Privacy policy
Privacy policy
There are two people in every call. This policy covers both. Last updated 17 September 2026.
Who this is for
- You, the trades business that pays us. The tenant. You connect your calendar. You forward your phone line.
- The caller, a member of the public who rang your number. They never signed up with us. They never saw this page. They hear one sentence on the line: “This call is recorded.”
A visitor to the website is a third, smaller group.
Who we are
Call Cover is a product of Northbound Tech Ltd, company number 17432444. Northbound Tech Ltd is registered in England and Wales. Registered office: 71-75 Shelton Street, London WC2H 9JQ.
Northbound Tech Ltd is the controller named in this policy. We answer inbound phone calls for trades businesses in the UK and the US.
Privacy and data requests: privacy@callcover.io
What we do with data, in one page
We pick up the phone as you. We quote from your price book. We book a job into a slot we believe is free. If you have connected Google Calendar, we read your calendar so we do not double-book you, and we write the booking into a calendar you own.
We keep a written record of the call (a transcript), a lead if we took a name and number, the outcome, and the appointment. We do not store audio as part of this product. We do not ask the carrier to keep a recording. The voice still travels through other companies while the call is live. That is not the same as us keeping a sound file.
The greeting still says “This call is recorded.” That sentence is broader than what we store.
What we collect
From you (the tenant)
- Business name, hours, service area, price book, technicians, greeting, voice, timezone, escalation number.
- The phone number we provision for you, and the fact that your line forwards to it.
- Billing details. Card numbers go to our payment provider. We do not store the full card.
- Google Calendar access, if you click through OAuth: we receive a long-lived token, the calendar we may write, and the scopes Google actually granted. Tokens are held in an encrypted store, not in the database in a usable form.
- Slack, if you connect a workspace for alerts.
- A CRM connection, if you connect one. The first vendor on that path is Jobber. Connecting it is optional.
- Emails and texts we send you (onboarding links, “your calendar died”, a flagged booking).
From the caller (a member of the public)
- The number they rang from, as the carrier presented it.
- What they said, as transcribed, and what we said, as a written turn.
- A name and a call-back number, if they gave one.
- The job they asked for, the window we offered, the appointment we booked.
- Whether we told them the call was recorded, and whether the carrier reported that sentence as played.
- Texts we send them as you, if you have that add-on (booking confirmation, review request). Ringing us is not consent to marketing. STOP stops that sender.
If the recording disclosure is not confirmed, we keep the envelope of the call (times, duration, that a call happened) and we discard what was said.
From a website visitor
The demo: they can talk to an agent in the browser. The same recording sentence is spoken. A demo session is a call, and what was said is kept as text on the same 90-day expiry.
Card details
The service is not for taking card details on the line, and the terms of service require you not to use it that way. A caller may still read a number out unprompted. Words already stored can be redacted on request.
Why we hold it
| Data | Why |
|---|---|
| Call transcript and outcome | So you can see who rang. So we can bill minutes. So a dispute weeks later has a record of what was actually said. |
| Lead (name, number) | So you can ring them back. |
| Appointment | So the job exists in our book and, if connected, in your Google Calendar. |
| Calendar events we read | So we do not offer a slot you already marked busy, and so we can write a booking into a calendar you can write. |
| Billing | So our payment provider can charge the subscription. |
| Disclosure proof | So we can show we spoke the recording sentence. That proof is kept even if the words of the call are later removed. |
The lawful basis
UK data protection law requires a basis for every use of personal data. These are the bases we rely on, by group.
You (the tenant)
- Running the service you bought. Your business details, hours, price book, numbers, connections, and the calls we answer for you: performance of our contract with you. We cannot answer your phone without them.
- Billing. Performance of that contract, and, for the records a company has to keep for tax and accounts, a legal obligation.
- Keeping the service secure and working. Setting up your tenant, finding out why something failed, investigating abuse, keeping one tenant out of another’s data: our legitimate interests in running a service that stays up and stays separated.
Giving us this data is a requirement of the contract, not of any statute. You do not have to. If you do not, we cannot provide the service.
The caller
A caller has no contract with us. They rang a business. The basis for what we do with the call is legitimate interests: ours, and those of the business they rang. Named, rather than left vague:
- answering the call, as the business the caller chose to ring, so it is not missed;
- quoting from that business’s price book and offering a slot that is actually free;
- passing the name, the number and the job to that business, which is the point of the call;
- holding a written record of what was said, in case there is a dispute weeks later;
- billing that business for the minutes, and keeping proof that we spoke the recording sentence;
- keeping the service secure, and finding out why a call went wrong.
Weighed against the caller’s side of it: every answered call is told out loud that it is recorded; we keep text, not audio; the words expire after 90 days; and we do not use what was said to advertise, to profile the caller, or to train a model.
Consent is not the basis, and we do not claim it is. Not hanging up after hearing a sentence is not consent, and ringing a plumber is not consent to marketing.
Where the business we answer for has told us to do something with a call (write the lead into its CRM, put the job in its calendar), that business is relying on its own basis for holding its customers’ details as well as on this one.
A caller does not have to give a name or a number. No law requires it and no contract requires it. If they do not, we can still take the call; we cannot book the job or have anyone ring them back.
A website visitor
Legitimate interests: showing what the product does, and keeping the site up. The demo is a call. The same recording sentence is spoken before the agent answers.
Recording
Every answered call is told, in English, “This call is recorded.” The sentence is ours. You cannot turn it off, shorten it, or rewrite it. A tenant who does not want calls disclosed does not want this product.
We disclose every call. We do not try to guess the caller’s state or country from caller ID.
If they talk over that sentence, we say it again before we answer them. If we never get a carrier signal that it played, we do not keep what they said.
What we keep is text. Default expiry of that text is 90 days from when our side of the call closed. The envelope of the call stays. It can be shortened. It cannot be set longer than 365 days.
A stored call summary, when we produce one, expires with the words. Calendar events we already wrote to your Google Calendar do not. Those are in your account.
Decisions the agent makes on a call
The agent makes decisions during a call without a person reviewing them at the time. What it decides, and how:
- A price. Read out of the price book you entered, matched to the job the caller described. The number comes from your prices, not from the model’s judgement.
- A window. Taken from your working hours, your service area and the busy time in the calendar you connected. It offers a slot it believes is free.
- A booking. If the caller accepts, it writes the appointment, and, if you connected Google Calendar, into your calendar.
- An outcome. Whether the call became a booking, a lead for you to ring back, or something to put in front of you.
What that means for the caller. They are quoted a price and offered a time, or they are told someone will ring them back. The agent does not decide anything about them as a person: it does not score them, rank them, or use anything they said on an earlier call to decide how to treat them on this one. It holds no profile of a caller.
The business you rang sees the call and the booking, and can change it, cancel it or ring you back itself. If a caller wants a person to look at what the agent did, they can write to privacy@callcover.io.
Google Calendar, and Limited Use
We ask for three scopes, and only these:
calendar.events.readonly: read events, so we can see busy time.calendar.events.owned: create, change, and delete events on calendars you own, so a booking we confirmed can appear in your calendar, and a reschedule or cancel can follow.calendar.calendarlist.readonly: list your calendars, so we know which calendar we may actually write.
None of these is a Restricted scope. Two are Sensitive. We do not ask for Gmail, Drive, or the rest of the account.
What we do with that data. We copy occupancy into our database so the agent can offer a real slot. We write, patch, or cancel events for jobs we booked on a call. We watch whether the grant is still alive. We do not read your calendar to advertise, to profile you, or to train a model.
The use of information received from Google Workspace scopes will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Google API Services User Data Policy: https://developers.google.com/terms/api-services-user-data-policy
Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy#additional_requirements_for_specific_api_scopes
In the words those pages use, applied here:
- Calendar data is used only to provide or improve the booking feature you can see: offer a window, write the job, notice a dead connection.
- We do not sell it. We do not transfer it to advertising platforms, data brokers, or information resellers.
- We do not use it for ads, retargeting, or interest-based advertising.
- We do not use it to create, train, or improve a machine learning or artificial intelligence model.
- Humans at Call Cover may see it when they set up or debug your tenant, when they investigate abuse or a bug, or when the law requires it. They do not otherwise read your calendar.
You can revoke access in your Google account. We treat a dead grant as a stored fact and we stop writing. Events already in your calendar stay there. We do not reach in to delete them.
Who else sees it
These are the categories of company that see personal data in the course of running the service.
| Who | What they see | Notes |
|---|---|---|
| A telephony provider | Call audio, caller ID, dialled number, duration | The carrier that connects the call. |
| Speech and language providers | Live audio, the transcript as it happens, the caller’s speech turned into text, the text of each turn, tool calls, and your business facts in the prompt | They carry the media of a connected call, turn speech into text, and produce the words the agent says. A call we never answer is not theirs; a call we connect is. The phone path and the browser demo are not the same model. |
| Calendar events we read and write; OAuth tokens at their end | Only if you connect Google Calendar. See the Limited Use section. | |
| Hosting and database providers | The database: tenants, calls, leads, appointments, encrypted tokens. HTTP requests to the site and our apps | They hold and serve the rows; they do not read them. |
| A payment provider | Payment details, invoices | Subscription payments. We do not store the full card. |
| An email delivery provider | The address an email is sent to, the content of that email (for example a sign-up link, or a notice that someone tried to sign up with that address), and delivery information | Delivers the service emails we send from notifications@callcover.io, and tells us whether each was accepted. No marketing email is sent this way. Open and click tracking are off: no tracking pixel is added and links are not rewritten. Replies go to support@callcover.io. |
| Slack | Alert text you asked us to send, if you connected a workspace | Optional. |
Error tracking does not carry a caller’s words.
How long we keep it
| What | How long, as the product stands |
|---|---|
| Transcript text, and a stored summary of the call | 90 days after we closed the call, then the words are gone. Envelope stays. |
| Call envelope (times, durations, outcome, disclosure proof, calling number as presented) | Until you are deleted, or we have another legal reason to keep it. |
| Leads and appointments | Same: they do not expire with the transcript. |
| Google Calendar copies we hold (occupancy) | While the connection is live. We stop when the grant dies. Your copy of the event remains in Google. |
| Encrypted calendar token | While the connection is live. Destroyed on revocation or tenant deletion. |
| Billing records | Our payment provider keeps theirs. We keep enough to invoice. |
| After you leave | Offboarding is not deletion. Your rows stay until we run deletion, after the relationship is Offboarded. What we keep after that is the record of key access, the periods for which a number was assigned to you, a minimised record that you were a tenant, and the record of the deletion itself. Deletion covers the live store; it does not reach copies already written to backups. |
Your rights (UK / GDPR, and similar US state rights)
You can ask to see what we hold about your business, to correct it, to export it, or to delete it.
You can also object to the processing we do on the basis of legitimate interests, and ask us to restrict processing while a question about it is being worked out.
How to exercise them:
- Export. Write to us and we produce a sealed archive of your tenant.
- Deletion. Write to us. Deletion runs after offboarding, and covers the live store.
Write to privacy@callcover.io. We answer within one month of receiving a request. If a request is complex, we may extend that period, and we will tell you within the first month if we do.
The caller’s rights
A caller is a data subject. They can ask what we hold about them, and ask us to correct it or erase it. Because the basis for holding it is legitimate interests, they can also object to us holding it at all, or ask us to restrict what we do with it.
The recording sentence is not consent to a privacy policy the caller has never seen. A caller who wants to exercise any of those rights should write to privacy@callcover.io. We answer within one month of receiving the request, and we will say so within that month if a complex request needs longer.
We text a caller only as you, only where consent for that kind of message is recorded, and STOP stops your sender.
Children
This product is for trades businesses and the people who ring them about a job. It is not directed at children. We do not want Google account data from child-directed apps, and we do not request it.
Where it lives
The database is in Ireland. That is where the rows sit. The company we contract with for that database is registered in Singapore, and access to the data from outside the UK is a transfer even when the rows themselves do not move.
The telephony, speech and language, hosting and database, payment and email delivery providers we use are US or global companies, and are largely operated from the United States. So a UK caller’s voice and transcript leave the UK while the call is live: the audio reaches the telephony and speech providers, the speech is turned into text, and the text of each turn reaches a language provider. Calendar data goes to Google. Payment details go to the payment provider. The emails we send go to the email delivery provider.
Security
- One tenant’s data is isolated from another’s in the database.
- Client secrets (Google tokens, CRM keys) are encrypted at rest in our store. Access tokens from Google are not written to disk.
- We verify webhooks we accept.
The same three facts have their own page at security, which is where to write if you think you have found a problem.
US and UK
We take calls for businesses in both. UK GDPR and the Data Protection Act 2018 apply to UK personal data. US state laws (including all-party recording states, and California privacy law if it applies) are in scope because callers and tenants can be there.
We do not branch the greeting by jurisdiction. Every call is disclosed.
Complaints
You can complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we use personal data.
Contact
Privacy and data requests: privacy@callcover.io
Call Cover is a product of Northbound Tech Ltd, company number 17432444, registered in England and Wales. Registered office: 71-75 Shelton Street, London WC2H 9JQ.