Privacy Policy

1. Data Controller

Two questions, and they do not have the same answer. Who operates this website and signs your agreement is one question; who is the controller for the personal data you send us through it is another. The imprint answers the first: AUDACT AI LIMITED (Ireland, CRO 822514) operates this site and signs customer, pilot and supplier agreements. This section answers the second, and today that is not the same company. It is stated rather than smoothed over, because a visitor who guesses wrong writes to the wrong supervisory authority.

Controller for this website, and for what you send us through it: Audact AI Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom (company no. 17059133) — "Audact", "we", "us". Contact: privacy@audact.ai

What changes when the agreement moves. AUDACT AI LIMITED (Ireland, CRO 822514, incorporated 29 July 2026) is the EU operating company and the contracting party named in the footer of this site and in the imprint. An agreement signed with the United Kingdom company is assigned to it by written notice. This page does not assert that the assignment has already been carried out, because that is not established here. Where it has been, the Irish company is the controller for that record and the Data Protection Commission is the supervisory authority rather than the ICO. If you need that settled before you sign, ask privacy@audact.ai and get the answer in writing.

Where Audact is not a controller. Personal data that passes through a customer's deployment — callers, transcripts, receipts — is processed on that customer's instructions. There Audact is a processor or a sub-processor and not a controller, and that processing runs under the Data Processing Agreement attached to the customer's signed order form; the version published here is a draft under counsel review. Section 1A sets out both chains.

1A. Who is controller, and who is processor

There are two routes to buying Audact and they put the same parties in different roles. Which one applies is fixed per deployment in the agreement you sign, not by this page.

Role under the GDPR
Controller
Direct
The customer that signs — the organisation whose callers are on the line
White-label
The end client of the agency
Role under the GDPR
Processor
Direct
The Audact company named on your order form (Data Processing Agreement, section 1)
White-label
The agency. An agency is also a controller in its own right for what it does with the data beyond its client's instructions
Role under the GDPR
Sub-processor
Direct
The suppliers listed in the Data Processing Agreement, section 3
White-label
Audact
Role under the GDPR
Further sub-processors
Direct
—
White-label
The suppliers listed in the Data Processing Agreement, section 3

Roles in the processing chain, per contract route
Role under the GDPR	Direct	White-label
Controller	The customer that signs — the organisation whose callers are on the line	The end client of the agency
Processor	The Audact company named on your order form (Data Processing Agreement, section 1)	The agency. An agency is also a controller in its own right for what it does with the data beyond its client's instructions
Sub-processor	The suppliers listed in the Data Processing Agreement, section 3	Audact
Further sub-processors	—	The suppliers listed in the Data Processing Agreement, section 3

Three axes are easy to confuse and none of them is the same as the others: provider and deployer come from the AI Act, manufacturer comes from the Product Liability Directive, and controller and processor come from the GDPR. A white-label agency can hold a different role on each of the three at the same time.

2. Data We Collect

Agency application. The form on /for-agencies/apply has three required fields — agency name and your role, email address, and the vertical you work in — and eight optional ones behind a single toggle: active end clients, current platform, EU jurisdictions you deploy in, languages your agents speak, monthly minutes, go-live window, what you charge one end client a month, and contract preference. Leaving all eight empty does not affect the application.

Recorded with every submission, whether you fill in the optional fields or not: the time, the IP address the request came from, and which link brought you to the form (one of two values, "apply" or "pilot"). The form also carries a hidden field that only an automated submission fills in; its value is checked and never stored.

Where a submission goes. The record is written to a database in the region named in section 4. The same fields are also sent to us as a notification and written to the application log of our hosting provider, so that a request is not lost if one of the two fails. Those copies are not a separate register and serve no other purpose. Enquiries from the enterprise form are also posted to a Slack channel of ours; Slack is listed as a sub-processor in the data processing agreement.

Other forms on this site. The enterprise inquiry form collects name, organisation, email address and sector, plus optional monthly volume, a free-text message, and five scoping answers (action class, current control, phase, system, framework). The waitlist, the developer-sandbox request, the WordPress-plugin notification and the newsletter collect an email address; a resource download (such as the migration kit) also records which resource, and optionally adds you to the migration-paths list if you tick that box. All of them record the time and the IP address in the same way.

Cookies. Strictly necessary cookies only. No tracking cookies, no advertising trackers, and no third-party analytics services. See our Cookies Policy.

Platform usage (post-launch): Call metadata (timestamps, jurisdiction, policy decisions, evidence hashes). Audio is not retained by default; where recording is switched on, it is kept for up to 90 days.

Website: Basic server logs (IP address, user agent, pages visited). No advertising trackers.

3. Purpose, Legal Basis and Retention (GDPR Art. 6)

One row per category of data in section 2: why we hold it, on what basis, and for how long.

Data
Required application fields: agency and role, email address, vertical
Purpose
Judge the request and prepare the call you asked for
Legal basis
Art. 6(1)(b) — steps taken at your request before entering into a contract
Retention
While the application is open, and up to 12 months after our last contact about it
Data
The eight optional application fields
Purpose
Qualify the request before the call, so the call is about your situation and not about the form
Legal basis
Art. 6(1)(f) — our interest in qualifying an inbound request. You can leave every one of them blank
Retention
With the application record
Data
Time and IP address of the submission
Purpose
Rate limiting (five submissions per address per hour) and tracing an automated or fraudulent submission
Legal basis
Art. 6(1)(f) — security and availability of the form
Retention
With the application record. The rate-limit counter itself lives in memory for one hour
Data
Notification and log copies of the same fields
Purpose
So that a request is not lost when the database write and the notification disagree
Legal basis
Art. 6(1)(b) and 6(1)(f), as for the fields themselves
Retention
30 days
Data
Enterprise inquiry fields
Purpose
Scope a pilot and answer the question you asked
Legal basis
Art. 6(1)(b) — steps taken at your request before entering into a contract
Retention
As the application record above
Data
Email address for the waitlist, the developer sandbox, the plugin notification and the newsletter
Purpose
Tell you when the thing you asked about exists
Legal basis
Art. 6(1)(a) — consent, given by submitting that form for that purpose
Retention
Until you ask us to remove you, or 12 months after signup, whichever is earlier
Data
Email address for a resource request (the migration kit) and, only if you tick the box, the migration-paths list
Purpose
Send you the resource when it is ready; and, only if you tick the box, send the migration-paths list
Legal basis
Art. 6(1)(b) for sending the resource; Art. 6(1)(a) — consent, given by ticking the box — for the list
Retention
Until you ask us to remove you, or 12 months after signup, whichever is earlier
Data
Platform service data (post-launch)
Purpose
Deliver the compliance services under the customer contract
Legal basis
Art. 6(1)(b) — performance of a contract
Retention
As agreed with the customer; see section 5
Data
Website server logs
Purpose
Operate and secure the site
Legal basis
Art. 6(1)(f) — security and availability
Retention
30 days

Purpose, legal basis and retention per category of data
Data	Purpose	Legal basis	Retention
Required application fields: agency and role, email address, vertical	Judge the request and prepare the call you asked for	Art. 6(1)(b) — steps taken at your request before entering into a contract	While the application is open, and up to 12 months after our last contact about it
The eight optional application fields	Qualify the request before the call, so the call is about your situation and not about the form	Art. 6(1)(f) — our interest in qualifying an inbound request. You can leave every one of them blank	With the application record
Time and IP address of the submission	Rate limiting (five submissions per address per hour) and tracing an automated or fraudulent submission	Art. 6(1)(f) — security and availability of the form	With the application record. The rate-limit counter itself lives in memory for one hour
Notification and log copies of the same fields	So that a request is not lost when the database write and the notification disagree	Art. 6(1)(b) and 6(1)(f), as for the fields themselves	30 days
Enterprise inquiry fields	Scope a pilot and answer the question you asked	Art. 6(1)(b) — steps taken at your request before entering into a contract	As the application record above
Email address for the waitlist, the developer sandbox, the plugin notification and the newsletter	Tell you when the thing you asked about exists	Art. 6(1)(a) — consent, given by submitting that form for that purpose	Until you ask us to remove you, or 12 months after signup, whichever is earlier
Email address for a resource request (the migration kit) and, only if you tick the box, the migration-paths list	Send you the resource when it is ready; and, only if you tick the box, send the migration-paths list	Art. 6(1)(b) for sending the resource; Art. 6(1)(a) — consent, given by ticking the box — for the list	Until you ask us to remove you, or 12 months after signup, whichever is earlier
Platform service data (post-launch)	Deliver the compliance services under the customer contract	Art. 6(1)(b) — performance of a contract	As agreed with the customer; see section 5
Website server logs	Operate and secure the site	Art. 6(1)(f) — security and availability	30 days

A request under section 6 covers the record in all of these systems.

4. Data Storage & Residency

Primary application hosting: Frankfurt. AWS eu-central-1; a backup region in AWS eu-west-1 (Ireland) is being set up. Both are inside the EEA. A number of the sub-processors listed in the Data Processing Agreement are US-owned; where they process personal data, the transfer mechanism is the Standard Contractual Clauses under Chapter V GDPR.

5. Data Retention

Application records (agency and enterprise): while the application is open, and up to 12 months after our last contact about it. If it becomes a contract, the record becomes part of the customer record and follows that contract.

Waitlist, sandbox, plugin-notification and newsletter addresses: until you ask us to remove you, or 12 months after signup, whichever is earlier.

Application and server logs: 30 days.

Everything that runs through a deployment — call audio, transcript, released output, receipt metadata — is customer data, and there Audact is a processor rather than a controller. Those periods are set per object in the Data Processing Agreement, section 2A, together with who sets each one and why it is kept.

No retention period follows from the AI Act. Article 50 is a transparency duty and sets no retention period, and the Commission guidelines C(2026)5054, point (73), state that a full provenance chain is not mandatory. Where a period does apply it comes from the contract, or from a rule that applies to the customer's own sector — never from Article 50.

6. Your Rights (GDPR Art. 15-22)

You have the right to: access your data, rectify inaccuracies, request erasure (right to be forgotten), restrict processing, data portability, and object to processing. Exercise these rights at privacy@audact.ai. We respond within 30 days (extendable by up to 60 days for complex requests, with notice).

GDPR erasure: Audact uses crypto-shredding (coming soon): the key that decrypts the payload will be destroyed, so the sequence remains checkable while the content is gone.

7. Sub-processors

We use sub-processors to deliver our services. The sub-processor table in the Trust Center is the authoritative, current register.

8. Contact & Complaints

Privacy contact: dpo@audact.ai. Audact does not publish the designation of a Data Protection Officer under Article 37, so read this as the privacy contact and not as a designated officer.

Supervisory authority: Information Commissioner’s Office (ICO), United Kingdom. AUDACT AI LIMITED (Ireland, CRO 822514, incorporated 29 July 2026): Data Protection Commission (DPC), Ireland.

Version history

Last amended on 27 August 2026. Earlier versions of this document are available on request.