Privacy notice: United Kingdom

1. Who this covers

People in the United Kingdom, where the UK GDPR applies: when a UK business uses the service, when a business uses it to offer goods or services to people in the UK, and for account holders in the UK.

The law: UK GDPR; Data Protection Act 2018; Data (Use and Access) Act 2025.

2. Who is responsible

• For the people a business calls or chats with, that business (the workspace) decides why and how the data is used. We process it on its instructions, under our Data Processing Agreement. Under the UK GDPR the workspace is the controller and we are its processor. (Art. 4(7), 4(8), 28)
• For the accounts of people who sign up with us, we are the controller.

3. Why we may use the data

• Account data: to provide the service you signed up for (contract); to keep billing records the law requires (legal obligation); and to keep accounts secure and investigate misuse (legitimate interests). (Art. 6(1)(b), (c), (f))
• People a workspace contacts: the workspace chooses the legal basis. Calls made by an automated calling system need the person's prior consent under the Privacy and Electronic Communications Regulations, and live marketing calls must be screened against the Telephone Preference Service. Both are the workspace's responsibility. (PECR regs. 19 and 21)
• Every call an agent makes or answers opens with a spoken statement that it is an automated AI assistant, and that the call may be recorded if recording is on. No workspace setting removes it.
• We do not sell personal data, use it for advertising, or train models on calls or chats.

4. Your rights

• Access, correction, erasure, restriction and portability. (Art. 15 to 18, 20)
• To object, and to stop direct marketing at any time. Saying so on a call, replying STOP on WhatsApp or using the opt-out link puts your number on that business's do-not-call list. (Art. 21)
• To withdraw consent. (Art. 7(3))
• An answer within one month, which can be extended by two further months for complex requests. (Art. 12(3))

If a business called or messaged you through Dialora AI, ask that business first: it decides what happens to your data, and the workspace has the tools to find, export and erase it. If you do not know which business it was, write to privacy@aicall.vitrano.in with the number that contacted you and the date, and we will pass your request on. If you hold an account with us, write to the same address.

5. Data leaving your country

• Our servers are in Ahmedabad, India, so using the service moves data to India. Services a workspace connects with its own account, such as Twilio, Deepgram, ElevenLabs or a hosted AI model, are mostly in the United States.
• The UK has made no adequacy regulations for India, so a transfer to us needs a safeguard. The ICO publishes two: the International Data Transfer Agreement, and an Addendum that adapts the EU Standard Contractual Clauses. (UK GDPR Art. 46; ICO)

Where each service is: sub-processor list. Terms for businesses: Data Processing Agreement.

6. If there is a breach

• We tell the workspace without undue delay after we become aware of a breach of its data. (Art. 33(2))
• The controller tells the ICO within 72 hours unless the breach is unlikely to put people at risk, and tells the people affected where the risk is high. (Art. 33(1), 34)

7. Complaints

• Since 19 June 2026 a controller must give you a way to complain about how it uses your data, acknowledge your complaint within 30 days, and tell you the outcome. (ICO)
• Write to us, or to the business that contacted you, first. If you are not satisfied, you can complain to the Information Commissioner's Office. (ICO)

8. Still open