Privacy policy
Last updated 30 October 2026
Calltrail is a call tracking service for UK businesses and the agencies that market them. It is provided by [Company name to be added], company number [company number], registered office [registered office address] (“we”, “us”).
This policy explains what personal data Calltrail handles, why, and the choices you have.
Our two roles
- For people who use Calltrail (our customers and their staff): we decide how your account data is used, so we are the controller.
- For people who call our customers, or visit their websites: we process that data on our customer's behalf and only on their instructions, so we are their processor and the business you called is the controller. If you called a business that uses Calltrail and have a question about your data, contact that business first; we will help them answer you. Our data processing terms set out how we handle it.
What we collect
Account data
Names, email addresses, passwords (stored only as a secure hash), the businesses you manage, your settings, and a record of important actions such as changes to call handling, playing recordings and changing access.
Call data (for our customers)
- The caller's phone number (unless withheld), the number they called, times, how the call was routed and its outcome.
- Call recordings and voicemails, if the business has recording switched on. Callers hear a notice before recording starts.
- Transcripts and short AI-written summaries of recordings, if the business has these switched on.
- Lead details the business adds, such as a name, stage and job value.
Website visit data (for our customers)
If a business adds our tracking script to its website, and the visitor accepts cookies where the business requires consent, we record a random visitor identifier, the pages landed on, how the visitor arrived (for example the advert, campaign, keyword and click identifier), and identifiers already set by the site's own Google Analytics or Meta tags. We use this to show which visit led to a call. We do not collect names, form entries or anything typed into the website.
Connected services
When a customer connects Google Ads, Google Analytics, Google Search Console, Meta or a webhook, we store the access it grants (encrypted, and never shown again in the app) and the settings needed to send or fetch data.
Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Providing Calltrail: routing and recording calls, reports, alerts, integrations | Contract with our customer; for callers and visitors, the customer's lawful basis, usually legitimate interests |
| Security, preventing fraud and misuse, keeping audit records | Legitimate interests |
| Billing and accounts | Contract; legal obligation for financial records |
| Service emails such as login links, alerts and reports | Contract; every report email has a one-click unsubscribe |
We do not sell personal data, use it for advertising, or use recordings or transcripts to train AI models.
AI processing
Recordings are transcribed by Deepgram and summarised by Anthropic's Claude, under contracts that stop either using the data to train their models. Summaries and suggestions are clearly labelled as AI-written, quote the transcript as evidence, and never change a lead without a person accepting them. Customers can switch transcription and summaries off.
Google user data
When a customer connects a Google account, Calltrail requests only the access it needs:
- Google Ads: to upload offline conversions (calls and booked jobs that came from an ad click) and to read, for those clicks, the campaign, ad group, keyword and the search terms report, so the customer can see what led to each call.
- Google Search Console: to read search analytics (queries and pages) for the sites the customer chooses, to show which searches bring visitors to each page.
Calltrail's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to provide these features to the customer who connected it. It is not sold, not used for advertising, not used to train AI models, and not read by people except where the customer asks for support, it is needed for security, or the law requires it. Customers can disconnect at any time in Calltrail or in their Google account settings, and we delete the stored access straight away.
Who we share it with
We use these service providers, under contracts requiring them to protect the data and use it only to provide their service to us:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, logins and recording storage | United Kingdom (London) |
| Vercel | Hosting the app and processing calls | United Kingdom (London), with global edge network |
| Twilio | Phone numbers, call routing, call recording, text messages | United Kingdom, EU and United States |
| Deepgram | Transcribing call recordings (opted out of model training) | United States |
| Anthropic | AI summaries of transcripts (not used for training) | United States |
| Resend | Sending alert, report and login emails | United States and EU |
| Only when a customer connects Google Ads, Analytics or Search Console | United States and EU | |
| Meta | Only when a customer connects the Meta Conversions API | United States and EU |
Where data goes outside the UK, we rely on UK adequacy regulations or the International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. We also share data with the places a customer chooses to send it (such as their CRM, Google Ads or Meta), and where the law requires.
How long we keep it
- Recordings, transcripts and summaries: for the period each business chooses (one year unless they change it), then deleted automatically.
- Call records, leads and reports: while the customer's account is open, and deleted within 30 days of it closing unless they ask us to export it first.
- Website visit data: up to 13 months.
- Billing records: six years, as the law requires.
- Backups are overwritten on a rolling basis within 30 days.
Keeping it safe
Data is encrypted in transit and at rest. Each business's data is separated at the database level, so one customer cannot see another's. Recordings are private and played only through short-lived links after checking access, and every play is logged. Secrets for connected services are stored apart and can't be read back through the app.
Your rights
You can ask to see, correct, delete or move your data, object to how it is used, or ask us to restrict it. If you called or visited a business that uses Calltrail, ask that business; we will help them respond. To contact us, email privacy@calltrail.co.uk. If you are unhappy with our answer, you can complain to the Information Commissioner's Office.
Cookies
The Calltrail app uses only the cookies it needs to keep you signed in and to remember if you are viewing the demo. The tracking script on customers' websites stores a random visitor identifier in the browser, and only after the visitor accepts cookies when the business requires consent.
Changes
We will update this page when things change and tell customers about significant changes by email.