Privacy Policy
This policy explains how I Enterprise Ltd handles personal data for Odette. We take privacy seriously — Odette handles phone calls, so we treat call data with care.
1. Controller & roles
For your account data, I Enterprise Ltd is the data controller. For data about your callers that Odette processes on your instructions (transcripts, messages and call metadata), you are the controller and we are your processor — see our DPA.
2. Data we collect
- Account data: name, business name, email, password (hashed), billing details (via Stripe).
- Knowledge base: the website/store content you connect.
- Call data: caller phone number, call transcripts, message content, timestamps and call metadata. We do not store call audio — audio is processed by your voice provider to produce the transcript, under your own account with them and their retention settings.
- Usage data: logs, minutes used, device/browser info for security.
3. How we use it
To provide and operate Odette, answer and log calls, take messages, bill you, provide support, keep the service secure, and comply with law. We do not sell your personal data, and we do not use your call content to train third-party foundation models beyond what is necessary to deliver the service.
4. Lawful bases (UK/EU GDPR)
Performance of our contract with you; our legitimate interests (running and securing the service); consent where required (e.g. certain cookies); and legal obligations.
5. Sub-processors
We use trusted providers to deliver Odette:
| Provider | Purpose | Region |
|---|---|---|
| Cloudflare, Inc. | Application hosting, database & storage | Global (EU/US) |
| ElevenLabs Inc. | Conversational voice AI (speech, transcription) | US/EU |
| Twilio Inc. | Telephony — inbound calls, phone numbers, SMS | US/EU |
| Stripe, Inc. | Subscription billing & payments | US/EU |
6. International transfers
Some providers process data outside the UK/EEA. Where they do, we rely on adequacy decisions or Standard Contractual Clauses / the UK International Data Transfer Addendum.
7. Retention
We keep account data while your account is active and as required for legal/accounting purposes. Call transcripts and messages are retained per your settings and deleted on request or on account closure, subject to legal retention. We do not hold call audio.
8. Your UK/EU rights
You may request access, rectification, erasure, restriction, portability, and object to certain processing. Email info@odettehq.com. If we process caller data on your behalf, please direct caller requests to the business that owns the call.
9. US privacy rights (CCPA/CPRA & other states)
If you are a California resident, you have rights to know, delete, correct, and opt out of “sale”/“sharing” of personal information. We do not sell or share personal information as those terms are defined. Residents of other US states with privacy laws have comparable rights. To exercise them, email info@odettehq.com.
10. Security
Passwords are hashed (PBKDF2). Data is encrypted in transit. Access is restricted and logged. No system is perfectly secure, but we work hard to protect your data.
11. Complaints
You can complain to the UK Information Commissioner’s Office (ico.org.uk) or your local supervisory authority. We’d appreciate the chance to help first — email info@odettehq.com.