This Privacy Policy explains how Klavini Labs Ltd (“we”, “us”, “our”) collects and uses personal data when you use Talk Klavini, the AI telephone assistant available at talk.klavini.co.uk. We act as the data controller for the personal data described below. This policy is written under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
The short version. We give you a UK mobile number. When someone rings it, our AI assistant LILY answers in English on your behalf. We do not record the call. We do not store conversation audio. We do store the caller’s number, the time, how long the call lasted, and — if LILY took a message — the text message we sent you. Nothing more. You can ask us to delete everything we hold at any time.
1. Who we are
Klavini Labs Ltd is a private company limited by shares, registered in England and Wales under company number 16374865. Our registered office is 65 Eton Road, Burton on Trent, DE14 2SP, United Kingdom. We trade as “Klavini Labs” and operate Talk Klavini. (Klavini Labs Ltd was formerly named BusyBuddy LTD; the company number and registered office are unchanged.)
Klavini Labs Ltd is registered with the UK Information Commissioner’s Office (ICO) as a data controller (registration number ZC157267).
For any question about this policy or about the personal data we hold about you, please email [email protected].
2. The personal data we collect
We only collect what we need to run the service. Specifically:
2.1 Account data
- Your name
- Your email address
- Your personal mobile telephone number (so we can send you SMS message summaries)
- A hashed version of your password (we never store the password itself in readable form)
2.2 Subscription and billing data
- Your Stripe customer identifier
- The plan you are on (Starter, Standard, Max or Professional) and your billing cycle dates
- Usage counters — the number of minutes you have used in the current cycle
- A log of Stripe webhook events about your subscription (we keep these so we do not charge or refund you twice for the same event)
We do not store your full card number, your card’s CVC, or your bank account details. Payment information is handled by Stripe (see §5).
2.3 Call metadata (no audio, no transcripts)
For each call to your Talk Klavini number we keep:
- The caller’s telephone number
- The date and time of the call
- The duration of the call
- The call mode — either “AI message” or “live interpreter”
- The outcome (for example: message taken, no message, you were connected)
- Whether we sent you an SMS summary, and the text of that summary
- Whether the caller was on your whitelist of trusted numbers
We do not keep an audio recording of any call. We do not keep a word-for-word transcript. See §9 for a precise statement of what is and is not stored.
2.4 Whitelist
The telephone numbers you have marked as known or trusted. We use these so LILY can recognise the caller and skip steps where appropriate.
2.5 Audit log
A timestamped log of security-relevant events on your account: log in, log out, password reset, change of plan, change of settings, data export and account deletion. We keep this so that you and we can verify what happened on your account.
2.6 Technical data
When you visit talk.klavini.co.uk, our servers automatically record your IP address, the page you requested, the time of the request and your browser’s User-Agent string. We use this for security, debugging and basic counting of visits. See also §10 on cookies.
3. How we use your personal data
| Purpose | Data we use | Lawful basis under UK GDPR |
|---|---|---|
| Create and run your account; let you log in | Account data, audit log | Performance of a contract (Article 6(1)(b)) |
| Take payment and manage your subscription | Account data, subscription & billing data | Performance of a contract (Article 6(1)(b)) |
| Answer calls to your Talk Klavini number with LILY | Call metadata, your whitelist | Performance of a contract (Article 6(1)(b)) |
| Send you the SMS summary of a call | Your mobile number, the SMS summary text | Performance of a contract (Article 6(1)(b)) |
| Translate between you and a caller during a live interpreter call | The live audio of that call (processed in real time, not stored) | Performance of a contract (Article 6(1)(b)) |
| Provide customer support; reply to emails you send us | Account data, email correspondence | Legitimate interests — running the service (Article 6(1)(f)) |
| Detect and prevent fraud, abuse and illegal use of the service | Account data, call metadata, technical data, audit log | Legitimate interests — protecting the service and other users (Article 6(1)(f)) |
| Comply with our legal obligations (for example, responding to a lawful request from a UK authority) | Whatever data is in scope of the obligation | Legal obligation (Article 6(1)(c)) |
| Send you service emails (receipts, security alerts, important changes) | Your email address | Performance of a contract (Article 6(1)(b)) |
| Send you optional marketing emails (we do not currently do this) | Your email address | Consent (Article 6(1)(a)) — only if you ask us to |
We do not carry out any profiling or automated decision-making that produces legal effects about you within the meaning of Article 22 of the UK GDPR.
4. Live calls and how AI processes them
When a caller dials your Talk Klavini number, our system streams the call audio to AI providers (listed in §5) so that LILY can:
- understand what the caller is saying;
- reply in English in a synthesised voice; and
- if you have chosen the live interpreter mode, translate between English and your language in both directions in real time. We currently support 54 languages on the call — including English, Spanish, Portuguese, French, German, Italian, Russian, Polish, Romanian, Ukrainian, Turkish, Arabic, Chinese, Japanese, Korean, Hindi, Indonesian and Vietnamese.
SMS message summaries are sent in the same 54 languages we support on the call — you choose yours at sign-up and can change it any time in the dashboard. If your chosen language ever fails to render correctly on your handset (very rare; Twilio sends non-Latin scripts via UCS-2 at no functional cost), we will fall back to English for that single message and email you.
The audio is processed in transit only. We do not save the audio after the call ends. Our AI providers process the audio under their own data-processing terms and do not use it to train their public models (see §5).
5. Sub-processors
To run Talk Klavini we use a small number of trusted suppliers. Each of these companies acts as our data processor and processes personal data on our instructions only.
| Sub-processor | What they do for us | Where they process |
|---|---|---|
| Stripe Payments Europe Ltd / Stripe Inc. | Take subscription payments; store your card token; issue receipts | Ireland (EU) and United States |
| OpenAI, L.L.C. | Powers LILY’s conversation — gpt-realtime-mini answers the call, gpt-4o-mini-tts speaks system prompts, and gpt-4o-mini writes the SMS summary of your call. OpenAI’s realtime models also serve as the interpreter’s fallback engine. API traffic only — not used to train OpenAI’s public models | United States |
| Microsoft Ireland Operations Ltd (Azure AI Speech) | Performs the live speech recognition, translation and interpreter voice for calls in non-English languages. API traffic only — not used to train Microsoft’s models | United Kingdom (Azure UK South region) |
| DeepL SE | Translates the short caller-reason text shown to the account holder when screening an interpreter call. | Germany (EU) |
| Twilio Inc. / Twilio Ireland Ltd | Telephony — provisioning your UK number, routing calls, sending SMS | Ireland (EU) and United States |
| Resend, Inc. | Sending transactional emails (sign-up confirmation, password reset, receipts) | Ireland (EU) and United States |
| OVH SAS | Hosting our application servers and database | France (EU) |
| OpenRouter, Inc. (routing to Anthropic, PBC) | Powers the in-dashboard support chat — your support messages are answered by an Anthropic Claude model accessed through OpenRouter. API traffic only — not used to train public models | United States |
| Cloudflare, Inc. | Content delivery network and security proxy in front of our website — processes your IP address, TLS connection data and request metadata when you visit talk.klavini.co.uk | Global network (EU and United States); UK Extension to the EU–US Data Privacy Framework and SCCs |
| Deepgram, Inc. | Contingency speech-recognition engine, used only if our primary interpreter engines have an outage. Not active in normal operation — no call audio reaches Deepgram unless the contingency is switched on | United States |
We will update this list when we add or change a sub-processor. If you would like to be told in advance, email [email protected].
6. Transfers outside the United Kingdom
Some of our sub-processors are based in the United States. When personal data is transferred to a country outside the UK that the UK Government has not deemed to provide an adequate level of protection, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (the “UK IDTA”) issued by the Information Commissioner’s Office, together with the underlying EU Standard Contractual Clauses (2021/914). For US-based sub-processors that are certified under the UK Extension to the EU–US Data Privacy Framework, we additionally rely on that framework.
Copies of these safeguards are available on request from [email protected].
7. How long we keep your personal data
Different categories of data are kept for different lengths of time. Where the law sets a minimum period (for example, for accounting records under the Companies Act 2006), we keep data for that period; otherwise we keep it only as long as we need it.
| Category | Retention |
|---|---|
| Account data | For as long as your account is active, plus a 30-day grace period after deletion (see below) |
| Subscription and billing records (invoices, receipts) | 6 years from the end of the relevant tax year (UK statutory requirement) |
| Call metadata and SMS summary text — retention depends on your plan |
|
| Support-chat transcripts (the in-dashboard help chat) | 90 days; deleted immediately if you delete your account |
| Feedback threads you send us from your dashboard | For as long as your account is active; deleted immediately when you delete your account |
| Whitelist | For as long as your account is active; you can delete entries at any time |
| Audit log | 13 months |
| Subscription event log (Stripe webhooks) | 13 months |
| Customer-support emails | 3 years from the last message in the thread |
| Server access logs (IP address, request URL, User-Agent) | 30 days |
Account deletion and the 30-day grace window. When you ask us to delete your account, we mark it for deletion immediately and stop using the data for normal purposes. We then keep the data in a recoverable state for 30 days, so that you can change your mind. After 30 days the data is permanently and irreversibly erased from our live systems. Backup snapshots are overwritten on a rolling 35-day cycle.
8. Your rights under UK GDPR
You have the following rights in relation to the personal data we hold about you:
- Right of access. You can ask for a copy of the personal data we hold about you.
- Right to rectification. You can ask us to correct data that is wrong or incomplete.
- Right to erasure. You can ask us to delete your data. We will do so, subject to any legal duty to keep it (for example, tax records).
- Right to restrict processing. You can ask us to stop using the data while a dispute is resolved.
- Right to data portability. You can ask for a copy of the data you have given us in a structured, machine-readable format.
- Right to object. You can object to us processing your data on the basis of our legitimate interests.
- Right to withdraw consent. Where we rely on your consent, you can withdraw it at any time. This does not affect the lawfulness of processing carried out before you withdrew it.
- Right to lodge a complaint. You can complain to the Information Commissioner’s Office (ICO) at any time. Their website is ico.org.uk/make-a-complaint. We would, however, appreciate the chance to deal with your concerns first.
To exercise any of these rights, email [email protected]. We will respond within one calendar month. We may need to verify your identity before we can act on a request.
9. What we do and do NOT store about your calls
We do not record your calls. We do not store conversation audio. LILY tells the caller this at the start of every call.
To be precise, for each call we:
- Process audio in real time through the providers listed in §5 so that LILY can understand and reply, and (in interpreter mode) translate. The audio passes through our systems and theirs while the call is in progress.
- Do not save the audio to our database, to disk, or to any backup. There is no recording you, we, or anyone else can play back later.
- Do not save a word-for-word transcript of the conversation.
- Do save the call metadata described in §2.3 (who rang, when, for how long, in which mode, the outcome).
- Do save the SMS summary text that we send you after an AI-message call — this is a short note LILY writes for you in your language. It is kept for the retention period set by your plan (see §7) and is the only written record of what the caller asked for.
If you would like the SMS summary text purged before the retention period ends, email [email protected] and we will do it.
10. Cookies
talk.klavini.co.uk uses two strictly-necessary cookies. The first is a session cookie that keeps you logged in as you move between pages; it is scoped to the talk.klavini.co.uk domain, is marked HttpOnly and Secure, and is deleted when you log out. The second is a NEXT_LOCALE cookie that remembers the language in which you would like to read the site. Both are strictly necessary to provide the service you have asked for, so no consent banner is needed.
We do not currently use any analytics, advertising or third-party tracking cookies. If we add any in the future we will update this policy, change the cookie banner accordingly, and ask for your consent where the law requires it.
11. How we protect your personal data
- All traffic to talk.klavini.co.uk is served over HTTPS (TLS 1.2 or higher).
- Passwords are stored only as a salted hash.
- Our servers are hosted in OVH’s data centres in France (EU).
- Access to production systems is limited to named members of the Klavini Labs team.
- We keep backups and we test that we can restore from them.
We will tell you, and the ICO where required, if we discover a personal data breach that is likely to affect your rights.
12. Children
Talk Klavini is not directed at children. You must be at least 18 years old to open an account. We do not knowingly collect personal data from people under 18.
13. Changes to this policy
We may update this policy from time to time. When we make a material change we will tell account holders by email at least 14 days before the change takes effect. The “Last updated” date at the top of this page always shows when it was last changed.
14. How to contact us
For any question about this policy or about the personal data we hold about you, please write to us at:
Klavini Labs Ltd
65 Eton Road
Burton on Trent
DE14 2SP
United Kingdom
Email: [email protected]