions to third-party AI platforms (such as ElevenLabs for voice AI and n8n for workflow automation). We assist them in setting up and configuring these platforms.
We provide a web dashboard that connects to our clients' own third-party accounts using API keys provided by the client. The dashboard displays usage statistics, call transcripts, caller details, and other data sourced from the client's own accounts.
We do not maintain our own ElevenLabs or n8n accounts for processing client data. The contractual relationship with those platforms is between the client and the platform provider.
For data processed through AI chatbots and voice agents, our client is the data controller and the third-party platform provider (e.g. ElevenLabs) is typically the data processor under the client's own agreement. Our role is limited to providing the dashboard interface and configuration services.

2. Personal Data We Collect as a Controller

Category	Examples	Source
Identity data	Name, job title	Contact forms, emails, calls
Contact data	Email address, phone number, business address	Contact forms, booking system (Cal.com)
Technical data	IP address, browser type, device information, pages visited	Website analytics, server logs
Usage data	How you interact with our website	Analytics, scroll tracking
Communications data	Content of emails and enquiries	Email, contact forms
Client account data	Login credentials, dashboard preferences, API keys provided by clients	Client onboarding and dashboard usage

3. Personal Data We Process on Behalf of Our Clients

Category	Examples	Source
Caller/user details	Phone numbers, names (where provided)	Client's ElevenLabs / voice platform account
Conversation data	Chat transcripts, call transcripts	Client's ElevenLabs / chatbot platform account
Usage metadata	Call timestamps, duration, interaction counts	Client's connected platform accounts

We process this data on behalf of our clients as a data processor. Our clients are the data controllers for this data and are responsible for having a lawful basis for its collection and for providing privacy notices to their end customers. Our processing of this data is governed by a separate Data Processing Agreement with each client.

4. Lawful Basis for Processing

Purpose	Lawful Basis	Details
Responding to enquiries	Legitimate interests	It is in our legitimate interest to respond to prospective clients who contact us
Providing our services	Performance of a contract	Processing is necessary to deliver the services we have been engaged to provide
Sending marketing emails	Consent	We will only send marketing communications where you have opted in
Website analytics	Legitimate interests	Understanding how visitors use our site to improve the user experience
Compliance and legal obligations	Legal obligation	Where processing is required by law, e.g. tax and accounting records

5. AI and Automated Decision-Making

AI chatbots and voice agents are deployed under our clients' own accounts on platforms such as ElevenLabs. Personal data from end-customer interactions is processed by those platforms under the client's agreement with the platform.
Our web dashboard retrieves and displays data from the client's platform accounts. Where transcripts and caller details are displayed, this data passes through our dashboard but the client controls what data is collected and how it is used.
If you interact with a demo chatbot or voice agent on our website (dialogueflow.co.uk), that interaction may be processed by our own demo accounts and is covered by this Privacy Policy.
No solely automated decisions: We do not make decisions based solely on automated processing that produce legal effects or similarly significant effects on you.

6. Who We Share Data With

Hosting and infrastructure providers (under written data processing agreements)
Cal.com for appointment booking functionality
Professional advisers (accountants, lawyers, insurers where necessary)
Law enforcement, regulators, or courts where required by law

We do not sell personal data to third parties.

Note: We do not share your data with ElevenLabs or n8n. Our clients maintain their own direct relationships with those providers.

7. International Data Transfers

Our hosting providers may process data outside the UK. Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, including adequacy decisions, the UK International Data Transfer Agreement (UK IDTA), or the UK Addendum to EU Standard Contractual Clauses.
Where our dashboard retrieves data from clients' third-party platform accounts, any international transfers involved are governed by the client's own agreement with those platforms, not this Privacy Policy.

8. Data Retention

Data Type	Retention Period	Reason
Enquiry records	Up to 2 years from last contact	Follow-up and business development
Client contract records	7 years from end of contract	Legal and accounting obligations
Marketing consent records	Until consent is withdrawn	To honour preferences
Website analytics	26 months (aggregated)	Website improvement
Demo AI interaction logs	90 days (then deleted)	Quality assurance

Data retrieved from clients' third-party accounts is cached temporarily (up to 72 hours) for dashboard performance. No long-term copies are retained. On termination of a client relationship, all cached data is deleted within 30 days.

9. Data Security

Encryption in transit (TLS/SSL) for all data transmitted between your browser and our servers
Authentication and access controls to limit data access to authorised personnel
Multi-tenant data isolation ensuring client data is kept separate
Regular security reviews of our systems and processes

10. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

Right of access — to request a copy of the personal data we hold about you.
Right to rectification — to ask us to correct inaccurate or incomplete data.
Right to erasure — to ask us to delete your data where there is no legitimate reason for us to continue holding it.
Right to restrict processing — to ask us to pause processing of your data in certain circumstances.
Right to data portability — to receive your data in a structured, commonly used, machine-readable format.
Right to object — to object to processing based on legitimate interests or direct marketing.
Right to withdraw consent — at any time, where processing is based on consent.

To exercise any of these rights, please email ben@dialogueflow.co.uk. We will respond within one calendar month.

If you are an end customer of one of our clients and wish to exercise your data protection rights in relation to data displayed on our dashboard, you should contact the relevant business (our client) directly, as they are the data controller for that data.

11. Cookies

We use minimal cookies on our website. For full details, please see our Cookie Policy.

12. Children's Data

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

14. Contact Us

Data Controller: Dialogue Flow Ltd (Company No. 16477998)
Email: ben@dialogueflow.co.uk
Address: Suite A, 82 James Carter Road, Mildenhall, IP28 7DE, United Kingdom

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Website: ico.org.uk
Telephone: 0303 123 1113