Privacy Notice

Draft version 2026-10-14

1. About the service and our roles

Built by Creata Co, Watford, United Kingdom. Contact hello@shoplineai.co.uk for privacy questions. We act as controller for our account administration, billing and support. When processing caller enquiries solely on a business customer's instructions, that business generally acts as controller and we act as processor. The final customer processing agreement must document those responsibilities.

2. Information processed

Account information includes business name and industry, owner name where provided, email and telephone numbers, business phone, phone provider and line type, services, rates, hours, configuration instructions, agreement timestamps and Stripe references/status. You provide this at signup or in correspondence.

Enquiry information includes caller numbers, call events, SMS conversations, vehicle/job details, preferred dates, extracted details and summaries. Airtable stores conversation history and enquiry records; Make handles workflow and temporary message data. We do not offer photo collection/storage and calls are not recorded. Avoid attachments, passwords, payment-card details and unnecessary sensitive information in messages.

Stripe collects card and billing-address information in hosted Checkout; the intake form does not request card details. Suppliers can process IP addresses, timestamps, request information, delivery status and errors. Workflow execution logs can contain messages and other personal information; logs are not assumed anonymous.

3. Purposes and proposed lawful bases

We use information for account administration, configuration, support, subscription billing, service emails, security and applicable record-keeping duties. Contract may apply where the individual is the contracting customer; legitimate interests may apply to business-contact administration, support and security subject to assessment; legal obligation applies to records required by a relevant law. These mappings require final assessment.

Communications are service-only: onboarding, setup, support and billing. We do not use caller data for promotional marketing. Accepting Terms or acknowledging this notice is not blanket processing consent. The business customer determines its lawful basis and supplies privacy information for caller data processed on its instructions.

4. Providers and sharing

Enquiries are shared with the relevant business. Necessary disclosures may also be made to comply with law or obtain professional advice. Verify supplier entities, roles and agreements in the supplier register before final publication.

5. AI handling

The inspected request uses store:false, which is not Zero Data Retention. OpenAI's published API defaults do not use API data for training unless the customer opts in. Abuse-monitoring logs may contain content and normally remain for up to 30 days, subject to applicable exceptions. Account-specific opt-in and special retention settings have not been independently verified.

The service assists enquiry intake; the business checks quotations, availability and final bookings. The complete workflow must be verified before making categorical claims about legally or similarly significant automated decisions.

6. International processing

Providers may process information or allow access outside the UK, including the US and EEA. Airtable defaults to US hosting; the inspected Make organisation uses its EU zone. This is not UK-only storage. OpenAI, Twilio, Stripe and Vercel publish transfer provisions.

Verify which agreements apply to our accounts and the relevant adequacy regulations or contractual safeguards, including UK provisions where applicable. Public terms alone do not prove account-specific agreements or assessments are complete. Contact our privacy email for information about verified safeguards.

7. Approved retention — implementation pending

These are approved policy targets, not verified deletion behaviour. Make reports 30-day execution history, three-day webhook logs and separate interrupted-execution storage. Twilio defaults to message-log availability up to 400 days. Other suppliers and backups have separate retention and exceptions. Deleting an Airtable record does not remove all copies.

Before making enforced retention commitments, define inactivity, cleanup cadence, exports, supplier deletion/redaction, backup expiry and exceptions. Restrict legally retained information to its relevant purpose. Do not promise immediate erasure from every system.

8. Security and rights

No system guarantees absolute security. Access controls, permissions, confidentiality, credentials and incident procedures still require verification; no unsupported certification claim is made.

Depending on circumstances, rights may include access, correction, erasure, restriction, portability and objection. Where consent is relied upon it can be withdrawn without affecting earlier lawful processing. Rights are not absolute. Contact our privacy email; proportionate identity checks may apply. For caller enquiries contact the business as controller; we assist under the processing agreement.

You may complain to the Information Commissioner's Office. Requests need to cover relevant records and suppliers; we cannot promise deletion from a recipient's own phone or independent systems.

9. Website technologies

The inspected frontend loads Fontshare fonts and redirects to Stripe. Preview may include Vercel feedback tooling; this does not prove identical Production tracking. No marketing pixel was identified in the inspected frontend. Production analytics, cookies, browser storage and external requests remain for the final test. We do not claim there are no cookies or tracking; required information and consent controls must be supplied where applicable.

10. Updates

The final notice will display its version date and be updated as practices change, with material changes communicated where appropriate.