Privacy policy

RepCall is a trading name of Bordosa Ltd, a company registered in England and Wales (company number 11604533). Bordosa Ltd is the data controller for the personal data described in this policy, except where we say we act as a processor on your behalf.

ICO registration: ZC209616.

This policy covers personal data we collect through repcall.co.uk, through our demo and trial forms, and through running your RepCall account — billing, support, and signing in.

It does not cover the contact and call data your team uploads or connects to RepCall in order to use the product. For that data, we act as your processor, not the controller — see “Your data if you use RepCall” below, and our Data Processing Addendum.

• Account holder data: your name, work email, a hashed password, your role and your team
• Billing and payment records
• Support correspondence you send us
• Website visitor data — basic technical logs only; we don’t set non-essential cookies (see Cookies below)
• Marketing enquiries submitted through the demo and trial forms: name, work email, company, number of reps, which CRM you use, and any message you add

• To provide your account and the service you’ve contracted for — performance of a contract
• To respond to demo and trial enquiries and follow up — our legitimate interest in running our business
• To invoice and take payment, and meet our accounting obligations — contract and legal obligation
• To keep the service secure and resolve support issues — our legitimate interest

We don’t use your data for anything else, and we don’t sell it.

• Account data: for the life of your account, then 30 days after closure
• Contact and call data (our processor role): for the life of your account; deleted within 30 days of closure, or immediately on your instruction
• Expired trials: kept read-only for 90 days then deleted, with warning emails at 60 and 80 days
• Billing records: 7 years, as UK tax law requires
• Support correspondence: 2 years
• Audit logs: 12 months

We use a small number of specialist providers to run RepCall. We have a data processing agreement with each of them, and we don’t share your data beyond what’s needed to run the service.

Most of our infrastructure is in the UK: our database, authentication and file storage run on Supabase’s UK region (AWS eu-west-2, London). Some of our sub-processors operate outside the UK — Vercel, Stripe and Resend host and process data in a mix of EU and US locations, and OpenAI processes call-note transcripts in the USA.

Where personal data leaves the UK, we rely on the UK International Data Transfer Addendum or an equivalent safeguard recognised under UK GDPR.

Under UK GDPR you can ask to access, correct, delete or export your personal data, and object to or restrict certain processing. To exercise any of these rights, email privacy@repcall.co.uk. You can also complain to the Information Commissioner’s Office (ico.org.uk) if you believe your data has been mishandled.

If your organisation uses RepCall, we also process data on your behalf as your processor — not as controller. This includes contact records you upload or sync (company name, contact name, phone number, account code, and the last note on file), call outcomes, and the notes RepCall generates.

Some important facts about how this works:

• Calls are not recorded. After a call, your rep dictates a short spoken summary — that’s the only voice input RepCall handles, the same legal position as typing a note into your CRM.
• Speech-to-text conversion happens on the rep’s own phone. Audio is never transmitted anywhere and is never stored, by us or anyone else.
• Only the resulting transcript text is sent to OpenAI to turn it into a clean note. Audio itself never reaches OpenAI.
• RepCall only ever adds new records to your CRM. It cannot update or delete anything that’s already there.

Full detail on how we handle this data as your processor — including our obligations, sub-processor authorisation, and what happens to your data if you leave — is in our Data Processing Addendum.

repcall.co.uk does not set any non-essential cookies. We don’t run analytics or advertising tracking on this site.

If you have a RepCall account, our portal — a separate part of the product — sets one strictly necessary cookie to keep you signed in via our authentication provider. Strictly necessary cookies like this don’t require consent under UK PECR rules, so we don’t show a cookie banner.

If that ever changes — for example, if we add analytics — we’ll add a consent banner before setting any non-essential cookie, with an equally prominent option to reject it.

We use industry-standard measures to protect your data, including encryption in transit and access controls on our systems. We don’t hold any formal security certification — such as ISO 27001, SOC 2 or Cyber Essentials — at this stage, and we won’t claim otherwise.

We may update this policy as the product and our data practices develop. Material changes will be reflected here with a new “last updated” date.

Questions about this policy or your data: email privacy@repcall.co.uk. General enquiries: hello@repcall.co.uk.

Bordosa Ltd, registered in England and Wales (company number 11604533). To write to us by post, use our registered office address.