Legal

Privacy Policy

Last updated · 6 Nov 2026 · Effective · 15 May 2026

This policy explains how Alta Vena Technologies Ltd (trading as Scarlett, company number 17330369, registered in England and Wales, registered office in London, UK — “we”, “us”, “our”) handles personal data when you use the Scarlett AI service at getscarlett.ai (and the deployed app at the current Vercel preview URL until our DNS cuts over).

We are the data controller for personal data about you, your staff, and the people who call you through Scarlett. We are registered with the Information Commissioner’s Office in the UK.

1. What we collect

We collect data in four buckets: account data you give us when you sign up,configuration data you give us when you set Scarlett up,call data that flows through Scarlett when your callers ring, and technical data we collect automatically to keep the service running.

1.1 Account data

Your name, email address, mobile number, business name, and the trade you operate in.
The password you set, stored as a salted hash (we can never see the plain text, including during password reset).
Billing details — handled by Stripe; we only hold your Stripe customer ID, the last 4 digits of your card, the brand (Visa/Mastercard/etc.), subscription status, period dates, trial-end date. We never see or store your full card number or CVC.
VAT number, company number, and registered address if you provide them.

1.2 Configuration data

Your services list (job types, prices, descriptions), call scenarios you’ve enabled, custom instructions, and business hours.
The voice you’ve picked for Scarlett.
Calendar OAuth tokens (Google or Outlook) if you connect a calendar — held encrypted at rest.
The Scarlett phone number we’ve allocated to your account.
Optional documents you upload to train Scarlett, the text content scraped from your website if you used the wizard’s scraper.

1.3 Call data

The caller’s phone number, the time and duration of the call, and which of your Scarlett numbers they called.
An audio recording of the call (see retention below).
A speech-to-text transcript of both sides of the call.
A summary, intent classification (e.g. quote, urgent, booking, complaint), and any structured data Scarlett extracted such as the caller’s name, postcode, or described problem.
Any SMS message Scarlett sent to the caller after the call, including the body and the time of delivery.
Any booking Scarlett made on your calendar as a result of the call.

Disclosure at call start. The very first thing Scarlett says on every call is a clear statement that the call is recorded and analysed by AI. This satisfies the lawful-basis requirement under UK GDPR. Callers who object can hang up and reach you by another route.

1.4 Technical data

The IP address you connect from, browser user-agent, and referrer — used for rate limiting on signup and sign-in, and for basic abuse prevention.
Pages visited inside the dashboard and basic interaction timestamps — used to monitor service health.
Server-side logs that may contain your account ID and the shape of API requests for debugging. These logs are automatically purged after 30 days.

2. Why we use it (lawful basis)

We rely on three lawful bases under UK GDPR Article 6:

Performance of a contract for account creation, subscription management, taking calls on your behalf, sending you operational emails, providing support, and storing the data needed for any of the above.
Legitimate interest for keeping the service secure (rate-limiting, fraud detection), improving Scarlett’s conversational quality through aggregated evaluation, and communicating about service changes. We’ve assessed that these uses don’t override your interests; you can object at any time.
Legal obligation for retaining billing records (HMRC), responding to lawful information requests, and complying with safeguarding obligations if any.

We do not rely on consent except for cookies that are not strictly necessary (we don’t currently set any), and optional marketing email which you can opt into separately.

3. Who else processes data for us (sub-processors)

Scarlett relies on third-party providers to deliver the service. Each operates as a data processor on our behalf under a contract that meets UK GDPR Article 28. The current list:

Supabase (Supabase Inc.) — primary database, authentication, file storage. EU region (Ireland, eu-west-1). Standard Contractual Clauses where applicable.
Vercel (Vercel Inc.) — web hosting for the app and marketing site. Edge network worldwide; data at rest in the EU/US.
Meta Platforms (WhatsApp Business Platform) — carries WhatsApp messages to and from a business that has connected WhatsApp to Scarlett, including Scarlett’s own number (section 15). Meta Platforms Ireland Ltd for UK and EU users; messages may be processed outside the UK and EEA under Meta’s Standard Contractual Clauses. Only used for businesses that connect WhatsApp.
Twilio Inc. — telephony (inbound calls and outbound SMS). US-headquartered with EU points of presence. Data Privacy Framework certified.
Speechmatics Ltd — speech-to-text for dictation inside the app. No longer used on phone calls. UK-based; audio is processed in the EU.
Anthropic PBC — the Claude large language model that powers Scarlett’s conversation. US-based; SCCs in place. Anthropic confirms inputs and outputs are not used to train Anthropic’s public models when accessed via the API.
ElevenLabs Inc. — handles the live call end to end: speech recognition, the conversation itself, and the voice you hear. Also used for the in-app “try her out” feature. US-based; SCCs in place.
Stripe Payments UK Ltd — payment processing and the customer portal. Stripe handles all card data directly; we never receive it.
Twilio SendGrid — email delivery: signup confirmation, password reset, billing notifications, and the quotes, invoices and messages businesses send their customers through Scarlett (section 14). US-based; SCCs in place.
PostHog — product analytics, so we can see which parts of Scarlett are used and where signup goes wrong. Hosted in the EU (Frankfurt). We do not record sessions and we do not send call recordings, transcripts or your customers’ details to it. Analytics requests are proxied through our own domain, so the data goes to us first.
Google (Firebase Cloud Messaging) — delivers push notifications to the Scarlett mobile apps; on iPhone and iPad, Firebase passes them to Apple’s push service for delivery. Only used if you install the app and allow notifications. It receives your device’s push token and the text of each alert, which can include a caller’s name and a one-line summary of the call or booking. Never recordings or transcripts.
ScrapingBee — loads the pages of your own business website when you ask Scarlett to read it during setup, so sites built with JavaScript can be read properly. It receives the address of the public page to load and nothing from your account, your calls or your customers.
Meta (Facebook and Instagram) — measures which of our own adverts bring people to our website and to sign up, so we stop paying for the ones that don’t. Only on our public website and the sign-up and sign-in pages, and only if you click Accept on our cookie banner. It receives the pages you visit there and whether you booked a demo or started a trial. It is never loaded inside the Scarlett app, so it never sees your calls, messages or your customers. Meta is US-based and certified under the Data Privacy Framework (UK Extension).
OpenStreetMap, Open-Meteo and postcodes.io — draw the map, today’s weather and your town’s name at the top of your dashboard. Your browser loads the map pictures for your area from OpenStreetMap, which sees your IP address the way any website you visit does; the weather and town name are fetched by our own server, which sends only your base postcode or its rough position, never who you are.

Where any of the above are based outside the UK or the EEA, we transfer personal data under Standard Contractual Clauses, the UK International Data Transfer Addendum, or the UK Extension to the EU-US Data Privacy Framework as appropriate. We do not transfer data to any country that the ICO considers not to provide adequate protection without one of those mechanisms in place.

We’ll update this list when we add or remove sub-processors and notify you by email if a change affects you materially.

4. AI processing and training

Scarlett is built on third-party AI models (ElevenLabs for speech recognition and voice, Claude for language understanding). When a call comes in, the live audio stream is sent to those services on a per-request basis solely to handle that call. When you dictate inside the app, that audio goes to Speechmatics instead, on the same per-session basis. Our contracts with those providers confirm that:

Inputs and outputs are not used to train the providers’ public AI models when accessed via the API on our paid plans.
The providers act as our processors and only use the data to provide the service to us, not for their own purposes.

We may use anonymised or aggregated metrics derived from multiple customers (for example, average call duration, transcript-quality scores, common caller intents) to evaluate and improve Scarlett. We never use one customer’s raw call content to train any model that other customers use.

5. How long we keep it

Account, profile, configuration data: while your account is active, plus up to 90 days after closure (operational tail).
Call recordings (audio): 90 days by default.
Call transcripts and summaries: kept while your account is active; deleted within 30 days of account closure.
Server logs: automatically purged after 30 days.
Billing records (invoices, payment events): 6 years from the end of the relevant tax year, in line with HMRC requirements.
Stripe records on Stripe’s side: governed by Stripe’s own retention schedule, see stripe.com/privacy.

On account closure or written request, we’ll delete all data we hold about you within 30 days, except where we are obliged to retain it for legal reasons (e.g. billing records).

6. Your rights under UK GDPR

You have the right to:

Access the personal data we hold about you and receive a copy.
Rectify inaccurate data and complete data that is incomplete.
Erase your data in the circumstances allowed by law. We aim to action erasure requests within 30 days.
Restrict our processing while you challenge its accuracy or our lawful basis.
Object to processing based on legitimate interest, including for direct marketing (we don’t currently do direct marketing).
Portability — receive your data in a structured, machine-readable format so you can move it to another provider.
Withdraw consent at any time where we’ve relied on consent. Withdrawing consent doesn’t affect the lawfulness of processing done before withdrawal.

To exercise any of these rights, email hello@getscarlett.ai. We’ll verify your identity (so we don’t hand your data to someone else) and respond within one calendar month.

If you’re unhappy with how we’ve handled your data, you also have the right to complain to the Information Commissioner’s Office at ico.org.uk. We’d appreciate the chance to put things right first.

7. Callers’ rights

People who call your Scarlett number have the same rights as you, but their relationship is primarily with you (your customer-of-customer relationship is governed by whatever agreement they have with your business). You and we are each independent controllers for their data: we process it to provide the receptionist service to you, and you process the outputs (lead, booking, summary) for your own business purposes. If a caller contacts us directly to exercise their rights, we’ll forward the request to you so you can act on it; we’ll also action our own side directly where it makes sense (e.g. shortening the retention window for a specific recording).

8. Security

We take security seriously:

All data in transit between you, our systems, and our sub-processors is encrypted using TLS 1.2 or higher.
Data at rest in our primary database is encrypted using AES-256 (Supabase Postgres).
Row-level security policies enforce that no customer can read or write another customer’s data, even via the API.
Our service-role keys are restricted to two specific server-side endpoints (Stripe webhook + signup write-back) and never exposed to the browser.
Our voice service runs as a non-root user inside a hardened container.
Access to production systems by Scarlett AI staff requires multi-factor authentication.
We run regular security audits and update sub-processor contracts as their certifications and standards evolve.

Despite all that, no system is perfectly secure. If we ever suffer a data breach that affects you, we’ll notify both you and the ICO within the timeframes UK GDPR requires.

Support access to your account

To help you when something goes wrong, a member of our support or account-management team can open your account and see what you see — your calls, messages, customers and settings. We do this to diagnose problems that we cannot reproduce from our own systems.

Every time it happens:

The person has to sign in with multi-factor authentication and write down a reason first.
We record who they were, whose account they opened, when, and why. Those records are kept for our audit log.
The session ends automatically after 30 minutes.
They cannot send messages to your customers, change your billing, change where your calls are transferred, buy you a phone line, or delete your account. Those actions are blocked outright while they are acting on your behalf.

We don’t email you each time, because it usually happens during a support conversation you started. If you’d like a record of when staff have opened your account, ask us and we’ll send you one.

9. Cookies and similar technologies

We use a small number of cookies and similar local-storage entries:

An essential session cookie set by Supabase Auth so that you stay signed in.
A CSRF protection token set by our framework.
A short-lived signup token in component state during the signup wizard so the Stripe payment step can identify you without leaking email addresses.
A scarlett-theme localStorage entry that remembers whether you’ve opted into dark mode.
A scarlett_consent cookie that remembers your answer to the cookie banner, for six months, so we ask you once.

None of these are used for advertising, behavioural tracking across other sites, or audience profiling.

Advertising cookies, only if you say yes. On our public website and the sign-up and sign-in pages we ask, with a banner, whether we may use the Meta Pixel. If you click Accept, Meta sets its own cookies (_fbp, and _fbc when you arrive from one of our adverts) so we can see which adverts lead to visits, demo bookings and trials, and show our adverts to people like those who signed up. If you click Reject, or don’t answer, none of this loads. You can change your mind at any time with “Cookie settings” at the bottom of every page of our website; saying no removes Meta’s cookies. None of this runs inside the Scarlett app.

Our product analytics (PostHog, listed in section 3) is deliberately configured to store nothing on your device — no cookie, no local storage. It counts page views and signup steps within a single visit so we can see where the product is confusing, and it cannot recognise you when you come back. That is why it runs whatever you answer on the cookie banner.

10. Children

Scarlett is sold for business use and is not aimed at children. We don’t knowingly collect personal data from anyone under 16. If you believe a child has signed up or had their data captured on a call to a Scarlett number, contact us so we can delete it.

11. Changes to this policy

We may update this policy. The version published at this URL is always the current one and the date at the top is updated when it is. If we make material changes to how we handle your personal data, we’ll email you at the address on file at least 30 days before the change takes effect.

12. Google user data (Calendar and Gmail)

If you connect Google, Scarlett asks for two scopes and nothing wider. This section sets out exactly what we do with the data each one gives us.

Google Calendar events (https://www.googleapis.com/auth/calendar.events) — used for two things only. To read when you are already busy, so Scarlett never offers a caller a time you cannot make; and to write an appointment into your calendar when she books one. When we read your calendar we take the start and end times of your events and nothing else — not titles, not attendees, not locations, not descriptions. Your colleagues on the same Scarlett account see those periods marked only as “Busy”.
Gmail send (https://www.googleapis.com/auth/gmail.send) — used only to send a reply you have written, from your own address, when you reply to a customer from your Scarlett inbox. It is a send-only permission. Scarlett cannot read your mailbox: we deliberately do not request gmail.readonly or any other read scope, so no email you have received is ever accessible to us.

How the connection is stored. The OAuth tokens Google issues are encrypted with AES-256-GCM before they are written to our database and are only ever decrypted on our servers at the moment a request is made. Disconnecting Google on the Integrations page deletes them.

Limited Use. Scarlett’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not and will not: transfer Google user data to others except as needed to provide or improve the features you have asked for, to comply with applicable law, or as part of a merger or acquisition; use it for advertising; sell it; or allow humans to read it, other than where you have given us specific permission, where it is necessary for security purposes such as investigating abuse, or where the law requires it.

We do not train models on it. Google Calendar and Gmail data is never used to train or fine-tune any AI model, ours or a third party’s. See section 4.

13. Accounting software (QuickBooks and Xero)

If you connect QuickBooks Online (Intuit Inc.) or Xero (Xero Limited), you choose which company or organisation Scarlett may use, on that provider’s own consent screen. Each account connects its own; no other Scarlett customer can reach it.

What we read: your customers’ names, email addresses, phone numbers and addresses, so Scarlett recognises a customer when they call; and, to write documents correctly, your company name, your products and services list and your VAT codes. We do not read your bank feeds, payroll, reports or other transactions.
What we write: the quotes and invoices you send from Scarlett, and a customer record when one is needed for them. In Xero they arrive as drafts; QuickBooks has no draft state, so there they are recorded as issued. We never ask either provider to email your customer — you already have.
How often: when you send a document, when you press Import, and once a night to pick up customers you added or changed since the last run.

The tokens the provider issues are encrypted with AES-256-GCM before they reach our database. Disconnecting on the Integrations page deletes them, and for QuickBooks also revokes the connection at Intuit; you can also disconnect from inside QuickBooks or Xero. Customers already imported stay in your Scarlett contacts until you delete them. This data is never used to train any AI model, sold, or used for advertising.

14. Messages businesses send through Scarlett

Businesses that use Scarlett can email or text their own customers and enquirers in bulk — a Christmas greeting, a holiday closure, a price change. If you received one, the business that sent it is the controller of your details and decided to contact you; Alta Vena Technologies Ltd processes them on its behalf.

What we hold for each message: your name and the email address or mobile number it went to, whether it was delivered, and when. The message itself is kept with the business’s account.
How it is sent: from the business’s own Gmail account when they have connected it, otherwise through Twilio SendGrid (email) or Twilio (texts), both listed in section 3.
Opting out: every email has an unsubscribe link and every text tells you to reply STOP. Either one stops that business’s bulk messages to you straight away. It does not stop other businesses that use Scarlett, and it does not stop the business replying to you about work you have asked for, such as a quote or an invoice. Replying START to a text opts you back in.
We keep the opt-out. To keep honouring it, we store the address you opted out with, against that business, for as long as the business uses Scarlett — even if they delete you from their contacts or import you again later.
Not used for anything else. We do not use these details to market Scarlett or anyone else, sell them, or use them to train any AI model.

To ask what a business holds about you, or to have it deleted, contact the business directly, or email us and we will pass it on.

15. WhatsApp

A business using Scarlett can connect its WhatsApp number, and Scarlett’s own number uses WhatsApp too. When you message one of these numbers:

Who is responsible: the business you messaged is the controller of your messages; Alta Vena Technologies Ltd processes them on its behalf. On Scarlett’s own number, Alta Vena is the controller.
What we keep: your WhatsApp name and number, your messages and any photos, voice notes or documents you send, the replies, and whether they were delivered and read. They sit in the business’s Scarlett inbox with its calls, texts and emails, for as long as it keeps them.
Automatic replies: Scarlett, an AI assistant for that business, may answer you on its behalf, using what the business has told her about its services. She is not a general-purpose assistant. A person at the business can take the conversation over at any time.
Messages they start: a business only starts a WhatsApp conversation with you — a quote, a booking reminder — if you messaged it first or agreed to hear from it on WhatsApp. Reply STOP and it will not message you on WhatsApp again; START reverses it.
Never used to market Scarlett or anyone else, sold, or used to train any AI model.

16. Facebook and Instagram

A business using Scarlett can connect its own Facebook Page and the Instagram business account linked to it, to publish its posts and to answer its Messenger and Instagram messages from the Scarlett inbox. It does this by signing in with Facebook and choosing which Page to connect; nothing is connected without that.

What we receive from Meta: the name and ID of the person who signed in, the Pages they manage (so they can pick one), the connected Page’s name and ID, the linked Instagram account’s ID, username, profile picture and recent posts, and an access token that lets Scarlett act for that Page. If messages are switched on: each Messenger or Instagram message sent to the business, with the sender’s name and Meta ID, and the replies.
What we use it for: publishing posts the business has approved to its own Page and Instagram account, showing which account they are connected to, and showing its customers’ messages in its inbox so a person at the business can reply. Replies are written and sent by a person at the business, only to someone who messaged it first, and only within the time Meta allows. We do not send promotional or unsolicited messages.
Who is responsible: for the business’s own Page and posts, Alta Vena Technologies Ltd is the controller. For messages from a business’s customers, the business is the controller and Alta Vena processes them on its behalf.
Where it is kept: in our database at Supabase (section 3). Access tokens are stored encrypted and are never shown in a browser. When a message arrives, Anthropic’s Claude reads it to label it and tag the customer (section 3), under the terms in section 4.
How long: the connection and its token until the business disconnects it or closes its account; messages with the rest of the business’s inbox, for as long as it keeps them, and deleted within 30 days of the account closing (section 5).
Disconnecting: a business can disconnect its Page in Social media → Settings → Connections, and switch messages off in the Inbox, at any time. It can also remove Scarlett in its Facebook settings under Business Integrations. Disconnecting stops new posts and messages straight away.
Never sold, used to market Scarlett or anyone else, shared with other businesses on Scarlett, or used to train any AI model.

To have this data deleted, follow the steps on our data deletion page or email us (section 17).

17. Contact

For privacy questions, requests under UK GDPR, or to flag a concern, email hello@getscarlett.ai. Postal correspondence can go to Alta Vena Technologies Ltd, registered office in London, UK — full address available on request or on Companies House (company number 17330369).