Last updated: 2 July 2026
Callyard is a managed AI office service for trade businesses in the UK. An AI agent answers our clients' calls and chat, records and transcribes them, books jobs, sends SMS and reports on marketing attribution.
This notice covers two different groups of people, because we handle their data in two different roles:
1. Our clients and their staff (the trade businesses who subscribe): for this data, Callyard is the controller.
2. Our clients' customers (the people who ring or message a client business): for this data, the client business is the controller and Callyard is their processor under a Data Processing Agreement. We include this section for transparency, because callers deserve to understand what happens to their data even though their primary privacy relationship is with the business they called.
Who we are
Callyard is currently operated by James Shallcrass, a sole trader based in the United Kingdom. A limited company is planned; this notice will be updated on incorporation.
Contact for anything in this notice: hello@callyard.co.uk
Part 1: Data about our clients (we are the controller)
What we collect and why
| Data | Why | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Business name, contact name, email, phone, address | To set up and run your account, communicate with you, provide support | Contract (Art. 6(1)(b)) |
| Billing and payment details | To charge subscription fees | Contract; legal obligation for tax and accounting records |
| Business configuration (services, prices, hours, diary access, fallback number) | To operate your AI agent correctly | Contract |
| Account usage, logs, dashboard activity | Security, troubleshooting, fair usage monitoring, service improvement | Legitimate interests (running and securing the service) |
| Marketing communications to you | To tell you about features and offers | Legitimate interests for existing clients (B2B, with opt-out every time); consent otherwise |
Retention
- Account and configuration data: for the life of your subscription plus 12 months.
- Billing records: 6 years after the tax year they relate to (HMRC requirement).
- Support correspondence: 24 months after closure.
Part 2: Data about our clients' customers (the client is the controller, we are the processor)
When you ring or message a business that uses Callyard, that business decides why your data is used; Callyard processes it on their instructions. The business's own privacy notice is the primary notice for this processing. What happens in practice:
What is processed
- Your phone number and, where you give it, your name, address and contact details.
- Call recordings and transcripts of your conversation with the AI agent. Every call starts with a spoken disclosure that you are talking to an AI assistant and that the call is recorded.
- Chat messages, where the business uses our chat agent.
- Booking details: the job you want done, dates, location, and any price or quote discussed.
- SMS messages sent to you about your enquiry or booking, and your replies.
- Basic call metadata (time, duration, the number you dialled, and where available the marketing source that led to your call) used for the business's marketing attribution reporting.
Why, and on what lawful basis
The client business is responsible for its lawful bases. Typically:
- Handling your enquiry and booking: contract or steps prior to a contract with you.
- Recording and transcribing calls: the business's legitimate interests in accurate records of bookings, quotes and service quality, supported by the up-front disclosure on every call.
- Transactional SMS about your enquiry or booking: legitimate interests or contract. Callyard does not send automated outbound marketing calls or marketing SMS on behalf of clients.
- Marketing attribution reporting: the business's legitimate interests in understanding where its enquiries come from.
Retention (our processor default)
- Call recordings and transcripts: 24 months by default, then automated deletion. A client may instruct a shorter period.
- Booking and contact records: for the client's subscription term, then deleted or returned under the DPA.
- When a client leaves Callyard, their customer data is exported to them on request and then deleted (normally within 30 days of the end of the export window), except where law requires longer retention.
If you are a caller and want to exercise your rights
Contact the business you called first; they are the controller. If you contact us instead, we will pass your request to them promptly and help them respond, as our DPA requires.
Sub-processors
We use these providers to deliver the service. Each is bound by a contract meeting UK GDPR requirements:
| Provider | What they do | Location / transfer basis |
|---|---|---|
| Supabase | Database and storage (recordings, transcripts, bookings, account data) | Hosted in the UK (London region) |
| Vercel | Application hosting for dashboards and web services | May involve transfer to the US; safeguarded by the UK Extension to the EU-US Data Privacy Framework and/or the UK International Data Transfer Addendum to EU SCCs |
| ElevenLabs | Voice AI (speech generation and processing for the agent) | May involve transfer to the US; safeguarded as above |
| Twilio (planned, when telephony goes live) | Telephony and SMS carriage | May involve transfer to the US; safeguarded as above |
We will update this list before adding or replacing a sub-processor, and clients receive advance notice under the DPA with a right to object.
International transfers
We keep primary data storage in the UK (London region). Where a sub-processor processes data outside the UK or EEA (see table above), we rely on UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or the UK International Data Transfer Agreement or Addendum, plus supplementary measures where appropriate. Details are available on request.
Security
Data is encrypted in transit and at rest, access is restricted to what is needed to run the service, and administrative access is protected by strong authentication. Recordings and transcripts are deleted automatically at the end of their retention period. Fuller technical measures are described in the DPA.
Your rights (UK GDPR)
Whether you are a client or a client's customer, you have the right to:
- Access a copy of your personal data.
- Correct inaccurate data.
- Erasure, in certain circumstances.
- Restrict or object to processing, including any processing based on legitimate interests.
- Data portability, for data you provided under contract or consent.
- Withdraw consent at any time, where consent is the basis.
- Not be subject to solely automated decisions with legal or similarly significant effects. The AI agent books appointments and answers questions; it does not make decisions of that kind about callers.
To exercise a right, email hello@callyard.co.uk. We respond within one month. If you are a caller, your request will normally be routed to the business you called, as they are the controller.
Complaints
If you are unhappy with how your data has been handled, please contact us first so we can put it right. Our full Complaints Procedure explains how to raise a complaint, the Data (Use and Access) Act 2025 right to complain to us as controller first, our commitment to acknowledge within 5 business days, and how we tell you the outcome. You also have the right to complain to the UK Information Commissioner's Office (ICO): ico.org.uk, or 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Changes to this notice
We will post updates here and notify clients of material changes by email at least 30 days before they take effect.