This policy explains what personal data we collect when you use Bulletproof Receptionist, why we collect it, who we share it with, how long we keep it and the rights you have. We follow the EU General Data Protection Regulation (GDPR) as our standard, wherever our customers and their callers are.
Who we are
Bulletproof Receptionist is a service of Bulletproof Automations (“we”, “us”). We are the controller of the personal data described in this policy, except where we say we act as a processor below.
Contact us about privacy at [email protected].
Our two roles
When we are the controller. We decide how and why data is used for your account, billing, the free browser demo, this website and our own communications with you.
When we are a processor. When your receptionist answers calls for your business, the information callers give belongs to your business. Your business is the controller of that call data, and we process it only on your instructions to provide the service. A Data Processing Agreement is available on request. If you are a caller and want to use your rights over call data, contact the business you called. We will help them respond.
What we collect
Account and business details. Your name, business name, email address, password (stored only in scrambled, hashed form), phone numbers you add, and the business information you enter: services, hours, answers to common questions, your greeting and your settings.
Call information (processed for your business). For each call: the caller’s phone number, the details the caller gives (such as name, phone number, email address and reason for calling), the written transcript of the conversation, messages, leads, urgency flags and any appointments booked, changed or cancelled.
Neither we nor our providers keep audio recordings of calls. The speech and AI providers that handle a live call work under zero data retention: they process the conversation to run the call and do not store it afterwards. We do not use call data to train AI models, and our providers do not either.
Free browser demo. Your business name, email address, password, the email verification code (stored in hashed form), the information you enter, and the time you spend talking to the demo. We also use an automated security check to keep out fake sign-ups.
Billing. Your plan, invoices and payment status. Card details are handled by our payment provider, Stripe; we never see or store your full card number.
Messages to us. What you send when you email us.
This website. Basic technical information our hosting provider receives when you visit, such as your IP address and browser type, used to deliver the site and keep it secure. This website does not use advertising or tracking cookies.
Why we use it, and our legal basis
| What we do | Legal basis under the GDPR |
|---|---|
| Run your account and receptionist, answer calls, send you messages and alerts | Performance of our contract with you |
| Bill you and keep tax records | Contract, and our legal obligations |
| Run the free browser demo and prevent abuse of it | Our legitimate interest in offering a fair free trial |
| Keep the service secure, fix problems and measure usage | Our legitimate interest in a safe, working service |
| Process call information for your business | Your business’s instructions, as its processor |
| Answer your emails | Our legitimate interest in replying to you |
Where we rely on legitimate interests, you can object at any time (see “Your rights”).
Who we share it with
We use trusted providers to run the service. Each processes data only to provide its part of the service, under a written agreement with us.
| Provider | What it does |
|---|---|
| Twilio | Phone numbers and call connections |
| Deepgram | Turns speech into text and text into the receptionist’s voice |
| OpenRouter, and the AI model provider it routes to | Generates the receptionist’s replies during calls |
| Stripe | Payments and invoices |
| Cloudflare | Network security, the sign-up security check and encrypted backups |
| Hostinger, Google or Microsoft | Sends our emails, or yours if you connect your own mailbox |
| Our hosting provider in Germany | Hosts our servers |
We do not sell personal data, and we do not use it for advertising.
We may also share data if the law requires it, to protect our rights or the safety of others, or as part of a business sale, in which case this policy continues to apply.
Where your data is processed
Our servers are in Germany. Some of the providers above are based in, or process data in, the United States and other countries outside the European Economic Area. When data goes to providers in the United States, we rely on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), which the European Commission has found gives adequate protection.
How long we keep it
- Account and business details: while your account is open.
- Call transcripts: deleted 7 days after the call ends.
- Messages, leads and appointments: while your account is open. You can ask us to delete items at any time.
- After you close your account: we delete your account and call information within 30 days.
- Backups: encrypted backups roll off within 35 days.
- Free demo accounts: we delete a demo that is not upgraded within 90 days after the demo ends, except the minimum record we need to stop the same business from taking the free demo again.
- Billing records: for as long as tax and accounting law requires.
How we protect it
We use encryption in transit, hashed passwords, access limited to the people who need it, separate workspaces for each business, and regular encrypted backups. No system is perfectly secure, and we will tell you without undue delay if a breach affects your data.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you
- correct data that is wrong
- delete your data (“right to be forgotten”)
- restrict how we use it
- receive your data in a portable format
- object to processing based on our legitimate interests
- withdraw consent at any time, where we rely on consent
To use any of these rights, email [email protected]. We will reply within one month. You also have the right to complain to a data protection authority, for example in the EU country where you live or work, or the authority for our servers’ location in Germany.
Automated decisions
The receptionist uses AI to hold conversations, take messages and book appointments for the business. It does not make decisions that have legal or similarly significant effects on callers.
Children
The service is for businesses and is not directed to children under 16. We do not knowingly collect their data.
Changes to this policy
We will post any changes on this page and update the date. If a change is significant, we will email account holders before it takes effect.
Contact
Bulletproof Automations Email: [email protected]