Privacy

1. Who we are

Squire PickUp is an AI receptionist for tradespeople. A customer rings you, you cannot answer, the call diverts to your PickUp number and PickUp handles it.

Where this page says we, us or Squire, it means Squire Holdings Ltd, the company registered at the foot of this page. For anything to do with personal data, write to hello@squireapp.co.uk or to the registered office below. We do not have a formal data protection officer, because the law does not require one for a business of our size. The person responsible is the company's director.

This page is for two kinds of reader: a tradesperson with a PickUp account, and a member of the public who rang a tradesperson and got PickUp. If you are the second, section 8 is written for you.

2. Who is responsible for what

Two different sets of personal details pass through PickUp, and they are not ours in the same way.

• Your details. Your account, your plan, your payment, your support messages, and how you use the dashboard. We decide what happens to those, so for them we are the data controller.
• Your callers' details. What they said, the number they rang from, where they live. Those belong to your business. You decide what PickUp does with them, so you are the controller and we are your processor, acting on your instructions. Our data processing agreement sets out the terms and forms part of our contract with you.

That split matters most when someone who rang you asks for a copy of their details or asks for them to be deleted. It is your call to answer, and we will help you answer it.

3. What we hold, and why we are allowed to

The law asks us to say, for each thing we do with your details, which legal ground we do it on. There are three in this list: running the contract you signed up to, a legitimate interest of ours that does not override yours, and a legal duty we cannot avoid.

Your account

Your name, your business name, your trade, your email address, your mobile, the number your job texts go to, your postcode and the area you cover, your working days and hours, your plan, the voice and greeting you chose, and the PickUp number we gave you. Ground: the contract. Without a name, a business name, an email and a mobile we cannot run PickUp for you, so those are the parts you have to give us. The rest makes your PickUp better at its job and is yours to leave out.

Your prices

What you charge, either typed into your dashboard or read out of a price list you upload. If you upload one, the document itself is held in private storage until it is deleted. Ground: the contract.

Every call to your PickUp number

The number the caller rang from, the name they gave, their postcode or area, what they said was wrong, how urgent it was, what PickUp quoted or booked, how long the call ran, and a written transcript of the conversation. Where recording is switched on for your account, we also hold a reference to the audio, which is held by Twilio rather than by us. Ground: we hold this as your processor, on your instructions.

Your customers

One record per caller number, so a customer who rings you again is recognised rather than treated as a stranger. Ground: as your processor.

Texts

Every text PickUp sends you or your customer, and any reply that comes back. Ground: the contract for texts to you, as your processor for texts to your customers.

Your diary

Only if you connect Google Calendar. We ask Google for the times you are busy, not for what those appointments are called, and we write the jobs PickUp books into your diary. You can disconnect it at any time and we delete the connection. Ground: the contract, and you switching it on.

Payments

Stripe holds your card. We hold Stripe's reference for you, your plan, your invoices and whether a payment went through. Ground: the contract, and tax law for keeping the invoices.

Support

What you write in the support room and what we write back. Ground: the contract.

Keeping the service running and honest

Server logs, error reports and usage figures, so we can fix faults, stop abuse and see which parts of PickUp get used. Logs record which account did what and when; they never record a caller's number. Ground: our legitimate interest in running a reliable, secure service, which we have weighed against yours and judged not to intrude on it.

What we never do

We do not sell personal details. We do not use what a caller said to advertise to them or to anyone else. We do not build profiles of your customers for our own purposes.

4. Recording, and what the caller is told

A call opens with your greeting, in the voice you chose. The greeting we suggest names the assistant. If a caller asks whether they are talking to a person, your PickUp says plainly that it is an AI assistant answering the phone for your business. It never claims to be a person and never denies being an AI.

Recording is off unless we have switched it on. When it is on, the first thing a caller hears, before the greeting, is:

"This call is recorded."

A caller who does not want to be recorded can hang up at that point, or ask to be rung back by a person. Recording a business call is lawful in the United Kingdom without that sentence, under the Telecommunications (Lawful Business Practice) Regulations 2000, and this policy is where callers can read about it. We say it anyway, because a caller who has been told cannot be surprised.

When recording is on, the audio is stored in our Twilio account. We keep a reference to it, never a link anyone could follow: the only way to hear a call back is through your dashboard, and the play button there makes a signed address that stops working after five minutes.

Whether or not the audio is recorded, every call is transcribed as it happens, because that is how PickUp follows the conversation. The transcript is what you see in your dashboard.

5. What the AI does with a call

While the call is live, three things happen to what the caller says.

• The audio is turned into text as they speak, so PickUp can follow the conversation.
• The text, along with your business details and your price list, is sent to a language model that decides what to say next. It can only quote prices from your list and can only offer times that are free in your diary.
• The reply is turned back into speech in the voice you chose.

After the caller hangs up, a second model reads the transcript once and writes the short summary, the job, the urgency and the rough value you see on your dashboard.

No decisions are made about anyone by the AI alone. It answers, transcribes, summarises, quotes from your list and offers free slots. It does not decide whether a caller gets served, what they are charged beyond your list, or anything with a legal effect on them. Every job goes to you, and you decide. If that ever changed, this page would say so and the law's safeguards for automated decisions would apply.

None of the companies in section 6 may use your callers' words to train their own systems. Where a supplier's standard terms would allow it, we have switched it off or told them not to, in the request itself or in our account settings.

6. Who else touches it, and where

PickUp is built on other companies' services. These are the ones that handle personal details on our behalf, what each does, and how sending details to it outside the United Kingdom is made lawful.

Twilio

Your PickUp number, the calls themselves, the texts, and the call recordings. United States. Certified under the UK extension to the EU-US Data Privacy Framework.

Deepgram

Turns what the caller says into text while the call is running. United States. Standard contractual clauses with the UK addendum, in its data processing agreement. Every request we send tells Deepgram not to use the audio to improve its models.

OpenAI

Decides what your PickUp says next. United States. Standard contractual clauses with the UK addendum. OpenAI does not train on what is sent through its API.

ElevenLabs

Speaks the reply in the voice you chose. United States. Certified under the UK extension to the EU-US Data Privacy Framework. Training on our account's content is switched off.

Anthropic

Reads a price list you upload, and writes the summary after a call. United States. Standard contractual clauses with the UK addendum. Anthropic does not train on what is sent through its API.

Stripe

Takes the payment for your plan. Card details go straight to Stripe and never reach our servers. United States and Ireland. Standard contractual clauses with the UK addendum.

Supabase

The database everything is stored in, the sign in codes, and the private storage for uploaded price lists. Switzerland, which the UK treats as an adequate country, so no further safeguard is needed.

Railway

Runs the software and the servers behind it. United States. Standard contractual clauses with the UK addendum.

Resend

Sends our emails to you: sign in codes, your number is ready, receipts, the weekly summary. United States, sending from servers in Ireland. Standard contractual clauses with the UK addendum.

Sentry

Collects error reports when something in the software goes wrong. A report names the account and the request, never a caller. A United States company, but our project is held in its European Union region in Germany, and standard contractual clauses with the UK addendum cover any support access from the United States.

Plausible

Counts visits to this website without cookies and without identifying anyone. European Union.

Google

Only if you connect a calendar. Busy times out, booked jobs in. United States. Certified under the UK extension to the EU-US Data Privacy Framework.

Each of them is bound by a contract that limits what it may do with the details we send it to what we have asked for. Where the safeguard is the standard contractual clauses, we have assessed the transfer and recorded that assessment, and you can ask us for a copy of the clauses. If we add a supplier or swap one, we update this list and, for anything that handles your callers' details, we tell you 15 days before.

We also share details where the law makes us, for example with a court or a regulator, and would tell you unless the law stopped us.

7. How long we keep it

Calls, leads, bookings and customers

While your account is open. Six months after your plan ends, we erase the account and everything under it. Ask sooner and we erase it sooner.

Transcripts and call recordings

Twelve months from the call, then the written record and the audio held at Twilio are both deleted by a nightly job. The short summary on your dashboard stays, because that is what tells you what the job was.

A price list you upload

The document is deleted thirty days after it arrives, whatever happens to your account. The prices read out of it stay, because they are what your PickUp quotes from.

Texts

The same as the call they belong to.

Support messages

While your account is open, then with the account.

Server logs and error reports

Ninety days.

Invoices and payment records

Six years from the end of the tax year they fall in, because tax law requires it.

Backups

The database is backed up daily. A backup is overwritten within thirty days, so anything erased above is gone from backups within thirty days of that.

Six months after a plan ends is a grace period, not a delay for its own sake. Plenty of tradespeople come back in the winter and would rather not lose the year behind them.

Twelve months for a transcript is a clock of its own, not the account's. A transcript is a member of the public describing their home in their own words. A year is long enough to hear back a call about a job earlier in the year and settle a dispute over it, and after that it is more sensitive than it is useful.

8. If you rang a tradesperson

You rang a business, nobody picked up, and an AI receptionist answered instead. This is what happened to what you said.

• Where it came from. We did not get your details from a form or a list. They came from the call you made to the tradesperson's number, which they had diverted to us.
• Who holds it. The tradesperson you rang. They decide what happens to it. We only hold it for them, as their processor.
• What is held. The number you rang from, the name you gave, the area or postcode, what you said was wrong, and a written record of the conversation. If recording was on, there is audio too, and you were told so at the start of the call.
• What it is for. So the tradesperson can ring you back, quote you or turn up. It is not sold, and it is not used to advertise to you.
• How long. The written record and any audio are deleted twelve months after the call. The job details stay with the tradesperson while they have an account with us.
• Who else sees it. The companies in section 6, and only to do the jobs described there.

To ask for a copy, a correction or deletion, ask the business you rang. If you cannot reach them, write to hello@squireapp.co.uk and we will pass it straight on and help them answer.

9. Your rights

Under UK data protection law you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to stop using it in a particular way or to restrict what we do with it, object to processing based on our legitimate interests, and ask for what you gave us in a form you can take elsewhere. Where anything rests on your consent, such as a connected calendar, you can withdraw it at any time.

Ask through the support room in your dashboard, or by email to hello@squireapp.co.uk, or in writing to the registered office at the foot of this page. We answer within a month, and we do not charge for it. We may ask you to prove who you are first.

Under 18s: PickUp is a business service and is not for children. We do not knowingly hold details of anyone under 18 as an account holder. A caller can be any age, and their details are held only for the tradesperson they rang.

10. Keeping it safe

• Everything travels over an encrypted connection, and the database, its backups and uploaded documents are encrypted where they are stored.
• Card details never reach our servers. They go straight from your browser to Stripe.
• Recordings are not public. The play button in your dashboard makes a signed address that stops working after five minutes.
• If you connect Google Calendar, the keys to your diary are encrypted before they are stored, so a copy of the database on its own is worth nothing.
• The database rows are reachable only by our own software using its own secret key. There is no public path to them, and access to the systems behind PickUp is limited to the people who run it.
• Callers' numbers are kept out of our server logs, and your own number is never read out to a caller.

If despite all that your details were lost, exposed or reached by someone who should not have them, we would tell you without undue delay, and tell the Information Commissioner's Office within 72 hours where the law requires it.

11. The website, emails and your dashboard

This site sets no advertising cookies and does not track you around the internet. The fonts and scripts it uses are served from our own site, so no outside company sees your visit. Our cookie notice lists every setting kept on your device and how to clear it, and explains the cookieless visit counter we use.

If you fill in the sign-up form or book a call with us, we keep what you typed so we can answer, on the ground that you asked us to.

We email you about your own account: sign in codes, your number being ready, receipts, a weekly summary of calls, and support replies. Those are part of the service and you can switch the summary off in Settings. We only send marketing email if you have said we can, and every one of those carries an unsubscribe link. We text you about calls you have missed, to the number you gave us for it, and you can change or turn off those texts in Settings.

12. Complaints

If you think we have got something wrong with your details, tell us at hello@squireapp.co.uk with the word Complaint in the subject, or through the support room. We acknowledge every complaint within 30 days, and in practice within two working days, look into it, and tell you the outcome and what we have done.

You can also complain to the Information Commissioner's Office, the UK regulator for personal data: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, 0303 123 1113, ico.org.uk/make-a-complaint. We would rather you told us first, so we can fix it, but that is your right and you do not need our permission to use it.

13. Changes, and how to reach us

If we change how any of this works, we change this page and the version and date at the top, and we keep every earlier version. If a change matters to you, we email you rather than leaving you to find it.

The quickest way to reach us is the support room in your dashboard. A real person reads it. By email it is hello@squireapp.co.uk, and by post it is the registered office at the foot of this page.