Privacy Policy

FLUIS.ai is a sole trader business based in the United Kingdom.

We are the data controller for personal data we collect about visitors to this website, prospects, and end-users of our public-facing demos (e.g. the voice widget on this page).

When we deliver paid services to a client business, we typically act as a data processor for the personal data that client uploads into our systems (e.g. the contacts our voice agent or AI chat books on the client's behalf). The client remains the data controller for that data. Our Data Processing Agreement (DPA), available on request, sets out the controller-processor terms.

We collect only what we need to deliver the service you asked for or to operate our business responsibly. The table below maps each category of personal data we may hold to its purpose.

Under Article 6 of the UK GDPR, every processing activity needs a lawful basis. For each category of activity above, ours are:

For special category data (e.g. health information, biometric data), we additionally rely on Article 9. We do not currently process voice as biometric data for speaker identification — see §5.

Our voice and chat agents are powered by large language models ("LLMs") supplied by third-party AI providers. Your conversation with our agent is transmitted to the LLM provider so it can generate a response.

The LLM provider(s) we currently use:

• AI / LLM providers including Anthropic (Claude), OpenAI (GPT), and the LLM infrastructure bundled with GoHighLevel, depending on the specific feature. We will update this list as the stack changes.

Training data posture: we require, by contract with our LLM providers, that your conversation data is not used to train their public models. For paid Anthropic and OpenAI APIs this is the default contractual position. For GoHighLevel-routed AI features we rely on the LeadConnector / GHL terms, which prohibit such training without consent.

Automated decision-making + profiling (Article 22): our AI agents are conversational and assistive. They do not make decisions that have legal or similarly significant effects on you without a human in the loop. For example, the agent may qualify a lead or suggest a booking time — a human at your business confirms the booking. If we ever introduce a feature that does involve solely automated decision-making with legal effect, we will obtain your explicit consent and disclose it here first.

Output accuracy: AI-generated content (transcripts, summaries, recommendations) can be incomplete or wrong. We provide it as-is and require clients to keep a human in the loop for any decision that depends on it. See §7 of our Terms & Conditions.

When you talk to our voice agent on this site, or call a phone number that routes through our voice agent on a client's system, your conversation is recorded.

• Encrypted in transit and at rest. Recordings and transcripts are encrypted while travelling between systems and while stored.
• Access is limited. Only your team (if you're a client) and our internal tuning engineer have access to transcripts. We do not sell, share, or otherwise disclose recordings to third parties beyond the sub-processors named in §6.
• Auto-deletion after 90 days unless you (or our client whose agent you spoke to) explicitly elect to retain them for longer. Production retention is configurable per client; the default is 90 days.
• No voiceprint / biometric identification. We process voice as audio for the purpose of conversation. We do not extract a voiceprint or use the recording to identify you biometrically. If this changes, we will obtain your explicit consent and complete a Data Protection Impact Assessment first.
• UK call-recording disclosure. Under UK PECR, we and our clients must tell you that the call is being recorded and why. The voice agent does this at the start of the conversation.
• HIPAA-compatible setup is available as a configuration option for medical clients on appropriate contracts. It is not the default. If your industry requires HIPAA, BAA, or other healthcare-grade controls, contact us before going live.

We share your personal data with third-party service providers ("sub-processors") only as needed to deliver the service. Each is contractually required to protect your data to UK GDPR standards. The current list:

We do not currently use Google Analytics, Mixpanel, Segment, advertising pixels, or third-party retargeting tools on fluis.ai. If we add any in future, we will update this policy and (where required) add a cookie consent banner before activation.

Some of our sub-processors are based in the United States, including GoHighLevel, LiveKit, and (depending on configuration) our LLM provider. When personal data is transferred outside the UK / EEA, we rely on one or more of the following transfer mechanisms required by UK GDPR Chapter V:

• The UK Extension to the EU–US Data Privacy Framework for transfers to US-based recipients certified under the framework.
• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses for any transfer not covered by the framework.
• Supplementary measures where the risk assessment indicates the legal framework alone is not sufficient — typically encryption in transit and at rest, access logging, and contractual restrictions on government access requests.

We complete an internal Transfer Risk Assessment ("TRA") for each US transfer involving personal data and update it when sub-processors change. The current TRA is available on request to privacy@fluis.ai.

We keep personal data only as long as we need it for the purpose it was collected, or as long as we are legally required to. Specifically:

Where data is anonymised rather than deleted, the anonymisation is irreversible and the resulting data is no longer personal data under the UK GDPR.

You have eight specific rights under the UK GDPR:

• The right to be informed — about how we use your data (this policy).
• The right of access — to a copy of the personal data we hold about you (a "Subject Access Request" or "SAR").
• The right to rectification — to correct inaccurate or incomplete data.
• The right to erasure — to ask us to delete your data ("right to be forgotten"). Some exceptions apply for data we are legally required to keep (e.g. billing records).
• The right to restrict processing — to ask us to pause processing while a dispute is resolved.
• The right to data portability — to receive your data in a structured, machine-readable format and have it transmitted to another controller.
• The right to object — to processing based on legitimate interests, and to direct marketing at any time.
• Rights related to automated decision-making + profiling — see §4 for our current stance.

How to exercise these rights: email privacy@fluis.ai with a short description of what you want. We will reply within 30 days (extendable by a further 60 days for complex requests, with a written explanation).

Identity verification. For requests other than basic enquiries, we may ask you to confirm your identity to make sure we don't disclose data to the wrong person. We will ask for the minimum information needed.

Fees. Most rights are exercised free of charge. We reserve the right to charge a reasonable administrative fee or refuse to act on requests that are manifestly unfounded or excessive (e.g. repetitive). If we do, we will tell you why in writing.

This website does not currently set any analytics, advertising, or marketing cookies. The only cookies and equivalent technologies we use are strictly necessary for the site to function — for example, a session identifier for the voice widget so it can resume a conversation if you reload the page.

Strictly necessary cookies do not require your consent under PECR. They are not used to track you across sites or to build a profile of your interests.

If we introduce non-essential cookies in future (e.g. for analytics or marketing measurement), we will display a consent banner the first time you visit, and only set those cookies if you explicitly opt in. You will always be able to change your mind via a "Cookie preferences" link in the footer.

Note that the embedded GoHighLevel booking calendar (loaded inside an iframe on our Contact page) and the GHL form-embed script may set their own cookies in your browser when you interact with them. Those are operated by GoHighLevel; their privacy policy applies to that interaction.

We may update this Privacy Policy from time to time as our services, sub-processors, or the law evolve. The Last updated date at the top of this page shows when the current version came into effect.

If we make a material change — for example, adding a new sub-processor in a non-adequate country, changing the lawful basis for a major processing activity, or introducing solely automated decision-making with legal effect — we will give you advance notice: typically by email to active customers, and by a visible banner on this site for at least 30 days. We will keep an archived copy of the previous version available on request.

If you believe we have not handled your personal data lawfully, please contact us first at privacy@fluis.ai so we have a chance to put things right.

You also have the right at any time to lodge a complaint with the UK supervisory authority: