Ansela / Data processing terms

Data processing terms

Last updated: 11 October 2026.

These terms cover the personal data Ansela handles for your business: your callers’ details, call recordings, transcripts, voicemails and text messages. They form part of our terms of service and apply automatically when you subscribe.

They’re written to meet Article 28 of the UK GDPR. If they conflict with the terms of service on how personal data is handled, these terms win.

1. Who’s who

• You, the business, are the controller of the personal data Ansela processes for you.
• We, Bookeasy.ai Ltd, trading as Ansela, are your processor. Ansela is a trading name of Bookeasy.ai Ltd, a company registered in England and Wales with company number 15411906. Our registered office is 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. Our VAT number is GB 464 9305 71.
• Words like “personal data”, “processing”, “controller”, “processor” and “personal data breach” mean what they mean in the UK GDPR and the Data Protection Act 2018.

2. What we process for you

• Why. To answer your calls, record and transcribe them, write summaries, book appointments, take messages and voicemails, pass calls on, send text messages you ask for, and store all of this for you to see.
• Whose data. People who call your Ansela number, your customers and contacts, and any of your staff whose details you add.
• What data. Phone numbers; names, addresses and other contact details; what callers say, as recordings (including their voice), transcripts and summaries; voicemails; appointment details; text messages; and anything else callers choose to tell Ansela. Callers may mention health or other special category data. Ansela isn’t built to collect it, and you mustn’t set her up to ask for it unless you have a lawful condition for doing so.
• How long. For as long as your subscription runs, and then until we delete the data as set out in section 9.

3. Your instructions

We process this data only on your documented instructions. Your instructions are these terms, the terms of service, and the settings and choices you make in Ansela. If the law makes us process the data in another way, we’ll tell you first, unless the law forbids that. If we think an instruction breaks data protection law, we’ll tell you.

We don’t use your callers’ personal data for our own purposes. We don’t sell it, and we don’t use it to train AI models, ours or anyone else’s.

4. Our people

Everyone at Bookeasy.ai Ltd who can access this data is bound to keep it confidential, and only those who need access to run or support the service get it.

5. Security

We keep the data secure with technical and organisational measures that fit the risk. They include:

• encryption in transit and at rest;
• each business’s data kept separate in our database, enforced at database level;
• access limited to the people who need it, with sign-in protection;
• call recordings moved off our carrier’s systems after each call and kept in our own storage in the UK;
• recordings and transcripts deleted automatically when their retention period ends, 90 days by default;
• monitoring and error reporting, so we spot problems quickly.

6. Sub-processors

You give us general permission to use the sub-processors below. We have a written contract with each one that requires it to protect the data, and we stay responsible to you for what they do.

• Microsoft Azure. Hosting, the database, and storage for call recordings and transcripts. Where: UK (UK South).
• Microsoft Azure AI Foundry. The AI models, run by Microsoft, that hold the conversation, understand what callers say and write call summaries. Where: Our Azure AI resource is in Sweden (EU). Microsoft may process requests in other regions where it runs these models. Where it does, UK-approved safeguards apply.
• Twilio. Phone numbers, carrying calls, recording calls, voicemail and text messages. After a call the recording is moved to our Azure storage and deleted from Twilio. Where: US, with a global network.
• ElevenLabs. Turning callers’ speech into text, and Ansela’s voice. Where: US.
• TypeSafe. An AI service that reads what is said during a call to check some of what callers mean, for example which appointment time they picked. We’re asking TypeSafe to agree to keep none of this data. Until that’s agreed, it may keep what it receives in line with its own terms. We’ll update this page when that changes. Where: US.
• Stripe. Subscriptions, invoices and card payments. Where: US and Ireland.
• Clerk. Sign-in and account security for business users. Where: US.
• Resend. Account and service emails, such as call summaries and minute warnings. Where: US.
• Sentry. Error reports, so we can find and fix faults. Where: EU (Germany).
• Cloudflare. Hosting this website, and the bot check on the sign-up page. Where: Global network.

We’ll tell you by email at least 30 days before we add or replace a sub-processor. If you object on reasonable data protection grounds, tell us. If we can’t resolve it, you can cancel before the change takes effect.

7. Where the data is, and transfers outside the UK

We store your callers’ data, including recordings and transcripts, in the UK (Microsoft Azure, UK South). Some sub-processors handle data outside the UK, mainly in the US and the EU, as the list above shows. We only transfer data where UK law allows it: to a country covered by UK adequacy regulations, to a US company certified under the UK extension to the EU-US Data Privacy Framework, or under the ICO’s International Data Transfer Agreement or Addendum.

8. Helping you

• Requests from people. If a caller asks us to see, correct or delete their data, we’ll pass the request to you and won’t answer it ourselves unless you ask us to. You can find and review calls in Ansela. Where you need more, such as a copy of a recording or a deletion, we’ll help.
• Breaches. If we become aware of a personal data breach affecting your data, we’ll tell you without undue delay, and we aim to do so within 48 hours. We’ll give you what we know and keep you updated, so you can decide whether to report it to the ICO or tell the people affected.
• Assessments. We’ll give you reasonable help with data protection impact assessments and any consultation with the ICO, using the information we have.

9. When your subscription ends

Until your subscription ends, you can see and export your data. If you want a copy of anything before it ends, ask us and we’ll help. After it ends, we delete or anonymise your callers’ personal data within six months, unless you ask us to delete it sooner or the law requires us to keep it. In the meantime, recordings and transcripts are still deleted on their normal schedule.

10. Showing we comply

We’ll give you the information you reasonably need to show we meet these terms. If that isn’t enough, you or an auditor bound by confidentiality can audit us once a year, at your cost, with 30 days’ notice, in a way that doesn’t disrupt the service or expose other customers’ data. We’ll also cooperate with the ICO.

11. Your duties

• You must have a lawful basis for the processing you ask us to do, and give callers the information the law requires, including that calls are recorded and that an AI receptionist answers.
• Your instructions must be lawful.
• If the default 90-day retention for recordings and transcripts doesn’t suit your business or the law that applies to you, ask us to change it.

12. Liability

Each side’s liability under these terms is subject to the limits in the terms of service.

Contact

Email [email protected] about anything in these terms.