Privacy Policy
Effective Date: February 2026 | Last Updated: August 2026
At Hannah AI (operated by FCOMS UK CIC, "we," "our," or "us"), we value your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access our website, use our SaaS dashboard, or utilize our 24/7 AI receptionist services.
1. Data Controller Details
For the purposes of the EU/UK General Data Protection Regulation (GDPR), FCOMS UK CIC acts as the Data Controller for subscriber/business user account data, and as a Data Processor for caller data processed on behalf of our business clients.
- Legal Entity Name: FCOMS UK CIC
- Registered Address: 2nd Floor, 309 High St, West Bromwich B70 8LX, United Kingdom
- Data Protection Office Contact: [email protected]
2. Information We Collect
- Account Registration: Name, email address, phone number, business name, and billing details provided during sign-up.
- Integrations & CRM Data: Data exchanged through authorized calendar APIs (e.g., Google Calendar, Outlook) and customer relationship management (CRM) integrations configured within your account.
Our platform processes incoming and outgoing voice calls on behalf of your business:
- Real-time speech transcriptions and audio call recordings.
- Telephony metadata (caller phone numbers, call duration, timestamp, call routing metrics).
- Appointment scheduling and contact intake details provided by callers.
We measure two things separately, with different tools, and they do not share data.
- This website (yourhannah.com): we use Databuddy to count visits and understand which pages and links people use. It sets no cookies and does not track you across other websites. It stores a randomly generated identifier in your browser's local storage so repeat visits within a session are not counted twice, records the page address, referring page, browser language, time zone, screen size and any campaign tags in the link you arrived through, and derives an approximate country from your IP address. Databuddy anonymises IP addresses with a one-way hash and does not retain them in their original form.
- The signup flow (app.yourhannah.com/start): we record the screen while you create an account, so we can see where the process fails and fix it. This is limited to the signup steps and does not run on your dashboard or during normal use of the service. Every text input is masked, so what you type, including your name, business name, email address, telephone number and password, is never captured. Recordings are deleted after 30 days.
- Technical identifiers: IP address, browser type, operating system, and device identifiers.
- Diagnostic data: errors and page performance, so we can find pages that are broken or slow.
3. How We Use Your Information & Legal Basis (GDPR)
| Purpose / Processing Activity | Data Type | GDPR Legal Basis |
|---|---|---|
| Service Provision (Operating AI voice receptionist & telephony) | Account & Call Data | Performance of Contract (Art. 6(1)(b)) |
| Automated Scheduling & Alerts (SMS/Email summaries) | Call & Calendar Data | Performance of Contract (Art. 6(1)(b)) |
| Billing & Payments | Transaction Data | Performance of Contract / Legal Obligation |
| Product Analytics & Dashboard Optimization | Usage & Telemetry | Legitimate Interests (Art. 6(1)(f)) |
| Model Optimization (Platform conversational quality) | Anonymized Interaction Data | Legitimate Interests (Art. 6(1)(f)) |
4. Sub-Processors & Data Sharing
We do not sell, rent, or trade personal data or caller content. We share data strictly with third-party service providers bound by Data Processing Agreements (DPAs) and confidentiality obligations:
- Telephony Routing: Twilio (processing voice streams and telephony transmission).
- Voice Synthesis & AI Agents: ElevenLabs (processing text-to-speech and audio interactions).
- Transactional Messaging: Resend (delivering email notifications, summaries, and receipts).
- Website Analytics: Databuddy Analytics, Inc. (cookieless visit measurement for yourhannah.com).
- Signup Diagnostics: PostHog (masked screen recordings of the signup flow only).
- Integrations: Calendar and CRM systems explicitly authorized and connected by you.
- Legal Requirements: When required by binding court orders, regulatory inquiries, or law enforcement.
Zero Model Training Commitment: Our sub-processors (including LLM and speech synthesis vendors) are contractually bound not to use customer audio streams, call transcriptions, or business data to train or fine-tune their public AI models.
5. Cookies & Tracking Technologies
We use essential and analytics cookies on our web application .yourhannah.com:
| Cookie Name | Domain | Expiry | Purpose |
|---|---|---|---|
ph_phc_*_posthog_session |
.yourhannah.com | 1 Year | Identifies the signup session so a screen recording can be matched to it. Set only in the signup flow. |
did, did_session (local storage, not a cookie) |
yourhannah.com | Until cleared | A randomly generated visitor and session identifier used by Databuddy to avoid counting the same visit twice. Stored in your browser and not readable by other websites. |
Note: Session state and temporary analytics flags are also managed securely via browser localStorage.
6. Regulatory Compliance: EU AI Act & US Wiretap Laws
In compliance with Article 50 of the EU AI Act, individuals must be informed when interacting with an artificial intelligence system.
Deployer Responsibility: Clients deploying Hannah AI are legally required to configure an explicit AI disclosure in their opening greeting (e.g., "Hello, you are speaking with an AI assistant...") when operating in jurisdictions that mandate AI interaction transparency.
Certain US states (including California, Florida, Massachusetts, and Pennsylvania) require all parties to consent to call recording.
Deployer Compliance Tooling: Hannah AI provides settings for clients to enable mandatory pre-call audio recording notices. It is the subscriber’s legal responsibility to ensure that audio recording notifications are enabled in accordance with local state laws.
7. International Data Transfers
As an EU/UK entity serving global users, your data may be processed on secure servers located in the United States (including PostHog Cloud US, Databuddy Analytics, Inc., and telephony infrastructure).
When transferring personal data outside the EU/UK, we implement legal safeguards, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission.
- Data Processing Addendums (DPAs) with sub-processors enforcing equivalent GDPR privacy standards.
8. Data Retention Policy
- Account Data: Active account details are retained for the duration of your subscription and up to 30 days after account termination.
- Call Transcripts & Audio (Hannah AI): Retained for up to 90 days by default before being automatically purged, unless custom retention timelines are configured in your dashboard.
- Telephony & Speech Processing Vendors: Audio recordings and conversation transcripts processed via ElevenLabs are retained for up to 2 years in accordance with system logs, unless shorter retention or zero-retention parameters are overridden by custom user settings.
9. Your Privacy Rights (EU/UK GDPR & US CCPA)
Depending on your physical location, you hold specific rights over your personal data:
- Right of Access & Data Portability: Request a copy of the personal data we hold about you.
- Right to Erasure ("Right to be Forgotten"): Request deletion of your personal information.
- Right to Rectification: Correct inaccurate or incomplete data.
- California Privacy Rights (CCPA/CPRA): California residents have the right to know what personal information is collected, request deletion, and opt out of any potential data sale/sharing (we do not sell data).
To exercise any of these rights, contact our Data Protection Office at [email protected]. We respond to all verified requests within 30 days.
10. Third-Party Links & Policy Updates
Our application may link to external services. We are not responsible for the privacy practices of third-party platforms. We may update this Privacy Policy periodically. Material changes will be communicated via your dashboard interface or sent via email prior to taking effect.
Contact our Data Protection Officer: [email protected]
FCOMS UK CIC, 2nd Floor, 309 High St, West Bromwich B70 8LX, UK