Privacy Policy

This policy explains how I Enterprise Ltd handles personal data for Odette HQ. We take privacy seriously — Odette HQ handles phone calls, so we treat call data with care.

1. Controller & roles

For your account data, I Enterprise Ltd is the data controller. For data about your callers that Odette HQ processes on your instructions (transcripts, messages and call metadata), you are the controller and we are your processor — see our DPA.

2. Data we collect

• Account data: name, business name, email, password (hashed), billing details (via Stripe).
• Number verification data: registered business name, registration number, UK business address, website and authorised representative name, work email and mobile. We use this to arrange required number checks with Twilio.
• Business brief: the website address and short instructions you choose to provide for greeting and enquiry capture. A website scan does not become a live answer source.
• Call data: caller number, saved name, company, email (when offered), enquiry details, timestamps, duration and routing metadata. The managed GPT-Live service stores the structured message, not a full-call transcript. Older account configurations may have generated transcripts. We do not intentionally store call audio in the Odette HQ application; live audio is transmitted to our voice-AI provider to handle the call. That provider may retain service and abuse-monitoring data under its own controls.
• Usage data: logs, minutes used, device/browser info for security.

3. How we use it

To provide and operate Odette HQ, answer and log calls, take messages, bill you, provide support, keep the service secure, and comply with law. We do not sell your personal data, and we do not use your call content to train third-party foundation models beyond what is necessary to deliver the service.

4. Lawful bases (UK/EU GDPR)

Performance of our contract with you; our legitimate interests (running and securing the service); consent where required (e.g. certain cookies); and legal obligations.

5. Sub-processors

We use providers to deliver Odette HQ:

6. International transfers

Some providers process data outside the UK/EEA. Where they do, we rely on adequacy decisions or Standard Contractual Clauses / the UK International Data Transfer Addendum.

7. Retention

We keep account and billing records while needed to provide the service and meet legal obligations. Call records, transcripts and messages remain in your account until removed through an available account process or a verified deletion request, subject to necessary legal retention. We do not intentionally retain call audio in the Odette HQ application. Provider-side retention is governed by the relevant provider settings and terms.

8. Your UK/EU rights

You may request access, rectification, erasure, restriction, portability, and object to certain processing. Email info@odettehq.com. If we process caller data on your behalf, please direct caller requests to the business that owns the call.

9. US privacy rights (CCPA/CPRA & other states)

If you are a California resident, you have rights to know, delete, correct, and opt out of “sale”/“sharing” of personal information. We do not sell or share personal information as those terms are defined. Residents of other US states with privacy laws have comparable rights. To exercise them, email info@odettehq.com.

10. Security

Passwords are hashed (PBKDF2). Data is encrypted in transit. Access is restricted and logged. No system is perfectly secure, but we work hard to protect your data.

11. Complaints

You can complain to the UK Information Commissioner’s Office (ico.org.uk) or your local supervisory authority. We’d appreciate the chance to help first — email info@odettehq.com.