Last updated: October 2026

Privacy Policy

DialAct Ltd (“DialAct”, “we”, “us”, or “our”) operates DialAct, a service that answers phone calls for businesses with an AI voice assistant, at dialact.app. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and what rights you have in relation to it.

By using our services, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use DialAct.

1. Who We Are

The data controller is DialAct Ltd, a company registered in England and Wales. Our contact email for privacy matters is hello@dialact.app. For GDPR-specific enquiries and data subject requests, please email dpo@dialact.app.

2. Data We Collect

Account and registration data

When you create a DialAct account, we collect your name, email address, and any organisation details you provide. Account authentication is handled by Clerk — your password is never stored by DialAct directly. If you pay by card, your payment details are processed by Stripe and are not stored on DialAct servers.

Call recordings and transcripts

When a caller contacts your AI agent, the call audio is recorded and transcribed. This recording and transcript contains the voice and words of the caller — who may be your customer, patient, or client. Every call opens with a line telling the caller they are speaking to your business's virtual assistant and that calls are recorded, and the agent always says it is an AI if asked. You remain responsible for making sure your use of DialAct complies with the call recording and AI disclosure laws where you and your callers are.

Call audio is processed by our AI voice pipeline for transcription and AI response generation. Transcripts are stored in DialAct's secure database. Recordings are stored on our infrastructure and deleted after 30, 90 or 365 days, depending on your plan.

Contact and lead data

When a caller's details are captured by your agent (name, phone number, email, reason for call), that data is stored in your DialAct account as a contact record. This data belongs to you as the DialAct customer — DialAct stores it on your behalf.

Business configuration data

This includes your agent prompts, knowledge base content, business hours, FAQ answers, intake questions, and other settings you configure within DialAct. This content is stored in Supabase and used solely to power your AI agent.

Usage and analytics data

We collect data about how you use the DialAct dashboard — pages visited, features used, and session duration. This is used to improve the product. We use Sentry for error monitoring, which may capture anonymised stack traces if errors occur during your session.

Cookies

We use essential cookies required for authentication (set by Clerk) and session management. We do not use advertising cookies or sell your browsing data to third parties. The live chat in the dashboard (Tawk.to) sets its own cookies, and only loads when you choose to open it. You can configure cookie preferences via your browser settings, but disabling essential cookies will prevent you from logging in to your account.

3. How We Use Your Data

We use the data we collect for the following purposes:

• Providing the service — processing calls, generating AI responses, booking appointments, and displaying your data in the dashboard.
• Billing — processing subscription payments and sending invoices.
• Account management — authenticating your login, managing your organisation, and sending account-related emails (receipts, usage alerts, notification emails).
• Product improvement — understanding how customers use DialAct to improve features and fix bugs. This analysis is performed on aggregated and anonymised data where possible.
• Support — diagnosing and resolving technical issues you report to us. We may review call transcripts or account data if you give us permission to do so in the course of a support request.
• Legal compliance — retaining records as required by applicable law and responding to lawful requests from public authorities.

We do not use your call recordings, transcripts, or customer contact data to train AI models. We do not sell your data to any third party.

4. Who We Share Data With (Sub-processors)

We share data with the following third-party service providers (“sub-processors”) solely to operate the DialAct service. Each sub-processor is contractually bound to protect your data and may only process it for the purposes we specify.

For transfers of personal data from the UK or EU to sub-processors in other countries, including the USA and India, we rely on Standard Contractual Clauses (SCCs) as the transfer mechanism, or adequacy decisions where applicable.

5. Data Retention

We retain data for as long as necessary to provide the service and meet our legal obligations. Specific retention periods:

• Call recordings — retained for 30, 90 or 365 days from the date of the call, depending on your plan, then permanently deleted from our secure storage.
• Call transcripts — retained for 12 months (1 year) from the date of the call, then permanently deleted.
• Contact and lead data — retained for the lifetime of your account. Deleted within 30 days of your request to close your account.
• Account data — retained for the lifetime of your account. Deleted within 30 days of your request to close your account.
• Billing records — retained for 7 years to comply with UK tax and accounting requirements, even after account closure.
• Knowledge base content — retained for the lifetime of your account. Deleted immediately upon your request or account closure.

You can delete individual call transcripts, contact records, and knowledge base documents at any time from within the DialAct dashboard.

6. Your Rights

Depending on your location, you may have the following rights in relation to your personal data:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate or incomplete data.
• Right to erasure — you can ask us to delete your personal data. We will comply unless we are required to retain it by law.
• Right to data portability — you can request your data in a machine-readable format.
• Right to restrict processing — you can ask us to pause processing of your data in certain circumstances.
• Right to object — you can object to processing based on legitimate interests.

To exercise any of these rights, email dpo@dialact.app. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have handled your data unlawfully.

7. Security

We implement industry-standard security measures including encryption in transit (TLS 1.2+), row-level security on our database (Supabase RLS policies), API authentication for all data access, and regular security reviews. All sub-processors are contractually required to maintain equivalent security standards.

No system is 100% secure. If you discover a security vulnerability in DialAct, please report it responsibly to hello@dialact.app.

8. Children's Privacy

DialAct is a business-to-business service and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and update the “Last updated” date at the top of this page. Continued use of DialAct after the effective date of any changes constitutes acceptance of the revised policy.

10. Contact Us

For questions about this Privacy Policy or to exercise your data rights:

• General enquiries: hello@dialact.app
• Data protection / GDPR: dpo@dialact.app