Privacy notice

NovaScale AI Ltd, a company registered in England & Wales (Company No. 16139762), registered office 167–169 Great Portland Street, 5th Floor, London W1W 5PF. Contact: hello@heymaisie.com. ICO registration: [ICO registration number — to be added].

Confirm the ICO registration number and whether a named Data Protection Officer or UK representative is required before publication.

• You, our business customer, are the controller for calls Maisie answers on your behalf and for the personal data of your callers. You decide why the calls are handled, what Maisie asks and how long records are kept.
• We are your processor for that call data. We process it only to provide the service, under a written data processing agreement that forms part of our terms.
• We are the controller for our own website analytics, marketing enquiries, demo call requests and your account and billing data.

• Enquiry and demo data: first name, business name, business type, website, mobile number, and the marketing parameters in the link you arrived by (such as gclid and UTM tags).
• Account data: name, business details, email address, password hash, plan and billing history.
• Onboarding data: your services, prices, areas covered, opening hours, urgent-call rules, calendar connection and greeting.
• Call data: caller telephone number, call audio recording, transcript, an AI-written summary, call time and duration, and any booking made.
• Website data: pages viewed, approximate location from IP, device and browser — analytics only after you accept cookies.
• Support data: emails and messages you send us.

• To provide the service and perform our contract with you — account, onboarding, calls, summaries, bookings and billing (contract).
• To place the demo call you asked for, and to follow up on that enquiry (consent for the call; legitimate interests for a short, relevant follow-up).
• To keep the service secure and prevent abuse, including rate-limiting demo calls and hashing the IP address of the request (legitimate interests).
• To meet our legal obligations, such as keeping accounting records (legal obligation).
• To improve how Maisie handles calls. We review call transcripts only where necessary to fix a problem or on your instruction (legitimate interests / your instruction as controller).
• For website analytics and advertising measurement (consent, given through the cookie banner).

We do not sell personal data, and we do not use your call recordings or transcripts to train third-party AI models.

We use the following sub-processors to deliver the service. Each is bound by a data processing agreement and processes data only on our instructions.

We aim to process and store data in the UK or the EEA. Where a sub-processor transfers data outside the UK, that transfer relies on UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses. Confirm the current hosting region and transfer mechanism for each sub-processor and list them explicitly.

We will tell customers before we add or replace a sub-processor, so you have an opportunity to object.

• Call recordings: 90 days by default. You can ask for 30 days, or for a longer period where you have a lawful reason, and you can delete an individual recording at any time.
• Call transcripts and summaries: 12 months, so you have a written record of what was agreed.
• Demo call requests: 12 months, then deleted or anonymised.
• Contact enquiries: 24 months from our last exchange.
• Account and onboarding data: for as long as you are a customer, then 12 months after cancellation.
• Invoices and accounting records: 7 years, as UK law requires.

Maisie tells callers at the start of the call that it is recorded, and she confirms she is the virtual receptionist whenever a caller asks. Our call recording notice explains this in full. As controller, you should also reference call recording in your own privacy information.

• Data encrypted in transit (TLS) and at rest.
• Access to customer data limited to the small number of staff who need it, with individual accounts and multi-factor authentication.
• Recordings and transcripts accessible only to your account, and to our support staff when investigating an issue you have raised.
• Secrets and API keys held in a managed secret store, never in our website code.
• Demo call requests rate-limited per number, per network and per day to prevent misuse.

Under UK GDPR you can ask for a copy of your data, correction, deletion, restriction, a portable export, or to object to processing based on legitimate interests. Where we act as processor for call data, please raise the request with the business whose calls were answered — we will help them respond.

Email hello@heymaisie.com and we will reply within one month. If you are unhappy with our response you can complain to the Information Commissioner’s Office: ico.org.uk, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

If we change this notice we will update the date above, and we will email customers about any material change before it takes effect.