Ringby
ProductPricingResourcesAbout
LEGAL

Privacy Policy

Last updated: 16 September 2026

1. Who We Are

Ringby ("we", "our", "us") provides calling software and managed communication services for UK businesses. We are registered with the Information Commissioner's Office (ICO). If you have any questions about this policy, contact us at privacy@ringby.co.uk.

2. What Data We Collect

We collect the following categories of personal data:

  • Identity and Contact Data. Name, email address, phone number, business name, job role.
  • Call Recordings, Transcripts and AI Summaries. When your calling workspace has recording enabled (the default), calls are recorded with a spoken notice to the other party: outbound auto-recordings announce on answer, inbound callers hear a notice before connection, and manual-consent campaigns record only after verbal permission on the live call. Recordings are transcribed with speaker labels and personal details redacted, then summarised. Storage honours the 90-day retention window below.
  • Account Data. Username, password (hashed), preferences, subscription tier, payment history.
  • Usage Data. Pages visited, features used, time spent, and error reports; device type, browser and IP address for security and abuse prevention. No session recordings or heatmaps are collected.
  • Payment Data. Seat checkout and the billing portal run on Stripe-hosted pages. Card details go directly to Stripe and never touch our servers. We keep plan, seat count, subscription status, and invoicing contact details (name, email, billing address) for accounts purposes only.

3. How We Collect Your Data

  • Direct interactions. You provide data when you fill in forms, create an account, contact us, or use our services.
  • Automated technologies. We collect usage data through cookies and similar tracking technologies as described in our Cookie Policy.
  • Third parties. We receive data from Clerk (authentication), Twilio (call routing and telephony), AssemblyAI (call transcription and summaries, EU region), HubSpot (contact data you connect), Google Sheets (contact lists you connect), Stripe (checkout and subscription events), and our analytics and infrastructure providers (Vercel, Sentry, Upstash).

4. Lawful Basis for Processing

We process your personal data under the following lawful bases:

  • Contract performance. To provide our services to you, including account management, call handling, and support.
  • Legitimate interests. To improve our services, prevent fraud, send service-related communications, and analyse usage patterns.
  • Consent. For marketing communications, optional analytics cookies, and call recording where required.
  • Legal obligation. To comply with applicable laws and regulatory obligations.

5. How We Use Your Data

  • To provide, maintain, and improve our calling workspace and related services.
  • To process your subscription billing through Stripe Checkout and the billing portal.
  • To communicate with you about your account, billing, and service updates.
  • To respond to your enquiries and provide customer support.
  • We do not train models on your data. Transcription and summaries run per-call on EU infrastructure and nothing is retained for model improvement.
  • To detect and prevent fraud, abuse, or violations of our Terms of Service.
  • To comply with legal and regulatory obligations.

6. Who We Share Your Data With

We share personal data only with service providers who need it to deliver our service. Where possible, we use providers based in the UK or EU. Where providers operate outside the UK or EEA, we ensure appropriate safeguards are in place (see Section 7).

  • Clerk. Authentication and user management (US). Clerk Privacy Policy
  • Twilio. Telephony, call routing, recording and SMS for your calling workspace (US). Call metadata is processed through Twilio's infrastructure; recordings are pinned to Twilio's EU region. Twilio Privacy Policy
  • Neon (Postgres). Database hosting for account and service data (UK, London). Your data is stored in the UK. Neon Privacy Policy
  • Vercel. Hosting and infrastructure for the Ringby platform, plus Vercel Web Analytics (cookieless page-view counting) and Speed Insights (Web Vitals performance measurement) on our marketing site (US/EU). Vercel Privacy Policy
  • Cloudflare. CDN, DDoS protection, and Turnstile bot protection (global edge network). Cloudflare processes IP addresses and browser fingerprint data to verify human visitors. Cloudflare Privacy Policy
  • AssemblyAI. Post-call transcription and summaries (EU region only). Call audio is transcribed with speaker labels and personal details redacted; audio and transcripts never leave the EU on this path, and nothing is used to train models. AssemblyAI Privacy Policy
  • Resend. Transactional email delivery (UK). Email notifications and service communications are processed in the UK. Resend Privacy Policy
  • Google Workspace. Email hosting and internal collaboration tools (US/EU). Google Privacy Policy
  • HubSpot. CRM contact import and per-call logging, only when you connect it (US). HubSpot Privacy Policy
  • Stripe. Seat checkout, billing portal, and subscription webhooks (US). Card details go directly to Stripe and never touch our servers. Stripe Privacy Policy
  • Sentry. Error tracking for our website and dashboard (US/EU). Captures error reports with request context; session replay is disabled. Only active when configured; no advertising use. Sentry Privacy Policy
  • Upstash (Redis). Rate limiting and abuse prevention (US). Processes request metadata (such as IP-derived rate-limit keys) to enforce per-user ceilings on mutating routes. Upstash Privacy Policy

We do not sell your personal data to third parties.

7. International Data Transfers

We use a mix of UK, EU, and US-based service providers. Wherever possible, we choose UK-based providers (for example, Neon hosts data in London, Resend processes emails in the UK). However, some essential services require data to be transferred outside the UK and European Economic Area (EEA):

  • US-based providers: Clerk, Twilio, Vercel, Stripe, Sentry, Upstash, and Google Workspace process data in the United States.
  • Global providers: Cloudflare operates a global edge network and data may be processed in various locations.

When we transfer your personal data outside the UK or EEA, we ensure appropriate safeguards are in place. For UK transfers, this includes the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as approved by the Information Commissioner's Office. For EU transfers, we use the EU Standard Contractual Clauses (2021) approved by the European Commission. We also conduct Transfer Impact Assessments where required to ensure an equivalent level of protection.

If you would like more information about the safeguards in place for your data, please contact us at privacy@ringby.co.uk.

8. Data Retention

  • Account data. Retained for the duration of your account plus 12 months after cancellation, unless you request earlier deletion.
  • Call recordings, transcripts and AI summaries. Retained for 90 days after the call and then deleted (audio on our provider, text in our database). Contact us if your workspace needs a different window. No retained material is used to train models.
  • Usage data. Retained in anonymised form indefinitely for analytics and service improvement.
  • Payment data. Card details are held by Stripe under its own retention; we keep subscription records (plan, seats, status) and invoices only as long as required by HMRC and financial regulations (typically 6 years).

9. Your Data Protection Rights

Under UK GDPR and the Data Protection Act 2018, you have the following rights:

  • Right to be informed. What data we collect and how we use it (this policy).
  • Right of access. Request a copy of the personal data we hold about you.
  • Right to rectification. Correct inaccurate or incomplete data.
  • Right to erasure ("right to be forgotten"). Request deletion of your data.
  • Right to restrict processing. Limit how we use your data in certain circumstances.
  • Right to data portability. Receive your data in a structured, machine-readable format.
  • Right to object. Object to processing based on legitimate interests or direct marketing.
  • Rights related to automated decision-making. Including profiling.

To exercise any of these rights, email privacy@ringby.co.uk. We will respond within one month. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption at rest and in transit, access controls, regular security assessments, and staff training. Checkout and card handling run on Stripe-hosted pages; card details never touch our servers.

11. Call Recording

Calls made through Ringby may be recorded and transcribed for quality assurance, training, dispute resolution and service improvement. Our lawful basis is legitimate interests, balanced against participants' rights, and we tell participants calls may be recorded: campaigns play a recording notice by default, which you should keep enabled for UK compliance. Disable only if you have an alternative lawful basis and privacy notice covering call recording.

Recordings are retained for 90 days and then deleted automatically, sooner on request. Transcripts are generated with speaker labels and personal details redacted, processed in the EU only, and never used to train models. Processors: Twilio (telephony; recordings pinned to its EU region) and AssemblyAI (transcription and summaries, EU region only), each under data processing terms. If you use Ringby to call people, you are responsible for having your own lawful basis, screening lists against TPS/CTPS, honouring opt-outs (including our account do-not-call list), and complying with telemarketing rules that apply to you (UK PECR/TPS, US TCPA and state laws, EU member-state rules).

AI transparency. Transcripts, speaker labels and summaries are produced by automated systems (AssemblyAI, EU region only) and may contain errors. Always check the recording or transcript before relying on a summary. Speaker labels only separate voices (Speaker A/B); Ringby performs no biometric identification, no emotion recognition, and no solely automated decision-making about any individual. Your reps review outputs and make every decision, so GDPR Article 22 does not arise. Nothing is used to train models. This limited, human-reviewed use is not a high-risk AI system under the EU AI Act; the transparency duties that do apply are met by the recording notice, this policy, and your own privacy notices to callees.

You can request deletion of specific recordings, or exercise any data right, by contacting us at privacy@ringby.co.uk.

12. Children's Data

Our services are intended for businesses and individuals aged 18 and over. We do not knowingly collect data from children under 13. If we become aware that a child has provided us with personal data, we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email to account holders and via a notice on our website. We encourage you to review this policy periodically.

13A. Agencies, Resellers and End Clients

If you use Ringby to run outbound calling for your own clients, this section applies on top of everything above.

  • You are the controller of your own workspace data. We are your processor.
  • For each end client whose campaigns you run, that client is the controller, you are their processor, and we are your sub-processor. You must have a written agreement with that client authorising us to process their data on your instructions.
  • We process end-client personal data only on your documented instructions, and only to provide the Service to you. We do not use it to train models, and we do not use one end client's data for another.
  • Regulatory verification for each end client is a legal declaration you make to our telephony provider. We store the details you submit encrypted, and the identity documents themselves are transferred directly to that provider and never stored by us.
  • If you terminate an end client's engagement, delete the client in Ringby and we delete its data on the same schedule as the rest of your workspace. You remain responsible for instructing us where an end client requires earlier deletion.
  • Contact us at the address below before adding an end client if you need a data processing agreement signed with us directly in that client's name.

14. Contact Us

Data controller: Ringby UK
Email: privacy@ringby.co.uk
ICO registration number: ZB879491 (registered with the Information Commissioner's Office)