1Introduction

Welcome to thisisagency.ai ("we," "our," or "us"). We are committed to protecting your personal data and respecting your privacy. This policy explains how we collect, use, share, and protect personal data when you visit our website or use our services, in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Our agency is based in Scotland and operates under Scottish and UK law.

2Our Role: Controller and Processor

For personal data about you as our user (your account, your interactions with the platform), we act as the data controller.

Where you use the platform to process personal data about your own contacts, customers, callers, or correspondents (for example, uploading contact lists, running the AI Receptionist on incoming calls, or triaging a mailbox), you are the controller of that data and we act as your processor. In that role we process such data only on your documented instructions. Business users who require one may request a Data Processing Agreement (DPA) at privacy@thisisagency.ai.

3The Data We Collect

We collect, use, store, and transfer different kinds of personal data to provide our AI orchestration services:

4How We Use Your Data & AI Memory

Beyond standard business operations, we use your data to power our autonomous agent systems. The lawful basis for each activity is noted:

• Topical Experience (AI Memory): Chat interactions and completed tasks are processed, compressed into long-term memory "Superchunks," and stored to personalise future interactions. (Lawful Basis: Legitimate Interests - service personalisation.)
• Incognito Mode (Opt-Out): You may opt out of long-term AI memory generation at any time in your Personal Context settings. When enabled, new memories are not extracted; existing memories are retained until you delete them or your account. (Lawful Basis: Consent.)
• Automated Profiling: Our agents may infer personal facts about you (e.g. location, interests, current challenges) from your conversations, stored in your Personal Entity Profile. You can view, edit, and delete all inferred facts in Settings. We do not make solely automated decisions producing legal or similarly significant effects about you without human oversight; agent actions that affect you (such as sending emails, posting, or spending credits) are subject to approval and human-in-the-loop controls. (Lawful Basis: Consent.)
• Email Triage & AI Receptionist: If you connect Gmail or use the Receptionist, our agents read, summarise, categorise, triage, and optionally draft or send replies, using our backend and third-party AI providers. (Lawful Basis: Consent.)
• Voice Calls: Handling, recording, and transcribing calls to operate the Receptionist/Call Centre and provide records to you. (Lawful Basis: Consent for you; Legitimate Interests for call handling - see Section 7 for callers.)
• Financial Processing: Uploaded financial records are analysed to provide budgeting, VAT calculations, and debt insights. This is not regulated financial advice (see Terms). (Lawful Basis: Consent.)
• Autonomous Operations: The system acts on your behalf, scraping requested domains for SEO and content insights. You must not direct the scraper to harvest third-party personal data without authorisation. (Lawful Basis: Performance of Contract.)
• Account, Billing & Security: To maintain your projects, process payments, prevent abuse, and secure the platform. (Lawful Basis: Performance of Contract / Legitimate Interests.)

5AI Providers & Model Training

To generate outputs, your prompts, chat messages, voice audio, emails, financial records, and uploaded documents may be sent for processing to third-party AI providers, currently Google (Gemini), OpenAI (GPT-4o and the OpenAI Realtime API for voice), and Anthropic (Claude). Real-time voice is routed via a secure backend and Twilio telephony.

We access these providers through their business/API tiers. Under those tiers, providers process your inputs to return a response and do not use your inputs or outputs to train their general-purpose models, and retain data only transiently for abuse monitoring in line with their terms. We do not control, and are not responsible for, the independent practices of these providers; their own terms and privacy policies also apply.

6Google User Data & Limited Use

When you connect Google services (Gmail, Google Calendar, Search Console, or Analytics), our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the user-facing features you request (e.g. email triage, SEO analysis).
• We do not transfer Google user data except as necessary to provide those features, to comply with law, or as part of a merger with your consent.
• We do not use Google user data for advertising, and we do not use it to train generalised AI/ML models.
• Humans do not read Google user data except with your consent, for security/abuse or legal reasons, or where the data has been aggregated and anonymised.

You can revoke our access to your Google account at any time via your Google account permissions or in your platform settings.

7Voice Calls, Recording & Callers

If you enable the AI Receptionist or Call Centre, incoming and outgoing telephone calls are connected to an AI voice agent, processed in real time, and may be recorded and transcribed and stored against your account. This includes personal data about third-party callers who are not our users.

For calls handled on your behalf, you are the controller of the caller's data and we act as your processor. You are responsible for ensuring an appropriate recording/AI notice is given to callers and for any consent required by law in the relevant jurisdiction. Calls handled on your behalf begin with an automatic spoken notice informing callers that the call is handled by an AI assistant and may be recorded for quality.

Call audio and transcripts are processed by our voice AI providers (Section 5). Callers may exercise their data rights by contacting the account holder or us at privacy@thisisagency.ai.

8Data Sharing & Subprocessors

We share personal data only with the service providers ("subprocessors") needed to run the platform, each under contractual data-protection obligations. Our current key subprocessors include:

We also query public/official sources such as the UK Companies House API for business lookups. Where you connect and instruct us to publish to third-party social, CMS, or newsletter platforms (such as X, Facebook, LinkedIn, WordPress, or beehiiv), the content you direct us to publish is transmitted to those platforms, which then act as independent controllers under their own terms. This list may change as the platform evolves; the current list above is maintained and available on request at privacy@thisisagency.ai. We do not sell your personal data.

9International Transfers

Our primary database is hosted in the European Union. Some subprocessors (including our hosting, AI, email, and telephony providers) are based in the United States or process data globally. Where personal data is transferred outside the UK, we rely on appropriate safeguards, including the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses and, where applicable, the UK Extension to the EU-US Data Privacy Framework for certified providers.

10Data Retention & Backups

Chat logs, project files, email copies, financial records, call transcripts, and AI memory "Superchunks" are retained for the duration of your active account to maintain personalisation. Upon account termination or a verified deletion request, we permanently delete your personal data from our live systems within 30 days.

Encrypted backups may retain copies for a limited additional period (typically up to 90 days) before rotation, and certain records may be retained longer where required by law (e.g. financial/tax records) or to resolve disputes and enforce our agreements.

11Security & Breach Notification

We apply appropriate technical and organisational measures, including encryption of data in transit and of sensitive stored credentials, signed and expiring authentication sessions, role-based access controls, rate limiting, prompt-injection scanning of AI actions, and a platform-wide session-revocation control. No system is perfectly secure, and you use the platform (particularly during Beta) at your own risk.

In the event of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware, and will notify affected individuals where the law requires.

12Multi-Tenancy Data Isolation

While you share the platform's infrastructure with other users, your data is logically siloed and tagged to your account, with access controls designed to ensure that other users cannot access your information.

13Your Legal Rights

Subject to applicable law, you have rights over your personal data:

You can exercise your data rights, including exporting your personal records or permanently deleting your account, directly from your Account Settings page, or by contacting us at privacy@thisisagency.ai. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

14Children's Privacy

Our platform and AI services are not intended for individuals under 18. We do not knowingly collect personal data from children. If we learn we have collected such data without verified parental consent, we will delete it promptly.