Privacy notice

1. Who we are

DT Global Ventures Ltd, a company registered in England and Wales (CRN 16042336), registered office 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE. We sell CallMyDesk to customers in the United States and the United Kingdom from the United Kingdom; there is no separate US company, and the service itself is US-hosted (section 8). We have not appointed a data protection officer because the law does not require us to; our named privacy contact is reached through the contact page (choose "Security or data protection"). Our registration with the UK Information Commissioner's Office is in the annex.

2. The two roles, in one paragraph

We decide how website, waitlist, demo-line, contact-form, consent-record and account data are used (we are the business, or controller, for them). For customer content (call audio and transcripts, what the assistant remembers about your work, the audit log, and anything it reads from your connected inbox, calendar and CRM) you decide and we act on your instructions: we are your service provider under California's privacy law and the other state laws, and your processor under UK GDPR. The data processing agreement governs the second role. People whose details appear in a customer's correspondence (for example, a customer's clients) should contact that customer in the first instance; we will pass on any request we receive and help the customer answer it.

3. What we collect, and why

One row per situation: the data, the purpose and, for the UK annex, the lawful basis.

4. The US state privacy laws, and our role under them

• Our size. We are below the size at which California's privacy law (the CCPA, as amended) applies to a company directly: we do not have annual revenue over $26.6 million, we do not handle the personal information of 100,000 or more California residents or households, and we earn nothing from selling or sharing personal information. The same is true of the thresholds in the other state laws. We follow this notice anyway, and we review the question every quarter.
• No sale, no sharing. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we have not done either in the preceding 12 months. That is why this site has no "Do Not Sell or Share My Personal Information" link. We honor the Global Privacy Control signal from your browser as a matter of course, even though there is nothing for it to stop.
• The categories, in the words the law uses. Identifiers (name, email, phone number, IP address); customer records (billing name and address); commercial information (the plan you bought, the deposit, invoices); internet activity (pages viewed, in aggregate); audio (the demo-line call, and your calls with your assistant, which are customer content under the data processing agreement); professional information (your role, your company); and inferences: none. Sources: you, your device, Stripe for payments, and the telephony provider for the one-time code result. We use them only for the purposes in section 3.
• Sensitive personal information. We do not collect it. Your PIN is stored as a one-way hash and is used only to confirm it is you on a call.
• When we are your service provider. If your company is covered by a state privacy law, we are its service provider (or, in some states' words, its processor) for the contents of your inbox, calendar, CRM and calls. Our data processing agreement contains the terms California's regulations require of a service provider: we use that data only for the specific business purposes you gave it to us for, we do not sell or share it, we do not combine it with data from anyone else, we do not use it for our own purposes or to train AI models, and we help you answer requests from the people whose data it is.
• Your rights under the state laws are in section 12.

5. Marketing

We do not run marketing lists. The early-access emails are the only emails we send that you did not individually ask for, and you consented to them when you joined. We never sell, rent or share your details for anyone else's marketing. We never make marketing calls or send marketing texts, and neither does the assistant (see section 10). The calls and texts the assistant makes to you carry no advertising: they are the briefs, alerts and summaries you asked for, and nothing else.

6. How the AI is involved, in plain terms

The assistant is an AI system. On a call, your speech is turned into text by a speech-recognition provider, the text is understood and answered by an AI model provider, and the reply is turned into speech by a speech-synthesis provider, each under contract with us. The AI model sees the transcript of the call and the parts of your mail, calendar and CRM needed for what you asked. It does not see your passwords or your connected-account keys. No decision with legal or similarly significant effects on you is made automatically: the assistant cannot send, book or log anything unless you heard it read back and said yes or pressed 1 (the full rule is in the terms, section 6). Your data is never used to train models, ours or anyone's.

7. Who we share data with

By category. The named current providers are kept on the sub-processor list in our data processing agreement, so there is one list to update.

• Telephony (the phone call itself, your number, one-time codes, call-backs, and the texts it sends you; texts come from a toll-free number at first, and later from the assistant's own number once the carriers have registered it).
• Speech recognition (turning what you say into text).
• Speech synthesis (turning the assistant's words into audio).
• AI model provider (understanding requests, drafting replies and read-backs).
• Hosting (the application, database and stored audio, transcripts and log).
• Email delivery (service emails such as lockout alerts and the daily log email).
• Payments (Stripe, which is responsible in its own right for the payment itself and has its own privacy notice; Stripe also works out any sales tax due at checkout from your billing address).
• Website analytics (a privacy-focused service that keeps no personal data and sets no cookies).
• Professional advisors and authorities where the law requires or allows it (our accountants, our lawyers, a court or regulator with a lawful request). We tell you about a request for your data unless the law forbids it.

Every one of these is a service provider to us under written terms that limit what it may do with the data to providing its service to us, and that forbid retaining it beyond that or training on it. Microsoft, Google, HubSpot, Pipedrive and Salesforce are not our providers. They are your own systems, connected by you; their notices apply to them.

8. Where your data goes

The service is US-hosted: the application, the database and stored audio, transcripts and logs are hosted in the United States, call audio passes through our telephony provider's US region, and speech recognition, speech synthesis and the AI model run with providers in the United States. Each is named, with what it processes, on the sub-processor list in our data processing agreement, and each is bound not to keep or train on what passes through. We say "US-hosted" rather than "your data never leaves the United States", because a provider may route part of its work through another region, and we would rather name who handles what than make a promise we cannot check. Our own staff, who are in the United Kingdom, can access systems for support and operations under the confidentiality and logging rules in the data processing agreement. For UK and EEA customers, the transfer of their data to the United States is covered in the annex.

9. How long we keep it

The same numbers are on our security page and in the data processing agreement.

"Deleted" means removed from live storage, and from backups within a further 30 days. Deletion runs as a scheduled job every day.

10. Calls, texts and recording

• It only calls and texts you because you asked it to. You say yes at signup, we text a one-time code to confirm it's your number, every call it makes to you opens with the CallMyDesk name and a number you can call back, and you can say "stop" at any time. Texts come from a toll-free number for now. The words beside the checkbox are in the terms, section 5, and the box on the early-access form is never pre-checked. We keep a record of your yes, the time and the code check, because federal law asks a company that calls a cell phone with an AI voice to be able to show it was invited. Saying "stop", "cancel", "quit", "end", "revoke", "opt out" or "unsubscribe" on a call, replying STOP to a text, or switching scheduled calls off on your account page, all count, and we act on them at once. After a STOP text we send one text, and only one, confirming what has stopped and how to stop the rest. Message and data rates may apply.
• Calls between you and your assistant are recorded and transcribed so the assistant can work and so a mishearing can be checked; you agree to this in the terms, and the assistant says it is an AI when it picks up. You are the only person on that call, so your agreement is the consent every state's recording law asks for, including the twelve states where everyone on a call must agree. It never joins or records your meetings.
• When it places a call to someone else at your request, it opens by saying it is an AI assistant calling on your behalf (the exact words are on our AI disclosure page); the other person's side of that call is not recorded and is not kept as a transcript; the audit log records only what you asked for and the outcome (for example, "meeting confirmed for Tuesday at 10 am"). We never make marketing calls or send marketing texts, and the assistant cannot be instructed to make one.

11. Security

The full description is on our security page: encryption in transit and at rest, a PIN with lockout, one-time codes or call-backs for sensitive actions, no stored passwords, an append-only audit log, and the confirmation rule in the terms, section 6.

12. Your rights

• What you can ask for. To know what personal information we hold about you and to receive a copy you can read without us; to correct it; to delete it; to take it with you in a portable form; and to opt out of the sale or sharing of your personal information and of profiling (we do none of these, so there is nothing to opt out of, but the right is yours). We will never treat you differently for using a right.
• How. Send us a message (choose "Security or data protection"), or use your account page, where you can export your transcripts, audit log and memory, correct your details, switch scheduled calls off and close your account without asking us. We may ask you to confirm it is you. We reply within 45 days, which is the longest the state privacy laws allow, and usually within a few days; if we need longer, we tell you why. If we refuse a request you may appeal by replying to our answer, and a different person will look at it within 45 days.
• Authorized agents. Someone you have authorized may make a request for you; we may ask for proof that you authorized them.
• Withdrawing consent. You can withdraw your consent to early-access emails, or to being called and texted, at any time, without affecting what was done before; section 10 says how.
• People in a customer's correspondence. If your details appear in a CallMyDesk customer's inbox, calendar or CRM, that customer decides how they are used; contact them first, and we will help them answer. We will pass on any request we receive within two business days.
• Complaints. Tell us first and we will put it right. You can also contact your state attorney general's office or, in California, the California Privacy Protection Agency.

13. Children

The service is for business use by adults. We do not knowingly collect data from anyone under 18, and an account cannot be opened by a person under 18.

14. Cookies

The website sets no cookies that need your consent. Analytics are cookieless and keep no personal data. When you pay a deposit you are taken to Stripe's checkout page, which sets its own cookies under Stripe's notice. The account app sets one strictly necessary cookie to keep you signed in. No advertising or tracking cookies, ever.

15. Changes to this notice

We update this notice when the service or the law changes. Material changes are emailed to account holders at least 14 days before they take effect. The "last updated" line at the top and the "Changes" list at the foot record every version.

16. Contact

For anything about your data, or a security concern, send us a message and choose "Security or data protection". For everything else, use the contact page. Our postal address is in the company block at the foot of this page.

Annex: UK and EEA customers

For readers in the United Kingdom (and, where it applies, the European Economic Area), the same facts in UK GDPR terms.

• Controller and registration. DT Global Ventures Ltd is the controller for website, waitlist, demo-line, contact-form, consent-record and account data, and the processor for customer content under the data processing agreement. We are registering with the Information Commissioner's Office, and our registration number will be shown here once it is issued. No data protection officer is required; the privacy contact is reached through the contact page.
• Lawful bases. As tabled in section 3: contract for the account and the deposit; consent for the early-access emails and for the calls and texts the assistant makes to you; legitimate interests for analytics, security, the demo line and answering inquiries; legal obligation for tax records, the consent record and notices of changes. A legitimate-interests assessment is documented for each legitimate-interest use.
• International transfers. The service is hosted in the United States, so your data leaves the United Kingdom. The transfer is made under the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses, entered into with each provider on the sub-processor list, with a transfer risk assessment done for each provider, and each provider is bound not to keep or train on what passes through. We do not claim that your data stays in the UK or the United States alone; section 8 says where it goes and the data processing agreement says on what terms.
• Your rights under UK GDPR. Access, rectification, erasure, restriction, portability, objection (including to processing based on legitimate interests), and withdrawal of consent at any time without affecting what was done before. Send us a message; we may ask you to confirm it is you; we reply within one month, as UK GDPR requires, and usually within a few days. You have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), and we would rather hear from you first.
• Marketing calls and texts. The UK rules on automated marketing calls and texts (PECR) are met the same way the US rules are: we make none, and the assistant cannot be instructed to make one. The calls and texts it makes to you are the ones you asked for, with your consent, and "stop" ends them.
• VAT. UK customers are charged UK VAT at 20% at checkout and receive a VAT invoice carrying our VAT number; EU business customers with a valid VAT number are reverse-charged. Records are kept for six years as UK law requires.
• EEA customers. Where the EU GDPR applies to you, this notice and the data processing agreement are to be read so as to satisfy it as well.