Privacy policy

Callbrook is operated by Flowfinds Solutions Kft., registered in Hungary under number Cg. 13-09-242910, at 2141 Csömör, Mező utca 11., Hungary. For any privacy question, contact privacy@callbrook.co.uk.

There are two different sets of people in this policy. Our customer is the business that subscribes to Callbrook. A caller is a member of the public who telephones that business. For call data, the business is the controller and we act on its instructions as processor; for the business's own account data, we are the controller.

A transcript of the call, produced by our speech provider. Calls are not recorded as audio by default; recording is off unless a business deliberately turns it on, and where it is enabled the business is responsible for any disclosure or consent its jurisdiction requires.

The details the caller gives in order to be helped: their name, a callback telephone number, the postcode of the property, what they need doing, and when suits them.

Technical metadata about the call: when it started, how long it lasted, and which receptionist answered it.

The receptionist is instructed never to collect payment card details, bank details, passwords or security codes, and to stop a caller who begins to read one out.

The email address used to sign in, the business information imported from the public pages of its website or entered by hand, and the settings that control how calls are handled.

First-party product analytics recording which steps of setup were reached. These do not record keystrokes, screen contents or page recordings, and no analytics of any kind run on pages that display telephone numbers, transcripts or lead details.

Caller telephone numbers, caller email addresses and notification destinations are encrypted with AES-256-GCM at the application layer before they reach the database, using keys derived from a secret that is never stored alongside the data.

Application logs are redacted before they are written: telephone numbers, email addresses, tokens and API keys are replaced with placeholders rather than filtered afterwards.

Access to a business's calls and leads requires an authenticated session belonging to the owner of that workspace.

Call transcripts are kept for 90 days by default and then automatically deleted. A business can shorten this.

Leads and call summaries are kept for as long as the business's account is open, because they are the business's own customer records.

An unpaid demonstration receptionist and everything associated with it is deleted automatically 72 hours after it is created.

A caller who wants their details corrected or erased should contact the business they telephoned, which controls that record. If it is easier, contact privacy@callbrook.co.uk and we will pass the request on and support it.

A business can export its data or delete its workspace by emailing support@callbrook.co.uk. Deletion removes the receptionist at our voice provider as well as the records held here.

We make no certification claims. We do not state that we are GDPR-certified, HIPAA-compliant, SOC 2 audited or ISO accredited, because such a statement would need to be true of the deployed system and the operating company, and would have to be independently established.