Privacy Policy
Last updated: 19 May 2026
HeyOlivia ("we", "us", "our") provides an AI-powered receptionist service for UK tradespeople. This policy explains how we collect, use, and protect your personal data when you use our website and services.
1. Data Controller
The data controller is:
Mr Buruxab Khitago BUTKUS, sole trader (micro-entrepreneur BNC), France.
Trading as: HeyOlivia
ICO Registration: ZC138011
Contact: [email protected]
2. What Data We Collect
| Data | When collected |
|---|---|
| Business name | Demo signup form |
| Phone number | Demo signup form |
| Email address | Demo signup form, waitlist |
| Trade/industry | Demo signup form |
| Marketing consent | Demo signup form (opt-in checkbox) |
| Call recordings | During demo and trial calls with Olivia |
| Call transcripts | Generated after each call |
| Sentiment analysis | AI-generated from call content |
| Postcode | If provided during a call |
| Cookies | Website visits (essential only by default) |
3. Why We Collect It
We collect your data to:
- Deliver the AI receptionist demo so you can experience the service
- Personalise Olivia's greeting with your business name and trade
- Send you a follow-up email after your demo call
- Notify you when your trial is ready (if you join the waitlist)
- Send marketing communications (only with your explicit consent)
- Improve our service quality and call handling
4. Legal Basis
| Purpose | Legal basis |
|---|---|
| Demo delivery | Legitimate interests (you requested the demo) |
| Post-demo follow-up email | Legitimate interests (service-related) |
| Marketing emails | Consent (opt-in checkbox) |
| Trial/paid service | Contract performance |
| Legal compliance | Legal obligation (UK accounting, tax) |
5. Who We Share Data With
We use the following processors to deliver the service. Each has a Data Processing Agreement (DPA) in place:
| Provider | Purpose | Location |
|---|---|---|
| Retell AI | Voice agent (call handling, recordings) | US (SCCs/UK IDTA) |
| Twilio | Telephony (SIP trunk, call routing) | UK/EU (DPA) |
| ElevenLabs | Voice synthesis (Olivia's voice) | US (SCCs/UK IDTA) |
| Google Workspace | Email delivery (SMTP) | EU (DPA) |
| Cloudflare | Website hosting, DNS, tunnel | EU (DPA) |
| Apollo.io | B2B contact enrichment for prospect outreach (Section 12) | US (SCCs/UK IDTA) |
| Smartlead.ai | B2B email sequencing for prospect outreach (Section 12) | US (SCCs/UK IDTA) |
| Companies House | UK public register; source of business contact data (Section 12) | UK (public-sector data; no DPA required) |
We do not sell your data to any third party.
6. International Transfers
Some of our processors are based in the United States. Where data is transferred outside the UK, we rely on Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (UK IDTA) to ensure adequate protection.
7. Data Retention
| Data type | Retention period |
|---|---|
| Demo leads (not converted) | 90 days from signup |
| Trial waitlist entries | 90 days or until trial starts |
| Paying customer data | Duration of contract + 6 years (UK accounting) |
| Call recordings | 90 days (demo), contract duration (paying) |
| Marketing consent records | Duration of consent + 1 year |
8. Your Rights
Under UK GDPR, you have the right to:
- Access — request a copy of your personal data
- Rectification — correct inaccurate data
- Erasure — request deletion of your data ("right to be forgotten")
- Portability — receive your data in a machine-readable format
- Object — object to processing based on legitimate interests
- Withdraw consent — withdraw marketing consent at any time
- Restrict processing — request we limit how we use your data
To exercise any of these rights, email [email protected]. We will respond within 30 days.
9. Cookies
By default, we only use essential cookies required for the website to function (e.g. cookie consent preference). We do not use tracking or analytics cookies unless you opt in via our cookie banner.
Essential cookies
| Cookie | Purpose | Duration |
|---|---|---|
| ho_cookie_consent | Stores your cookie preference | 365 days |
Analytics cookies (opt-in only)
If you accept analytics cookies, we may use privacy-respecting analytics to understand how visitors use our site. No analytics cookies are set until you explicitly consent.
10. Complaints
If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO):
ico.org.uk/concerns
Telephone: 0303 123 1113
11. Changes to This Policy
We may update this policy from time to time. The "last updated" date at the top will always reflect the most recent version. Material changes will be communicated via email to active customers.
12. B2B Prospect Data & Cold Outreach
HeyOlivia engages in business-to-business outreach to UK Limited companies and LLPs that we believe may benefit from our service. This processing is governed by UK GDPR Article 6(1)(f) (legitimate interests) and PECR Regulation 22 (corporate-subscriber rule).
What data we process for prospects
- Company name, registration number, status, type, and SIC codes (sourced from Companies House public register)
- Director or officer names and registered office address (also from Companies House)
- Business contact email and phone number (sourced from Apollo.io's B2B database and public websites)
- Google Business Profile completeness data (from Google's public Maps view)
- Outbound engagement events (email opens, clicks, replies — retained 90 days)
Who we contact and how
We contact UK Limited companies, LLPs, and Scottish partnerships only (PECR corporate subscribers). We do not send cold emails or SMS to sole traders or ordinary partnerships — they are "individual subscribers" under PECR and require prior consent.
Every email and SMS we send includes:
- The sender's identity (HeyOlivia, with the controller's name)
- A working one-click opt-out (reply STOP, List-Unsubscribe header, and a dedicated opt-out mailbox)
- Our registered company address (once Companies House incorporation completes, expected June 2026)
Phone calls to business numbers are screened against both the Corporate Telephone Preference Service (CTPS) and the Telephone Preference Service (TPS) before dialling.
Our Legitimate Interests Assessment
The lawful basis for B2B cold outreach is detailed in our Legitimate Interests Assessment (LIA), version 1.0 dated 19 May 2026. Available on request from [email protected]. The LIA covers the purpose test, necessity test, and balancing test under UK GDPR Art. 6(1)(f), with mitigations documented per ICO direct-marketing guidance.
How to opt out
To stop all outreach immediately:
- Reply STOP to any HeyOlivia email or SMS, or
- Email [email protected]
We will suppress your details within 24 hours and retain a permanent suppression record (the only way we can guarantee no future contact). Suppression records are NOT used for any purpose other than honouring your opt-out.
Retention for non-converting prospects
If you do not respond or convert to a customer, your prospect record is deleted 90 days after the final outbound touch. Engagement metadata (opens, clicks) is deleted at the same time.