Privacy Policy

fluis.ai is a sole trader business based in the United Kingdom.

We are the data controller for personal data we collect about visitors to this website and prospects who book a call with us.

When we deliver paid services to a client business, we typically act as a data processor for the personal data that client uploads into our systems (e.g. the contacts our AI Receptionist (Voice) or AI chat books on the client's behalf). The client remains the data controller for that data. Our Data Processing Agreement (DPA), available on request, sets out the controller-processor terms.

We collect only what we need to deliver the service you asked for or to operate our business responsibly. The table below maps each category of personal data we may hold to its purpose.

Under Article 6 of the UK GDPR, every processing activity needs a lawful basis. For each category of activity above, ours are:

For special category data (e.g. health information, biometric data), we additionally rely on Article 9. We do not currently process voice as biometric data for speaker identification — see §5.

Our AI Receptionists (Voice and Chat) are powered by large language models ("LLMs") supplied by third-party AI providers. Your conversation with our agent is transmitted to the LLM provider so it can generate a response.

The LLM provider(s) we currently use:

• AI / LLM providers including Anthropic (Claude), OpenAI (GPT), and the LLM infrastructure bundled with GoHighLevel, depending on the specific feature. We will update this list as the stack changes.

Training data posture: we require, by contract with our LLM providers, that your conversation data is not used to train their public models. For paid Anthropic and OpenAI APIs this is the default contractual position. For GoHighLevel-routed AI features we rely on the LeadConnector / GHL terms, which prohibit such training without consent.

Automated decision-making + profiling (Article 22): our AI agents are conversational and assistive. They do not make decisions that have legal or similarly significant effects on you without a human in the loop. For example, the agent may qualify a lead or suggest a booking time — a human at your business confirms the booking. If we ever introduce a feature that does involve solely automated decision-making with legal effect, we will obtain your explicit consent and disclose it here first.

Output accuracy: AI-generated content (transcripts, summaries, recommendations) can be incomplete or wrong. We provide it as-is and require clients to keep a human in the loop for any decision that depends on it. See §7 of our Terms & Conditions.

When you call a phone number that routes through an AI Receptionist (Voice) we run on a client's system, your conversation is recorded.

• Encrypted in transit and at rest. Recordings and transcripts are encrypted while travelling between systems and while stored.
• Access is limited. Only your team (if you're a client) and our internal tuning engineer have access to transcripts. We do not sell, share, or otherwise disclose recordings to third parties beyond the sub-processors named in §6.
• Auto-deletion after 90 days unless you (or our client whose agent you spoke to) explicitly elect to retain them for longer. Production retention is configurable per client; the default is 90 days.
• No voiceprint / biometric identification. We process voice as audio for the purpose of conversation. We do not extract a voiceprint or use the recording to identify you biometrically. If this changes, we will obtain your explicit consent and complete a Data Protection Impact Assessment first.
• UK call-recording disclosure. Under UK PECR, we and our clients must tell you that the call is being recorded and why. The AI Receptionist (Voice) does this at the start of the conversation.
• HIPAA-compatible setup is available as a configuration option for medical clients on appropriate contracts. It is not the default. If your industry requires HIPAA, BAA, or other healthcare-grade controls, contact us before going live.

We share your personal data with third-party service providers ("sub-processors") only as needed to deliver the service. Each is contractually required to protect your data to UK GDPR standards. The current list:

The Google and Meta entries above are the only analytics or advertising recipients we use, and both are strictly conditional on your consent. We do not use Mixpanel, Segment, session-recording or heatmap tools, or any other third-party retargeting network on fluis.ai. If we add one, we will update this policy and this table before it goes live.

Some of our sub-processors are based in the United States, including GoHighLevel and (depending on configuration) our LLM provider. Where you have consented to analytics or advertising cookies, Google and Meta are added to that list — both contract through their Irish entities but transfer onward to the United States. If you decline those cookies, no transfer to Google or Meta takes place at all.

• The UK Extension to the EU–US Data Privacy Framework for transfers to US-based recipients certified under the framework.
• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses for any transfer not covered by the framework.
• Supplementary measures where the risk assessment indicates the legal framework alone is not sufficient — typically encryption in transit and at rest, access logging, and contractual restrictions on government access requests.

We complete an internal Transfer Risk Assessment ("TRA") for each US transfer involving personal data and update it when sub-processors change. The current TRA is available on request to privacy@fluis.ai.

We keep personal data only as long as we need it for the purpose it was collected, or as long as we are legally required to. Specifically:

Where data is anonymised rather than deleted, the anonymisation is irreversible and the resulting data is no longer personal data under the UK GDPR.

You have eight specific rights under the UK GDPR:

• The right to be informed — about how we use your data (this policy).
• The right of access — to a copy of the personal data we hold about you (a "Subject Access Request" or "SAR").
• The right to rectification — to correct inaccurate or incomplete data.
• The right to erasure — to ask us to delete your data ("right to be forgotten"). Some exceptions apply for data we are legally required to keep (e.g. billing records).
• The right to restrict processing — to ask us to pause processing while a dispute is resolved.
• The right to data portability — to receive your data in a structured, machine-readable format and have it transmitted to another controller.
• The right to object — to processing based on legitimate interests, and to direct marketing at any time.
• Rights related to automated decision-making + profiling — see §4 for our current stance.

How to exercise these rights: email privacy@fluis.ai with a short description of what you want. We will reply within 30 days (extendable by a further 60 days for complex requests, with a written explanation).

Identity verification. For requests other than basic enquiries, we may ask you to confirm your identity to make sure we don't disclose data to the wrong person. We will ask for the minimum information needed.

Fees. Most rights are exercised free of charge. We reserve the right to charge a reasonable administrative fee or refuse to act on requests that are manifestly unfounded or excessive (e.g. repetitive). If we do, we will tell you why in writing.

We use two kinds of cookie on this site: a small number that are strictly necessary for it to work, and — only if you opt in — analytics and advertising cookies. Nothing in the second group is set until you choose "Accept all" or enable that category in "Cookie preferences". If you decline, the relevant scripts are never even downloaded.

Strictly necessary cookies do not require your consent under PECR. They are not used to track you across sites or to build a profile of your interests.

Changing your mind. Select "Cookie preferences" in the footer of any page to review or withdraw your consent. Withdrawing is as easy as giving it: we clear the analytics and advertising cookies we can reach and reload the page so the tags stop running. Refusing or withdrawing costs you no functionality anywhere on this site.

We also honour the Global Privacy Control signal. If your browser sends GPC, we treat it as a refusal of analytics and advertising cookies and do not show you the banner at all — though you can still opt in later from "Cookie preferences" if you want to.

The booking calendar. Our Contact page embeds a GoHighLevel booking calendar inside an iframe, and a GoHighLevel script that resizes it. These are strictly necessary to offer online booking, but GoHighLevel may set its own cookies in your browser when the calendar loads. Those cookies are outside the categories above because they are set by GoHighLevel as a third party, not by us; their privacy policy governs what they do with them. We are reviewing this embed so that it too loads only on interaction. If you would rather not load it at all, email hello@fluis.ai and we will book you in by hand.

We may update this Privacy Policy from time to time as our services, sub-processors, or the law evolve. The Last updated date at the top of this page shows when the current version came into effect.

If we make a material change — for example, adding a new sub-processor in a non-adequate country, changing the lawful basis for a major processing activity, or introducing solely automated decision-making with legal effect — we will give you advance notice: typically by email to active customers, and by a visible banner on this site for at least 30 days. We will keep an archived copy of the previous version available on request.

If you believe we have not handled your personal data lawfully, please contact us first at privacy@fluis.ai so we have a chance to put things right.

You also have the right at any time to lodge a complaint with the UK supervisory authority: