Privacy policy
The short version. AfterTheTone answers calls you miss, takes a message and sends it to you. To do that we handle two kinds of personal data: yours as the account holder, and the caller's. Calls are recorded and transcribed, callers are told so at the start of every call, and recordings are deleted after 90 days unless you choose a different period. We never sell data and we don't run advertising or analytics trackers.
1. Who we are
AfterTheTone is a trading name of PJM IT Solutions Ltd, Unit 36, Silk Mill Industrial Estate, Brook Street, Tring HP23 5EF. We are the data controller for the processing described in this policy, except where section 4 says otherwise.
Questions, requests or complaints: support@afterthetone.uk.
2. Who this policy covers
- Account holders ("you", "owners"): the sole traders, small businesses and individuals who sign up for the service.
- Callers: the people who ring an account holder, reach AfterTheTone instead, and leave (or decline to leave) a message.
3. Account holders
What we collect
- Your name, business name (Business plan), mobile number, email address and, on the Personal plan, which mobile network you use.
- Your settings: how calls are routed, your spending cap, how long recordings are kept, whether you prefer email to WhatsApp.
- Usage: the calls taken on your behalf, how each one was classified (message, spam, silent, too short), and the WhatsApp messages and emails we sent you.
- Billing references: your Stripe customer and subscription identifiers and the invoices Stripe raises. We never see or store your card details; Stripe collects them directly.
- Sign-in records: one-time codes (stored only as a hash, expiring after 5 minutes) and session tokens.
- Terms acceptance: the time you accepted the terms and which version.
Why, and on what basis
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Providing the service: answering calls, delivering messages, running your account, taking payment | Performance of a contract |
| Sending you service messages (new message, sign-in code, calls paused, billing problems) | Performance of a contract |
| Keeping the service secure, preventing fraud and abuse, rate-limiting sign-in attempts | Legitimate interests |
| Keeping accounting records | Legal obligation |
We do not send marketing emails or messages. If that ever changes, we will ask first.
How long we keep it
- Your account data: for as long as your account exists. You can delete your account yourself from Settings; we then delete your account, your messages and your call recordings and transcripts straight away.
- Invoice records: Stripe keeps these for the period UK tax law requires (currently six years) even after your account is deleted.
- Sessions expire 90 days after last use. Sign-in codes expire after 5 minutes.
4. Callers
If you called a business or person who uses AfterTheTone, this section is for you.
What we collect
- Your phone number (unless you withheld it), the number you dialled, the time and length of the call.
- A recording and a transcript of the call. The automated assistant says at the start of every call that it is automated and that the call is recorded.
- What you told the assistant: typically your name, the reason for your call and when you would like to be called back, plus a free-form message.
- Whether you said you were happy to be contacted on WhatsApp.
- An automated assessment of the call: whether it was a genuine message, a sales or scam call, or silent.
Why, and on what basis
We take your message because the person you called has asked us to answer when they can't, and because you chose to leave one. Our lawful basis is legitimate interests: the account holder's interest in not missing your call, and yours in getting through to them. The recording exists so the account holder can hear exactly what you said and so the transcript can be checked. The spam assessment exists so account holders are not charged for, or woken by, nuisance calls.
Once your message is delivered, the business or person you called is a controller in their own right for what you told them, as they would be for a voicemail. Their own privacy obligations apply to how they use it.
Automated processing
The call is handled by an AI voice assistant: speech is transcribed by software and a language model decides what to say next and summarises your message. No decision with legal or similarly significant effect on you is made automatically. The spam assessment only affects whether the account holder is notified and billed; it is never used to block your number.
How long we keep it
- Recordings and transcripts: 90 days by default. Each account holder can set a shorter or longer period, or keep them.
- Calls that did not match any account (for example a number dialled by mistake): 30 days.
- If you ask us to erase your data (section 7), we delete recordings and transcripts and remove your number, name and message from our records across every account on the platform.
5. Who we share data with
We use these processors. Each only receives what it needs to do its job, under a written contract.
| Provider | What they do for us | Where |
|---|---|---|
| Twilio | Carries the phone calls, provides our phone numbers, sends WhatsApp messages and one-time codes | EU/US, under the UK International Data Transfer Addendum and Standard Contractual Clauses |
| Retell AI | Runs the voice assistant: speech-to-text, text-to-speech and the conversation; produces the recording, transcript and call analysis | US, under Standard Contractual Clauses |
| Anthropic | The language model the assistant uses, via Retell | US, under Standard Contractual Clauses |
| Stripe | Payments, invoices and the billing portal | EU/UK/US; Stripe is also an independent controller for payment data |
| Resend | Sends our emails (the WhatsApp fallback and sign-in codes) | US, under Standard Contractual Clauses |
| Our hosting provider | Runs the application, database and the storage that holds recordings and transcripts | United Kingdom |
We also disclose data where the law requires it, for example to a court or regulator, and to a successor if the business is sold, under the same commitments.
6. Security
All traffic is encrypted in transit. Sign-in codes are stored only as hashes. Account access is by one-time code to your verified mobile or email; there are no passwords to leak. Recordings sit in private storage reachable only through the application. Our staff access data only to support you, to handle a request under this policy or to keep the service running.
7. Your rights
Under UK GDPR you can ask us to:
- access the personal data we hold about you and receive a copy;
- correct it if it is wrong;
- erase it;
- restrict or object to how we use it, including where we rely on legitimate interests;
- port it to another service, where we process it under a contract.
Email support@afterthetone.uk. We reply within one month. Account holders can delete their account from Settings without asking us. Callers have no login, so we will first confirm you control the phone number concerned, for example by sending a code to it. A request from a caller is applied across every account that holds that number.
If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk, though we would rather hear from you first.
8. Cookies
We set one cookie, att_session, only when you sign in, so the app knows it is you. It is strictly necessary for the service, so it needs no consent banner. We use no analytics, advertising or third-party cookies on this site.
9. Children
The service is for adults. We do not knowingly take accounts from anyone under 18. Callers of any age may leave a message; we treat a caller's data the same whatever their age and delete it on request.
10. Changes
If we change this policy in a way that matters, we will tell account holders by WhatsApp or email at least 14 days before it takes effect. The date at the top is the current version.