BlueMonkeyAI is a service operated by Bizitel Limited, registered in England & Wales, company number 06449529, registered office Lilywood, Longage Hill, Rhodes Minnis, CT4 6XT, United Kingdom. VAT registration GB929960082.
Privacy questions: privacy@bluemonkeyai.com.
This matters more than anything else on this page, because it decides whose rules apply to what.
Businesses in Zimbabwe: local data protection law may impose additional duties on you as controller, over and above what is described here. This policy describes our obligations, not yours — take your own advice on what Zimbabwean law requires of you.
If you are a caller and want your information removed, the business you rang is the right place to ask. If they ask us, we act on it.
No audio of a call to your receptionist is recorded or stored. There is no recording feature on a customer line, no setting to enable one, and no audio of your callers is written to disk at any point.
What happens instead: while a call is live, the audio is streamed to our speech provider so the receptionist can understand and reply in real time, and a written transcript is produced. The transcript is what we keep. The audio is not.
The only sound files the system creates are ones it speaks itself — the ringing tone, spoken announcements, and the short summary the receptionist reads to a member of staff before putting a caller through. These are deleted when the call ends, and a sweep removes any left over within 24 hours.
The recordings and demonstration dashboards on our website show calls made by us to demonstration businesses we invented; any phone number appearing in a published sample is our own. Demonstration dashboards never show anyone else's calls.
We do not publish the demonstration numbers, and the demonstration businesses cannot be called. Their telephone numbers have been returned to our pool, so nobody can ring them — every call you can read or hear there is one we made ourselves. Caller numbers are masked on those pages in any case: the digits that identify a caller are never displayed.
Our demonstration lines, which are not published, may be recorded; customer lines are never recorded. If we make a recording on one of our own lines, the receptionist says at the start of the call that it is a demonstration and that it is being recorded.
This exception cannot reach a customer line. Recording is tied to the account type: a demonstration account records, a customer account produces no audio file at all. That is enforced in the software and checked automatically, not left to a setting somebody could tick by mistake.
| What | Why | Kept for |
|---|---|---|
| Call transcripts | so you can see what was said | while your account is active, then 30 days |
| Call summaries and outcomes | so you can scan a day at a glance | while your account is active, then 30 days |
| Messages taken for you | so you can act on them | while your account is active, then 30 days |
| Appointments | your diary | while your account is active, then 30 days |
| WhatsApp conversations | so you can read what was said | while your account is active, then 30 days |
| Caller phone numbers and names | so you can call people back | held within the records above |
| Documents you upload | so the receptionist can answer from them | until you delete them |
| Your account, plan and invoices | to run your account | as long as you are a customer, then six years (tax law) |
This deletion process is in force from 30 September 2026.
If you come back before that date, nothing is deleted. Reactivating cancels the deletion.
What we keep afterwards, and only this: your business name, the plan you were on, your country, the date you joined, and the reference that ties you to your invoices in Stripe. We keep those for six years because UK tax law requires us to be able to account for what we sold you. Everything else — every transcript, message, booking, document and WhatsApp conversation — is gone.
Deleting something from the live service does not reach backups taken before the deletion. Those expire on their own schedule, and the longest any deleted record survives in a backup is 14 days after deletion.
One exception: we occasionally take a manual snapshot of the whole server before a risky change, and those do not expire on a timer. Manual snapshots taken while customer accounts exist are deleted within 30 days — so a deleted record survives at most 60 days from cancellation.
Data protection law asks us to say which lawful basis we rely on. For your own information — the account, not your callers' — these are ours:
| What | Basis | Why |
|---|---|---|
| Running your account, providing the service, taking payment | Contract | We cannot give you a receptionist without it. |
| Invoices and tax records | Legal obligation | UK tax law requires us to keep them for six years. |
| Keeping the service secure, preventing fraud and telephone-line abuse, and sending you alerts about your own service | Legitimate interests | Ours and yours: a platform that carries telephone calls is a target, and an account holder needs to be told when something is wrong with theirs. We have weighed this against your interests and it does not override them. |
For your callers' information, you choose the basis, not us. You are the controller for that data and we are your processor — we hold it on your instructions, and it is for you to decide, and to tell your callers, what your lawful basis is for having a receptionist answer your line.
If you switch on WhatsApp, your receptionist can answer messages sent to your WhatsApp Business number. We process the sender's WhatsApp number, the messages they send, and the replies the receptionist sends back.
WhatsApp messages reach us through Twilio, which is our messaging provider, and travel over WhatsApp (Meta), which operates the network itself. Meta's handling of WhatsApp messages is governed by its own terms with you and with the person messaging you; we do not control it.
Today the WhatsApp record is read-only in your dashboard: you can see the conversation, and replies are sent by the receptionist during the conversation rather than by you from the page.
We use a small number of suppliers. Each does one job, and none is given information for any purpose of its own.
| Supplier | What it does | Where |
|---|---|---|
| OpenAI | understands speech and writes the receptionist's replies, transcripts and summaries | United States |
| Twilio | carries WhatsApp messages | United States and Ireland |
| WhatsApp (Meta) | the WhatsApp network itself | United States and elsewhere |
| Telnyx, Gamma, Liquid Telecom, DIDLogic | telephone carriers — they carry the call and see the numbers involved; they never receive transcripts or your dashboard data | United Kingdom, United States, Zimbabwe and elsewhere |
| Stripe | takes payment for your subscription | United States and Ireland |
| Hetzner | hosts the service and stores the backups | Finland and Germany |
| Our own mail server, operated by Bizitel Limited | sends you notification and account emails | Germany |
We do not use advertising networks, analytics trackers or content delivery networks. The dashboard loads nothing from anybody else.
Your service runs on servers in Finland, with backups in Germany — both inside the EEA. Some suppliers above are in the United States, so call content and message content do leave the UK and EEA in the course of providing the service. Each supplier's data processing terms include the UK International Data Transfer Addendum or the standard contractual clauses, and the UK–US Data Bridge where the supplier is certified under it.
Your dashboard uses one cookie: the one that keeps you logged in. It is there so you do not have to sign in again on every page. It is not used to follow you and it means nothing to any other website.
There are no tracking or advertising cookies anywhere in the service.
The marketing site sets no cookies at all. It also loads nothing from a third party — the fonts are served from our own server — so visiting it does not tell anyone else that you did.
Information is encrypted in transit. Access to the servers is by key only and restricted to a private network. Each business's records are isolated by the database itself, so one account cannot read another's even if the application asks it to.
Backups are encrypted in transit and at rest, and stored in a separate datacentre: every database dump is encrypted on this server before it is sent anywhere, so the copy held off-site cannot be read without a key that is not kept with it.
If you are a customer, you can ask us for a copy of your account information, to correct it, or to delete it when your account ends. You can export your calls from the dashboard at any time. Messages, appointments and WhatsApp conversations cannot yet be exported from the dashboard — ask us at privacy@bluemonkeyai.com and we will provide them within 30 days.
If you are a caller, ask the business you rang. They decide, and we act on their instruction.
The rights you have over your own information, in the usual words:
Ask at privacy@bluemonkeyai.com. We do not charge, and we will answer within one month.
If something goes wrong: in the event of a personal data breach affecting your information, we will tell affected customers without undue delay, with what we know and what we are doing about it — and we will notify the Information Commissioner's Office where the law requires it.
You can complain to the Information Commissioner's Office (ico.org.uk) at any time.
The receptionist says it is an AI assistant when it answers, and says so plainly if anybody asks.
A business in the EU or EEA cannot turn that greeting off. The EU AI Act requires a person to be told they are dealing with an AI system, so for those countries the setting is refused by the software rather than left to a choice. Elsewhere a business may turn the greeting off, and is responsible for whether doing so is lawful where it operates — the receptionist will still answer honestly if a caller asks directly.
The service is sold to businesses and is not directed at children. Callers are not age-verified, and a business whose callers are likely to be children should consider that before using it.
We will post changes here and update the date at the top. If a change materially affects how we handle information, we will tell customers by email.
privacy@bluemonkeyai.com
Bizitel Limited, Lilywood, Longage Hill, Rhodes Minnis, CT4 6XT, United Kingdom
Company number 06449529 · VAT GB929960082