Privacy notice

This notice explains how Convexa AI Ltd ("Convexa", "we") handles personal data when you visit our website, speak with one of our voice agents, or use our service. We aim to keep it plain — if anything is unclear, get in touch.

1. Who we are

Convexa AI Ltd is a company registered in England & Wales (company no. 14820934), with its registered office at 88 Shoreditch High Street, London E1 6JJ. We are registered with the UK Information Commissioner's Office (ICO). For questions about this notice, contact our Data Protection team at privacy@convexaai.com.

2. What we collect

Depending on how you interact with us, we may collect:

• Contact details — name, work email, phone number, and company, when you book a call or contact us.
• Website usage — pages visited, approximate location, device and browser type, collected through privacy-respecting analytics.
• Call data — when you speak with a Convexa voice agent, we process the audio, a transcript, and metadata such as call time and outcome.
• Customer data — for customers, the information our team needs to build, launch, and support a managed voice-agent deployment.

3. How we use it

We use personal data to respond to enquiries, provide and improve the service, keep our systems secure, and meet our legal obligations. We rely on legitimate interests, contract performance, consent, or legal obligation as the lawful basis, depending on the activity. We do not sell personal data, and we do not use customer call content to train third-party models.

4. Controller & processor roles

For our own website and marketing, Convexa is the data controller. When we operate voice agents on behalf of a customer, the customer is the controller and Convexa acts as a data processor, handling personal data only on the customer's documented instructions under a data processing addendum.

5. Call recordings & voice data

Voice agents may record and transcribe calls where the customer has enabled it and where callers are notified. Personal and sensitive identifiers are automatically redacted from transcripts by default. Recordings are encrypted in transit and at rest, and access is logged. Retention is agreed with each customer and managed by our team.

6. Sharing & sub-processors

We share personal data only with vetted service providers (sub-processors) who help us run the service — cloud hosting, telephony, and observability — under contract. A current list of sub-processors is available in our trust centre. We may also disclose data where required by law.

7. Retention

We keep personal data only as long as needed for the purpose it was collected, or as required by law. Customer call data follows the retention period agreed with each customer (typically 90 days, and adjustable from 0 days to 7 years on request).

8. Your rights

Subject to applicable law, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. Where we operate as a processor, we will forward your request to the relevant customer (controller). To exercise a right, email privacy@convexaai.com. You may also complain to your local data-protection authority.

9. International transfers

Where personal data is transferred outside its region of origin, we rely on appropriate safeguards such as Standard Contractual Clauses and the UK International Data Transfer Addendum. Customers can agree a regional deployment — UK, EU, US, and others — with our team, set out in our trust centre.

10. Contact us

Questions, requests, or concerns about privacy can be sent to privacy@convexaai.com or by post to the registered office above. We will respond within the timeframes set by applicable law.