1. Introduction

Welcome to thisisagency.ai (“we,” “our,” or “us”). We are committed to protecting your personal data and respecting your privacy. This policy explains how we collect, use, share, and protect personal data when you visit our website or use our services, in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Our Role: Controller and Processor

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the Data Controller is Candlestickoperations Ltd (Company No. 17503419), 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE.

For personal data about you as our user (your account, your interactions with the platform), we act as the data controller.

Where you use the platform to process personal data about your own contacts, customers, callers, or correspondents (for example, uploading contact lists, running the AI Receptionist on incoming calls, or triaging a mailbox), you are the controller of that data and we act as your processor. In that role we process such data only on your documented instructions. Business users who require one may request a Data Processing Agreement (DPA) at privacy@thisisagency.ai.

3. The Data We Collect

We collect, use, store, and transfer different kinds of personal data to provide our AI orchestration services:

4. How We Use Your Data & AI Memory

Beyond standard business operations, we use your data to power our autonomous agent systems. The lawful basis for each activity is noted:

• Topical Experience (AI Memory): Chat interactions and completed tasks are processed, compressed into long-term memory "Superchunks," and stored to personalise future interactions. (Lawful Basis: Legitimate Interests - service personalisation.)
• Incognito Mode (Opt-Out): You may opt out of long-term AI memory generation at any time in your Personal Context settings. When enabled, new memories are not extracted; existing memories are retained until you delete them or your account. (Lawful Basis: Consent.)
• Automated Profiling: Our agents may infer personal facts about you (e.g. location, interests, current challenges) from your conversations, stored in your Personal Entity Profile. You can view, edit, and delete all inferred facts in Settings. We do not make solely automated decisions producing legal or similarly significant effects about you without human oversight; agent actions that affect you (such as sending emails, posting, or spending credits) are subject to approval and human-in-the-loop controls. (Lawful Basis: Consent.)
• Email Triage & AI Receptionist: If you connect Gmail or use the Receptionist, our agents read, summarise, categorise, triage, and optionally draft or send replies, using our backend and third-party AI providers. (Lawful Basis: Consent.)
• Voice Calls: Handling, recording, and transcribing calls to operate the Receptionist/Call Centre and provide records to you. (Lawful Basis: Consent for you; Legitimate Interests for call handling - see Section 7 for callers.)
• Financial Processing: Uploaded financial records are analysed to provide budgeting, VAT calculations, and debt insights. This is not regulated financial advice (see Terms). (Lawful Basis: Consent.)
• Autonomous Operations: The system acts on your behalf, scraping requested domains for SEO and content insights. You must not direct the scraper to harvest third-party personal data without authorisation. (Lawful Basis: Performance of Contract.)
• Account, Billing & Security: To maintain your projects, process payments, prevent abuse, and secure the platform. (Lawful Basis: Performance of Contract / Legitimate Interests.)

5. AI Providers & Model Training

To generate outputs, your prompts, chat messages, voice audio, emails, financial records, and uploaded documents may be sent for processing to third-party AI providers, currently Google (Gemini), OpenAI (GPT-4o and the OpenAI Realtime API for voice), and Anthropic (Claude). Real-time voice is routed via a secure backend and Twilio telephony.

We access these providers through their business/API tiers. Under those tiers, providers process your inputs to return a response and do not use your inputs or outputs to train their general-purpose models, and retain data only transiently for abuse monitoring in line with their terms. We do not control, and are not responsible for, the independent practices of these providers; their own terms and privacy policies also apply.

6. Google User Data & Limited Use

When you connect Google services (Gmail, Google Calendar, Search Console, or Analytics), our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the user-facing features you request (e.g. email triage, SEO analysis).
• We do not transfer Google user data except as necessary to provide those features, to comply with law, or as part of a merger with your consent.
• We do not use Google user data for advertising, and we do not use it to train generalised AI/ML models.
• Humans do not read Google user data except with your consent, for security/abuse or legal reasons, or where the data has been aggregated and anonymised.

You can revoke our access to your Google account at any time via your Google account permissions or in your platform settings.

7. Voice Calls, Encrypted Video Rooms & Callers

If you enable the AI Receptionist or Call Centre, incoming and outgoing telephone calls are connected to an AI voice agent, processed in real time, and may be recorded and transcribed and stored against your account. This includes personal data about third-party callers who are not our users.

For In-Agency Encrypted Video Rooms (/meet/[token]), WebRTC audio and video streams are encrypted in transit (DTLS-SRTP / EU-pinned eu-central-1 SFU) and zero video or audio files are ever recorded or stored on our servers or subprocessor infrastructure. When Elsa AI Scribe is enabled for text meeting minutes, every participant (including external guests) receives a clear pre-join AI transparency notice (UK/EU GDPR Arts. 12–13 & EU AI Act Art. 50) and must either provide explicit affirmative opt-in consent (logged with timestamp) or select Join in Private Mode (No AI Scribe) to disable AI transcription for everyone before entering. While active, Elsa appears inside the room as a visible participant tile and converts ephemeral 15-second audio buffers into text notes via our enterprise AI API, discarding audio immediately from memory. Any admitted participant (Host or Guest) may click Go Private (Switch Elsa Off)at any moment during the call (GDPR Art. 7(3) & all-party consent withdrawal): browser RAM buffers are discarded immediately without transmission, Elsa announces her exit to all participants and leaves the room, and zero further transcription occurs. Every room enforces an automatic countdown cutoff at its scheduled end time, tearing down media connections and purging transient signaling keys, and Hosts may permanently delete any session and its text transcript on demand (GDPR Art. 17).

For calls and meetings hosted on your behalf, you are the controller of participant/caller data and we act as your processor. You are responsible for ensuring any notice or consent required by law in the relevant jurisdiction. Telephone calls handled on your behalf begin with an automatic spoken notice informing callers that the call is handled by an AI assistant.

Call audio and transcripts are processed by our AI and real-time media providers (Sections 5 & 8). Participants and callers may exercise their data rights by contacting the account holder or us at privacy@thisisagency.ai.

8. Data Sharing & Subprocessors

We share personal data only with the service providers ("subprocessors") needed to run the platform, each under contractual data-protection obligations. Our current key subprocessors include:

We also query public/official sources such as the UK Companies House API for business lookups. Where you connect and instruct us to publish to third-party social, CMS, or newsletter platforms (such as X, Facebook, LinkedIn, Bluesky, WordPress, or beehiiv), the content you direct us to publish is transmitted to those platforms, which then act as independent controllers under their own terms. This list may change as the platform evolves; the current list above is maintained and available on request at privacy@thisisagency.ai. We do not sell your personal data.

9. International Transfers

Our primary database is hosted in the European Union. Some subprocessors (including our hosting, AI, email, and telephony providers) are based in the United States or process data globally. Where personal data is transferred outside the UK, we rely on appropriate safeguards, including the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses and, where applicable, the UK Extension to the EU-US Data Privacy Framework for certified providers.

10. Data Retention & Backups

To practise data minimisation, raw transient communication logs (including raw chat message history, synced inbox emails and attachments, and call logs) are automatically purged on a rolling 30-day schedule. Project files, case notes, briefcase documents, financial records, and compressed AI memory "Superchunks" are retained for the duration of your active account to maintain personalisation and continuity. Upon account termination or a verified deletion request, we permanently delete your personal data from our live systems within 30 days.

Encrypted backups may retain copies for a limited additional period (typically up to 90 days) before rotation, and certain records may be retained longer where required by law (e.g. financial/tax records) or to resolve disputes and enforce our agreements.

11. Security & Breach Notification

We apply appropriate technical and organisational measures, including encryption of data in transit and of sensitive stored credentials, signed and expiring authentication sessions, role-based access controls, rate limiting, prompt-injection scanning of AI actions, and a platform-wide session-revocation control. No system is perfectly secure, and you use the platform (particularly during Beta) at your own risk.

In the event of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware, and will notify affected individuals where the law requires.

12. Multi-Tenancy Data Isolation & Shared Projects

While you share the platform's infrastructure with other users, your data is logically siloed and tagged to your account, with access controls designed to ensure that other users cannot access your information. Where you explicitly invite team members or collaborators to a shared Project (as an Editor or Viewer) or Workspace, those collaborators will have access to the project data, case notes, and project-scoped briefcase files in accordance with the role you assign them (with underlying project API credentials redacted from read-only Viewers). Personal CEO/Silver briefcases, personal inbox data, and personal billing records remain strictly isolated to your individual account.

13. Your Legal Rights

Subject to applicable law, you have rights over your personal data:

You can exercise your data rights, including exporting your personal records or permanently deleting your account, directly from your Account Settings page, or by contacting us at privacy@thisisagency.ai. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

14. Children's Privacy

Our platform and AI services are not intended for individuals under 18. We do not knowingly collect personal data from children. If we learn we have collected such data without verified parental consent, we will delete it promptly.