Draft – to be reviewed. This page is a working draft with placeholders in [square brackets]. It is not legal advice and must be checked before the service launches.
Privacy policy
This policy explains what personal data Offhook handles, why, how long we keep it, who helps us process it, and your rights. It covers people who call our clients (tradespeople) and are answered by Offhook, our clients themselves, and visitors to this website.
1. Who is responsible
The controller for this website and for client accounts is [BUSINESS NAME] ([OWNER NAME]), [ADDRESS], [POSTCODE AND TOWN], Finland. Business ID [BUSINESS ID]. Contact: hello@offhook.uk.
For calls answered on a client's behalf, the tradesperson is the controller of their callers' details and Offhook processes them on the client's instructions as a processor. [Confirm this split with your adviser and set it out in a data processing agreement with each client.]
2. What we collect
From people who call a client
- The phone number you call from
- Your name and a callback number, if you give them
- What the job is, where it is, and how urgent it is
- When the call started and ended, and how long it lasted
Call recordings are switched off. We do not keep audio recordings, full transcripts or AI summaries of the conversation, only the fields above. During the call, the audio is processed live by Vapi and Twilio to answer you and to work out those details.
From clients
- Your login email address
- Your business details and the mobile number we text job summaries to
- Billing details [add once payments are set up]
From website visitors
This website uses no analytics, no tracking and no advertising cookies, and loads nothing from third-party servers unless you press play on the demo video (which then loads from Loom). Our hosting provider keeps short-lived technical server logs (such as IP address and time of request) to keep the site secure and running. If you email or message us, we keep that conversation to reply to you.
3. Why we use it (legal basis)
- To pass callers' enquiries to the tradesperson they rang, so they can call back: performing our contract with the client, and the legitimate interest of the caller and the client in the enquiry being answered (GDPR Art. 6(1)(b) and (f)).
- To run client accounts and logins: performing our contract (Art. 6(1)(b)).
- To keep the service secure and working, and to fix problems: legitimate interest (Art. 6(1)(f)).
- To meet accounting and tax obligations: legal obligation (Art. 6(1)(c)).
4. How long we keep it
- Call records: while the client's account is active, then deleted within [30] days of the account closing. A client can ask us to delete individual calls at any time. [Set a maximum, e.g. 12 months, if you prefer.]
- Client account details: while the account is active, then [30] days.
- Invoices and accounting records: as long as Finnish accounting law requires.
- Login codes: they expire within minutes and can only be used once.
5. Who processes data for us
| Processor | What for | Where |
|---|---|---|
| Vercel Inc. | Hosts this website and the app. | EU region (Frankfurt) for the app; content may be served from Vercel's global network |
| Supabase Inc. | Database for call records and client accounts, and client logins. | EU (Frankfurt, Germany) |
| Vapi Inc. | The voice AI that answers calls and turns them into a job summary. | USA |
| Twilio Inc. | Phone numbers, call forwarding and the text messages sent to clients. | USA |
| Resend Inc. | Sends the one-time login codes to clients by email. | [USA or EU: check your Resend region] |
Each works under a data processing agreement. Where data goes to the USA, the transfer is covered by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses. Vapi is configured not to use call data for training. [Confirm each provider's certification and settings before launch.] We never sell personal data.
6. Your rights
Under the GDPR (and UK GDPR, where it applies) you have the right to:
- see the personal data we hold about you (access)
- have it corrected if it's wrong
- have it deleted
- restrict or object to how we use it
- receive it in a portable format
- complain to a data protection authority: in Finland, the Data Protection Ombudsman (tietosuoja.fi); in the UK, the Information Commissioner's Office (ico.org.uk); or the authority where you live
7. How to ask for your data or have it deleted
Email hello@offhook.uk from the address or phone number your request is about, and tell us what you'd like. If you called a tradesperson, tell us roughly when you called and which business, so we can find the record. We may ask you to confirm who you are. We reply within one month. If you called a client, you can also ask the tradesperson directly.
8. Cookies
The public website sets no cookies. Clients who log in to the dashboard get essential cookies that keep them signed in. These are needed for the login to work, so no consent banner is required.
9. Changes
If we change this policy, we'll update this page and the date below, and tell clients about important changes by email.
Last updated: [DATE]