Privacy Policy

Enchat Ltd

Effective date: 28 July 2026Last updated: 28 July 2026Version: 2.0

1. Introduction

This policy explains how Enchat Ltd collects, uses, shares and protects personal information in connection with enchat, our AI voice and WhatsApp automation service for service businesses.

It covers three groups of people:

• Business customers. The businesses that subscribe to enchat, and the individual staff members who use it.
• Website visitors and prospective customers. Anyone who visits our website, books a call, or receives marketing from us.
• Customers and enquirers of our business customers. People who call, message or book with a business that uses enchat.

If you are in the third group and you want to know how your information is being used, please read section 3 first. In most cases the business you contacted, not Enchat Ltd, controls that information, and you should direct your request to them.

2. Who we are

Enchat Ltd is the company responsible for the enchat service.

We have not appointed a statutory Data Protection Officer, because we are not required to under UK data protection law. Responsibility for data protection sits with our directors, and support@enchat.co.uk is the fastest way to reach them on this subject.

3. The two different roles we play

This is the most important section of this policy, because it determines who is responsible for what.

3.1 When we are the controller

We are the controller for:

• account and billing information relating to our business customers;
• information about the individual staff members who log in and use enchat;
• website visitor and prospective customer information, including marketing contacts;
• technical, security and diagnostic information generated by our platform;
• support correspondence sent to us directly.

For all of the above, we decide why and how the information is used, and this policy governs that use.

3.2 When we are the processor

We are a processor for the enquiry information that flows through enchat on behalf of a business customer. This includes:

• the content of calls and WhatsApp conversations handled by an AI agent;
• names, telephone numbers, email addresses and enquiry details captured during those conversations;
• text transcripts of calls;
• booking, appointment and payment details created through the service;
• notes, summaries, tags and outcomes generated by the AI agent.

For all of the above, our business customer is the controller. They decide what the service is used for, what data is collected, how long it is kept and what lawful basis applies. We only process that information on their documented instructions, under the terms of our Data Processing Agreement.

If you are an enquirer or customer of a business that uses enchat: your rights under data protection law are exercised against that business, not against us. If you contact us directly we will tell you, without unnecessary delay, that we are the processor, and we will pass your request to the relevant business customer where we are able to identify them.

4. Information we collect as controller

4.1 Account and customer information

Business name, trading name, business address, business telephone number, website, VAT number where provided, and the name, job title, work email address and work telephone number of the individuals who administer or use the account.

4.2 Billing information

Subscription plan, billing address, invoices, payment history, and the last four digits and expiry date of a payment card where our payment provider supplies them. We do not store full payment card numbers on our systems. Card details are collected and stored by our payment provider, which is certified to the PCI DSS standard.

4.3 Account usage and technical information

Log-in timestamps, IP address, device type, browser type and version, operating system, pages and features used, session duration, error and diagnostic reports, and audit records of actions taken within the account.

4.4 Website and marketing information

Information you provide through forms on our website, when you book a call through our Calendly booking page, when you use the chat widget on our website, or when you correspond with us.

Where you have consented to analytics and advertising cookies, this also includes website usage information and advertising identifiers. Section 14 sets out exactly which cookies we use and who provides them.

We also collect business contact information about prospective customers from sources other than the individual concerned, for the purpose of business-to-business marketing. The categories of information involved are name, job title, employer, business email address, business telephone number and publicly listed business profile information.

The sources we use are:

• publicly accessible sources, including company websites, Companies House, and public professional profiles on platforms such as LinkedIn;
• licensed business data and lead generation providers.

Where we obtain your information this way, we will provide you with this policy within one month, or at the latest at the point we first contact you. Section 8.3 explains how to stop us contacting you. You may ask us at any time which provider supplied your details, by emailing support@enchat.co.uk, and we will tell you.

4.5 Support and correspondence

Emails, support tickets, chat messages, meeting notes and, where a call with our team is recorded and you have been told it is being recorded, the recording and any transcript.

4.6 Information we do not want

Please do not send us special category information (such as information about health, race, religion, sexual orientation, political opinions, trade union membership or biometric data) or criminal offence information through general correspondence or support channels. We do not need it in order to support you, and we will delete it where it reaches us unnecessarily. This does not apply to enquiry data lawfully processed through the service on a business customer’s instructions, which is dealt with in section 5.

5. Special category and sensitive information in the service

Some of our business customers operate in sectors where an enquirer may reveal health or other sensitive information during a call or message. Dental practices, clinics, veterinary practices and similar businesses are obvious examples.

Where this happens:

• the business customer is the controller and must have an appropriate lawful basis under both Article 6 and Article 9 of the UK GDPR, and must have an appropriate policy document in place where one is required;
• we act only as processor, on that customer’s instructions;
• we apply access restrictions, encryption and retention controls to that information;
• we do not use that information to train, fine-tune or improve any AI model, and we contractually require the same of the AI providers we use.

If you are a business customer in a sector of this kind, please raise it with us before going live so that we can confirm the appropriate configuration and record it in your Data Processing Agreement.

6. Why we use information, and our lawful bases

Where we act as controller, we rely on the following lawful bases.

Where we rely on legitimate interests, we have carried out a balancing assessment and concluded that our interests are not overridden by your rights and freedoms. You may ask us for a summary of any of these assessments by writing to support@enchat.co.uk, and you have the right to object at any time. Section 11 explains how.

Where we rely on consent, you may withdraw it at any time. Withdrawing consent does not affect the lawfulness of anything we did before you withdrew it.

6A. Whether you have to give us information

Some of the information we ask for is necessary in order to enter into or perform a contract with us, and some is optional.

There is no statutory obligation on you to give us personal information, other than information we need in order to meet our own legal obligations, such as tax and accounting records.

7. Calls, transcription and artificial intelligence

Because enchat is an AI product, we set this out explicitly rather than burying it.

7.1 How calls and messages are handled

When an enquirer contacts a business that uses enchat, an AI agent may answer the call or respond to the message. The audio or message content is converted to text, processed by a large language model in order to understand the enquiry and generate a response, and the outcome is written back into the business customer’s inbox, calendar or CRM.

7.2 Transcripts, and what we do not keep

We keep a text transcript of the conversation. We do not retain a recording of the call audio. Audio is processed in the moment in order to produce the transcript and generate a spoken reply, and is not stored by us afterwards.

It remains the business customer’s responsibility, as controller, to tell callers that the call is being handled by an automated system and that a transcript is kept. That duty arises from the transparency and fairness requirements of Articles 13 and 14 of the UK GDPR. Where a business customer separately monitors or records its own staff’s use of the system, the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018 apply in addition, and require all reasonable efforts to be made to inform system users.

We provide configurable announcements and disclosure wording to support this, and we require our business customers to use it.

7.3 Model training

We do not use customer or enquirer content to train, fine-tune or improve any AI model, whether our own or a third party’s.

The providers that carry out speech recognition, language understanding and speech generation are engaged by us as processors. They are contractually restricted to processing content on our instructions and for the purpose of returning a response, and are not permitted to use it for model development. Content sent to them is retained only for the period needed to return a response, or for a short abuse-monitoring window where a provider requires one.

7.4 Automated decision-making

Enchat automates conversations, booking and note-taking. It does not make decisions that produce legal effects concerning an individual or similarly significantly affect them, such as decisions about credit, employment, insurance or access to essential services. Where an enquiry falls outside what the AI agent can handle, it is handed to a human at the business customer.

If a business customer configures the service in a way that would result in significant automated decision-making, they become responsible for meeting the additional requirements that then apply, including the requirement to offer human intervention. Our contract requires them to tell us before doing so.

7.5 Accuracy

AI-generated transcripts, summaries and notes can contain errors. They are a working record, not a verbatim legal record. Business customers should treat them accordingly, and enquirers who believe a record about them is inaccurate should raise it with the business concerned.

8. Who we share information with

We do not sell personal information. We do not share it with third parties for their own marketing purposes.

8.1 Service providers and sub-processors

We use a limited number of providers to run the service and our website. Each is bound by a written contract that meets the requirements of Article 28 of the UK GDPR, and each is permitted to use the information only to provide the service to us.

Providers that support the enchat service:

Providers that support our website and our own business:

Vapi Inc. engages its own specialist providers for speech recognition, language modelling and speech generation, and which of them are involved depends on how an agent is configured. Business customers may ask us for the current list applying to their account, and we will provide it.

We will update this list when it changes. Business customers may ask to be notified of changes in advance, as set out in our Data Processing Agreement.

8.2 Other disclosures

We may also disclose information:

• where we are required to by law, by a court order, or by a regulator;
• to establish, exercise or defend legal claims;
• to protect the rights, property or safety of Enchat Ltd, our customers or the public;
• to a buyer or prospective buyer in connection with a sale, merger or reorganisation of our business, subject to appropriate confidentiality protections, and we will tell affected customers if this happens.

8.3 Marketing

We market our services to businesses. Where we contact a named individual at a business by email, we rely on legitimate interests and on the business-to-business provisions of the Privacy and Electronic Communications Regulations.

Every marketing email includes an unsubscribe link. You may also email support@enchat.co.uk and ask us to stop, and we will act on that request without unnecessary delay and add your details to our suppression list so that we do not contact you again.

We screen telephone marketing against the Telephone Preference Service and Corporate Telephone Preference Service registers before calling.

9. International transfers

Information processed through enchat is transferred to the United States. The platform we run on, and the AI providers that understand enquiries and generate responses, process information there. This means the content of calls and messages handled by an AI agent is transferred to the United States.

Several of the providers supporting our website, including Google, LinkedIn and Calendly, also transfer information to the United States.

We are direct about this because it is the question a compliance-minded customer will ask, and because a policy that stays silent on it is not being straight with anyone. Section 8.1 sets out the specific safeguard applying to each provider.

9.1 How we make those transfers lawful

Where information is transferred outside the United Kingdom, we make sure one of the following applies:

• the destination country is covered by UK adequacy regulations. This currently includes transfers to organisations in the United States that are certified under the UK Extension to the EU-US Data Privacy Framework; or
• the transfer is made under the International Data Transfer Agreement, or the International Data Transfer Addendum to the European Commission’s standard contractual clauses, in each case supported by a transfer risk assessment; or
• another lawful safeguard or exception under Chapter V of the UK GDPR applies.

Before we engage any provider that processes information outside the United Kingdom, we check whether it holds a current Data Privacy Framework certification, and where it does not, we put an International Data Transfer Agreement or Addendum in place and carry out a transfer risk assessment covering the laws and practices of the destination country.

9.2 The safeguards we apply in addition

Contractual mechanisms alone are not the whole answer, so we also:

• transmit all data in transit using TLS encryption;
• send only the content necessary to generate a response, rather than the full customer record;
• contractually prohibit our AI providers from using the content to train or improve their models;
• require zero or minimal data retention at the provider, so that content is not stored beyond the period needed to return a response or to meet a short abuse-monitoring window where the provider requires one;
• prohibit onward transfer by the provider except under equivalent safeguards.

9.3 What business customers can ask for

Business customers may request, by writing to support@enchat.co.uk:

• the identity and location of each provider involved in processing their data;
• a copy of the relevant transfer mechanism;
• a summary of the associated transfer risk assessment;
• confirmation of the retention and no-training terms we hold with each AI provider.

If you operate in a sector where transfers outside the United Kingdom present a particular difficulty, speak to us before going live. Where a UK or European Union processing option is available for your configuration, we will tell you.

10. How long we keep information

We keep personal information only for as long as we need it for the purpose we collected it, or for as long as the law requires. The periods below are our defaults. Where information is processed on behalf of a business customer, that customer sets the period and we follow their instruction.

Where a retention period expires but we are required to keep information for a legal claim, an investigation or a regulatory requirement, we keep only what is necessary for that purpose and delete the rest.

Information held in encrypted backups is deleted on the backup cycle above rather than immediately, and remains protected and inaccessible for ordinary use in the meantime.

11. Your rights

Under the UK GDPR and the Data Protection Act 2018 you have the following rights in relation to information for which we are the controller.

How to exercise them

Email support@enchat.co.uk. Please tell us which right you want to exercise and give us enough information to find your records.

• We will respond within one month. Where a request is complex, or where you have made a number of requests, we may extend that by up to two further months, and we will tell you within the first month if we do.
• We may need to verify your identity before we respond, and the one month period does not begin until we have what we reasonably need to do so.
• We will make reasonable and proportionate searches for the information you have asked for.
• Requests are free. We may charge a reasonable fee, or refuse, where a request is manifestly unfounded or excessive, and we will explain why if that happens.

If your request relates to a call or message you had with a business that uses enchat, please contact that business. See section 3.2.

12. How to complain

If you are unhappy with how we have handled your personal information, please tell us first at support@enchat.co.uk. You do not have to, but it usually gets the problem solved faster.

• You may complain through any channel, including by email, by post, by telephone, or by telling any member of our team. You do not have to use a particular form.
• We will acknowledge your complaint within 30 days of receiving it.
• We will investigate and respond without undue delay.
• We will tell you what we found and what we are doing about it.
• We keep a record of every complaint, what we did about it, and the outcome.

You also have the right to complain to the Information Commissioner’s Office at any time.

Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Helpline: 0303 123 1113 ico.org.uk/make-a-complaint

Complaining to us does not affect your right to complain to the ICO or to seek a remedy through the courts.

13. Security

We apply technical and organisational measures appropriate to the risk, including:

• encryption of data in transit using TLS, and encryption of data at rest;
• role-based access controls, so that staff and contractors can only reach the data they need for their role;
• multi-factor authentication on administrative access to our systems;
• logging and monitoring of access to customer data;
• segregation of customer data so that one business customer cannot access another’s;
• vetting of staff and contractors, confidentiality obligations, and data protection training;
• a documented security incident and breach response procedure, tested periodically;
• due diligence on providers before we engage them, and written Article 28 contracts with each.

If a personal data breach occurs that is likely to result in a risk to people’s rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it, and we will tell affected individuals without undue delay where the risk is high. Where we are acting as processor, we will notify the affected business customer without undue delay so that they can meet their own obligations.

No system can be guaranteed completely secure. We do not claim otherwise. What we commit to is applying appropriate measures, keeping them under review, and telling you promptly if something goes wrong.

14. Cookies and similar technologies

A cookie is a small file stored on your device when you visit a website. We also use similar technologies, such as tracking pixels and local storage.

14.1 Cookies we set without consent

These are strictly necessary for the website to work, or fall within the limited exceptions introduced by the Data (Use and Access) Act 2025. Where we rely on those exceptions, statistical information is aggregated, is not shared with any other party except to help us improve our own website, and you may object at any time using the cookie settings link in the footer of our website.

14.2 Cookies we set only with your consent

These are set only if you accept them through our cookie banner. Rejecting them is as easy as accepting them, and you can change your mind at any time.

14.3 Managing your choices

You can change or withdraw your cookie preferences at any time using the cookie settings link in the footer of our website. You can also block or delete cookies in your browser settings, although note that browser settings alone are not how we obtain or record your consent, and blocking strictly necessary cookies may stop parts of the website working.

15. Children

enchat is a business service. It is not directed at children, and we do not knowingly collect information from anyone under 18 in the course of running our own business. If you believe a child’s information has reached us in error, contact support@enchat.co.uk and we will delete it.

Where a business customer’s own enquirers may include children, that customer is the controller and is responsible for meeting the additional requirements that apply to children’s information.

16. Changes to this policy

We review this policy at least annually and update it when our practices or the law change.

When we make a change, we will update the effective date at the top of this page. Where a change is significant, we will tell business customers by email at least 30 days before it takes effect, so that they have time to consider it.

Previous versions are available on request from support@enchat.co.uk.

17. Contact us

Enchat Ltd is registered in England and Wales, company number 17087352. Registered office: 20 Wenlock Road, London, N1 7GU.