Built for UK businessesLast updated 28 September 2026.
This is a draft and hasn’t yet been reviewed by a solicitor. If anything here is unclear or looks wrong, tell us.
1. Who we are
whitsun is a company being registered in England and Wales. We are the controller of the personal data described in this notice, which means we decide how and why it is used.
For anything about your data, email privacy@whitsun.ai. We are a small company and don’t have a data protection officer; the founders handle privacy requests themselves.
This notice covers people who visit this website, try the demo call, ring our number, or book a consultation with us. If your business becomes a whitsun customer, the calls whitsun answers for you are covered by a separate data processing agreement, in which you are the controller and we act for you.
2. What we collect
We only collect what we need for the purposes in section 3.
You ask for a demo call
Your mobile number; the exact consent wording you were shown, its version and the time; your IP address and browser details; the ad campaign you came from, if the link carried one.
During the demo call
A recording and transcript of the call, and a short write-up of it. Anything you choose to say on the call is included, such as your name, what kind of business you run and how you handle calls today.
You ring our number
Your phone number, and a recording, transcript and short write-up of the call. Calls to 020 7362 4127 are answered by our AI assistant.
You book a consultation
Your name, email address, business name and phone number, the time you chose, and anything you add to the booking form.
The consultation and after
Notes from our conversation and any emails, calls or texts between us.
You browse the site
Only if you accept cookies: how you use the page and which ad brought you here. See the cookie policy.
3. Why we use it, and our lawful basis
Data protection law requires us to have a lawful basis for each use. Ours are:
Placing the demo call you asked for, and showing you the write-up
Your consent, given when you tap Test whitsun now (UK GDPR article 6(1)(a); PECR regulation 19 for the automated call).
Calling or texting you afterwards about setting whitsun up
Your consent, given in the same sentence (PECR regulations 21 and 22). You can withdraw it at any time.
Answering when you ring our number, and passing your message to the team
Our legitimate interest in answering people who ring us (article 6(1)(f)). The assistant says at the start that it's an AI and that the call is recorded.
Arranging and holding a consultation you booked
Taking steps you asked for before a possible contract (article 6(1)(b)).
Keeping a record of each consent, and stopping misuse of the demo line (for example, one number being called repeatedly)
Our legitimate interest in being able to show we only call people who asked, and in protecting the service (article 6(1)(f)).
Improving the demo call and the product, using call recordings and transcripts
Our legitimate interest in making the product work well. We look at calls to fix mistakes; we don't use them to train AI models.
Measuring which ads and pages work
Your consent, through the cookie banner (PECR regulation 6 and article 6(1)(a)).
Where we rely on legitimate interests, we have weighed them against your interests and rights. You can object at any time (section 8).
4. The demo call
Asking for a demo call is how you consent to it. The words next to the button are:
By entering your number, you agree to this AI call and to us following up by call or text.
The call comes from our AI assistant, which tells you it is an AI at the start of the call. If you are put through to the pretend business on the call, that business is fictional and nothing said is booked, confirmed or advice.
If a call reaches someone who didn't ask for it, they can say so on the call, or email us, and we won't call that number again.
We only call UK mobile numbers, and we limit how often any number or connection can ask for a call.
5. Who we share it with
We never sell your data. We share it only with service providers who handle it for us under contract, only for the purposes above, and with appropriate security:
Retell AI
What they do for us
Runs the AI voice on the demo call, including speech recognition, the language model and text-to-speech, and holds the recording and transcript while the call is processed
Where
United States
Twilio
What they do for us
Connects the phone call
Where
United States, with UK numbers
Google Cloud and Firebase
What they do for us
Runs our demo-call service and hosts this website
Where
London, UK (service); global content delivery (website)
Supabase
What they do for us
Stores demo-call records and consent records
Where
London, UK
HubSpot
What they do for us
Our customer relationship system and booking page
Where
European Union or United States, depending on our account's data centre
Slack
What they do for us
Tells our team when a demo call ends or a consultation is booked
Where
United States
Meta
What they do for us
Only if you accept marketing cookies: tells Meta that someone who saw our ad asked for a demo call or booked, including a one-way scrambled (hashed) copy of your number so Meta can match it to the ad
Where
United States and Ireland
Google Analytics, Hotjar, HubSpot tracking
What they do for us
Only if you accept cookies: measuring the site and our ads
Where
See the cookie policy
We may also share data if the law requires it, or to protect our rights, or with a buyer if the business is sold, who would be bound by this notice.
6. International transfers
Some of our providers are based in, or access data from, the United States. Where personal data leaves the UK, we make sure it is protected by one of the safeguards UK law recognises: the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge) where the provider is certified under it, or the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses otherwise. You can ask us for details of the safeguard for any provider.
7. How long we keep it
Demo call recording, transcript and write-up
30 days, then deleted automatically. You can delete yours sooner from the page after the call, or by emailing us.
Calls to our number: recording, transcript and write-up
30 days, then deleted automatically
Consent records
Two years from the call, so we can show the call was asked for
Your contact record (number, name, email, notes)
Until you ask us to delete it, or two years after we were last in touch
Accounting records, if you become a customer
Six years, as the law requires
8. Your rights
You have the right to:
- be told how we use your data (this notice)
- get a copy of the personal data we hold about you
- have it corrected if it's wrong, or deleted
- restrict how we use it, or object to our using it, including an absolute right to object to direct marketing
- withdraw consent at any time, without affecting what we did before
- receive data you gave us in a portable format, where that applies
To use any of these, email privacy@whitsun.ai, or say “stop” on a call or reply STOP to a text to end follow-up. We’ll respond within one month, and usually much sooner. There is no charge.
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
9. Complaints
If you’re unhappy with how we’ve handled your data, please tell us first at privacy@whitsun.ai. We’ll acknowledge your complaint within 30 days and tell you what we’re doing about it.
You can also complain to the Information Commissioner’s Office, the UK regulator: ico.org.uk/make-a-complaint, or call 0303 123 1113.
10. Security, children and changes
Data is encrypted in transit and at rest with our providers, access is limited to the people who need it, and demo records are deleted on schedule.
whitsun is for businesses. It isn't intended for anyone under 18, and we don't knowingly collect their data.
If we change this notice, we’ll update the date at the top. Cookies are covered in the cookie policy, and the rules for using the site and the demo call in the terms.