Data processing terms
Last updated 30 October 2026
These terms apply when [Company name to be added] (“Calltrail”, the processor) processes personal data on behalf of a customer (the controller) in providing Calltrail. They form part of our terms of service and meet the requirements of Article 28 of the UK GDPR. If you are an agency, you act for your clients and pass these terms on to them.
1. Details of the processing
| Subject matter and duration | Providing Calltrail, for as long as the customer's account is open plus the deletion period below. |
|---|---|
| Nature and purpose | Routing, recording and reporting on calls; matching calls to website visits; transcribing and summarising recordings; sending alerts, reports and data to services the customer connects. |
| People concerned | Callers; website visitors; the customer's staff and clients who use Calltrail; people named in calls. |
| Types of data | Phone numbers, call times and outcomes, recordings, transcripts and summaries (which may include anything said on a call), names and job details added to leads, website visit identifiers and campaign data. |
The customer should not use Calltrail to collect special category data (such as health information) unless it has a lawful basis to do so and has told us. Callers sometimes mention such information; it is handled like any other call content.
2. Calltrail will
- Process personal data only on the customer's documented instructions, which are these terms and the customer's settings in Calltrail, unless the law requires otherwise (in which case we will tell the customer first unless the law forbids it).
- Make sure everyone authorised to process the data is bound by confidentiality.
- Take appropriate technical and organisational security measures, including encryption in transit and at rest, separation of each customer's data at the database level, access controls, logging of access to recordings, and short-lived links for playback.
- Use the sub-processors listed below, under written terms giving the same protection, and give the customer at least 30 days' notice by email of any new sub-processor so it can object. If it objects on reasonable grounds and we cannot resolve it, the customer may end the affected service.
- Help the customer respond to requests from people exercising their rights, and with security, breach notifications, data protection impact assessments and consultations with the ICO, taking into account the information available to us.
- Tell the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting its data, with the information it needs to meet its own obligations.
- At the end of the service, let the customer export its data for 30 days, then delete it (including from backups within a further 30 days), unless the law requires us to keep it.
- Make available the information needed to show compliance with these terms, and allow for and contribute to reasonable audits, with reasonable notice, no more than once a year unless there has been a breach.
3. The customer will
- Have a lawful basis for the processing and give callers and website visitors the information the law requires, including about call recording.
- Use the cookie consent settings where its website needs them.
- Only connect integrations (such as a CRM, Google Ads or Meta) it is entitled to send the data to; once sent, the customer is responsible for that data in those services.
4. International transfers
Some sub-processors process data outside the UK. Where they do, transfers rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.
5. Sub-processors
| Sub-processor | Processing | Location |
|---|---|---|
| Supabase | Database, logins and recording storage | United Kingdom (London) |
| Vercel | Hosting the app and processing calls | United Kingdom (London), with global edge network |
| Twilio | Phone numbers, call routing, call recording, text messages | United Kingdom, EU and United States |
| Deepgram | Transcribing call recordings (opted out of model training) | United States |
| Anthropic | AI summaries of transcripts (not used for training) | United States |
| Resend | Sending alert, report and login emails | United States and EU |
| Only when a customer connects Google Ads, Analytics or Search Console | United States and EU | |
| Meta | Only when a customer connects the Meta Conversions API | United States and EU |
6. Contact
Data protection questions and breach reports: privacy@calltrail.co.uk.