Privacy Policy
Last updated: 16 September 2026
Requires review and approval by qualified legal counsel in the relevant jurisdictions before being presented as final contractual/legal documentation.
AgentLane ("we", "us", or "our") provides AI-powered communication automation services that marketing agencies resell to local businesses. This Privacy Policy explains how we collect, use, store, and protect personal data when you use our services, interact with our automations, or visit our website.
For the personal data of our business clients' customers, we act on behalf of others: normally as a sub-processor for the agency, which acts for the business (the controller). Where a business contracts with us directly, we are its processor. For agency partner accounts, billing and website visitors, we are the controller. The exact roles for each business are confirmed with the agency and recorded before an EU pilot.
For recipients in the United States, SMS communications are designed to align with the Telephone Consumer Protection Act (TCPA) and carrier 10DLC registration requirements.
1. Who We Are
Company: AgentLane Ltd Registered Address: 20 Wenlock Road, London, N1 7GU, United Kingdom Company Number: 17400209 (registered in England and Wales) Contact Email: contact@agentlane.agency
AgentLane Ltd is established in the United Kingdom, not in the EU. Whether we need an EU representative under Article 27 GDPR is under legal review.
2. What Data We Process
2.1 End-Customer Data (processed on behalf of our clients)
When a customer of one of our clients calls and misses the business, or texts it, we process:
- Phone numbers (caller ID / SMS sender)
- Message content (SMS text)
- Missed-call metadata (calling number, called number, call status, timestamps)
- Appointment details (requested dates, times, services), where given
- Names, if the customer provides them
- Contact preferences (opt-outs, do-not-contact entries and, where applicable, recorded consent to be called)
- Call audio, where the AI voice agent answers a call — streamed to our speech sub-processors during the call so it can understand the caller and reply
- Call metadata (call id, direction, start and end times, duration, outcome) and, only where the business has switched transcripts on, the text of what was said
- Voice call records: the Twilio call id, the partner and client the call belongs to, call status and timestamps, duration, and your phone number masked to its last 4 digits only. No audio and no transcript is kept in this record. Kept 90 days by default (a business can set 1–3650 days), then deleted by an automated nightly job. The call-minute count for the same call is kept afterward as usage history (see §5).
Call audio is not recorded in the current configuration — it exists only in transit to the speech provider. Call metadata is always kept. Transcript text is kept only where the business has enabled it; that is off by default, callers are told at the start of any call that is transcribed, and a caller who objects has that call kept as metadata only. Where transcripts are stored, they are deleted on the retention period the business sets (30 days by default).
If we introduce call recording in future it will be off by default, enabled only for a specific business on its written instruction, announced to the caller at the start of the call, and kept for a defined retention period. We will tell the agency in advance before that change takes effect.
The AI voice agent was deployed on 2026-09-20 and is in limited internal testing against a single AgentLane-operated test client; no end-customer calls have reached it. [ ] Counsel to review this section against the voice runtime as shipped before it is enabled for any production client.
Legal basis: determined by our client as controller.
2.2 Agency Partner Data
- Name and job title
- Business email address
- Company name and registration number
- Phone number
- Billing information (processed via Stripe)
- Communication history (emails, support chat)
Legal basis: Contractual necessity and legitimate interest (business relationship management).
2.3 Website Visitor Data
- Form submissions (name, email, company, message)
- With your consent only: analytics data collected by Google Analytics 4 (online identifiers, pages visited, device and browser information, referral source). See our Cookie Policy.
Legal basis: Legitimate interest (responding to enquiries, website security) and consent (analytics).
3. How We Use Your Data
3.1 End-Customer Data
We use this data solely to:
- Send and receive SMS messages on behalf of our clients
- Generate AI-powered replies using large language models
- Create appointments via integrated calendar systems
- Escalate enquiries to the business owner
- Produce performance reports for our agency partners
We do NOT use end-customer data to:
- Train our own AI models
- Sell or share with third parties for marketing
- Profile individuals for purposes unrelated to the client's business
3.2 Agency Partner Data
To manage partner accounts, bill fees, provide support, send service updates and meet legal obligations.
3.3 Website Visitor Data
To respond to enquiries, keep the website secure and, with consent, understand traffic.
4. Data Sharing and Sub-Processors
Our platform (application, database, job queue, object storage and automation engine) runs on one server in Frankfurt am Main, Germany. We are confirming this against the hosting contract. AI replies are the exception: they are generated on Google Cloud's Vertex AI global endpoint, which sends each request to a Google-selected region anywhere in the world, so message content used to generate an AI reply may be processed outside the EEA. We do not claim EU-only AI processing. We use the following third parties. The current register is published in our Compliance Center.
| Sub-Processor | Purpose | Location |
|---|---|---|
| VPS hosting provider | Hosting of all platform data | Germany (Frankfurt), to be confirmed against contract |
| Twilio | Phone numbers, missed-call detection, SMS | United States-headquartered |
| Google Cloud (Vertex AI) | AI replies — the active default AI provider (automations, voice, support chat) | Vertex AI's global endpoint — Google chooses the region, worldwide; no EU residency for AI inference |
| Anthropic | Emergency fallback only, on our platform key, if Google Cloud is unavailable — not used for a client's own key | United States-headquartered |
| OpenAI | AI replies (alternate provider) | United States-headquartered |
| Cal.com | Appointment booking (client's own account) | Depends on the client's account |
| Resend | Transactional and automation email | United States-headquartered |
| Stripe | Payments for agency partners | United States-headquartered |
| Slack | Internal operational alerts (no conversation content) | United States-headquartered |
| Google (Analytics 4) | Website analytics, only with consent | Google infrastructure |
Important notes:
- The workflow automation engine runs inside the AgentLane API on the server above. It is not a separate third party.
- Where an agency or client connects its own Twilio, Anthropic, OpenAI, Cal.com or Resend account, that provider processes the data under the agency's or client's own agreement.
- We do not currently claim that any AI provider applies zero data retention to our requests.
- New sub-processors: we will notify agency partners before a new sub-processor processes their data. This entry for Google Cloud (Vertex AI) was that notice, published before the platform was configured to send it any data. As of 22 September 2026, that configuration is live: default AI processing runs on Google Gemini on Vertex AI for every tenant, on Vertex's global endpoint — see §8 for what that means for where your data is processed. Anthropic is retained only as an emergency fallback on our own platform key; client Anthropic keys (BYOK) are retired and no longer used for inference.
5. Data Retention
| Data Category | Retention Period | How it is deleted |
|---|---|---|
| SMS and missed-call conversations | 12 months after last activity by default; agencies/clients can set 1–3650 days | Automated daily job |
| Voice call records (call id, party ids, status, timestamps, duration, caller number masked to last 4 digits — no audio, no transcript) | 90 days after the call by default; agencies/clients can set 1–3650 days | Automated nightly job (PurgeVoiceCallsJob); the aggregated call-minute usage record is kept afterward as usage history |
| Data export archives | 7 days | Automated |
| Closed accounts | Purged 30 days after an approved deletion request | Automated |
| Database backups | 14 days | Rotation |
| Support chat | 12 months (automated deletion being enabled) | Scheduled job, currently count-only |
| Appointment records in legacy home-services tables | Deleted when the client account is purged | Automated deletion on account purge only |
| Agency partner contract and billing data | Duration of contract + period required by tax law | Manual review |
| Website analytics | Per our Google Analytics retention setting |
These periods are safe defaults for our platform. Controllers remain responsible for deciding whether they meet their own legal obligations.
6. Your Rights Under GDPR
If you are a customer of one of our clients, the business you contacted is the controller. Please contact that business first. You can also email us and we will pass your request on.
- Access and portability: a copy of your data in a structured format.
- Rectification: correction of inaccurate data.
- Erasure: deletion of your data, unless a legal obligation requires retention.
- Restriction and objection: limiting or objecting to processing.
- Stopping texts: reply STOP to stop automated texts from that business's number. Text START to opt back in.
- Automated decisions: our automations qualify enquiries and propose appointments on behalf of businesses. You can ask the business for human review.
- AI transparency: where our clients use AI voice agents in the future, the agent will identify itself as an AI at the start of the call.
- Complaints: your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO).
We respond within one month.
7. Security Measures
- Encryption in transit: TLS on all public endpoints.
- Credential encryption: provider API keys and tokens are encrypted with AES-256-GCM before storage.
- Access control: role-based access with view-only agency roles. Two-factor authentication is available and strongly recommended, but not currently enforced.
- Tenant isolation: each agency and client can only access its own data.
- Audit logging: application-level actions (account, billing, credential, compliance and admin changes) are logged. This does not cover raw database-level access.
- Network: only SSH, HTTP and HTTPS are exposed publicly.
- Incident response: we notify affected agency partners without undue delay after becoming aware of a personal data breach. The partner or business, as controller, handles regulatory and customer notification where required.
8. International Data Transfers
Platform data is stored in Germany: the application, database, job queue, object storage and backups are all on the Frankfurt server described in §4. Some sub-processors are headquartered in the United States (Twilio, Anthropic, OpenAI, Resend, Stripe, Slack).
AI replies leave the EEA. We generate them with Google's Gemini models on Vertex AI's global endpoint, which routes each request to a region Google selects — anywhere in the world, not necessarily the EU. We use the global endpoint because the Gemini models we run are served only there; Google's EU single-region endpoints serve only an older model generation. Message content and business context sent for an AI reply must therefore be assumed to be transferred outside the EEA/UK. Google Analytics likewise processes data on Google infrastructure with no region configured.
For Google Cloud we propose to rely on the Google Cloud Data Processing Addendum together with Standard Contractual Clauses; that has not yet been executed or verified. The transfer mechanism for each of the other providers (for example Standard Contractual Clauses or the EU-US Data Privacy Framework) is being confirmed as part of our legal review. Until that review is complete, we do not represent any particular mechanism as in place.
9. Children's Privacy
Our services are not directed at children under 16. We do not knowingly process data from children. Contact us if you believe we have.
10. Changes to This Policy
We will notify agency partners of material changes by email. The latest version is always at agentlane.agency/privacy.
11. Contact Us
Email: contact@agentlane.agency Postal address: AgentLane Ltd, 20 Wenlock Road, London, N1 7GU, United Kingdom (Company No. 17400209)
Our Data Processing Agreement is pending legal finalization. Agencies can request the current draft by email.
This Privacy Policy does not constitute legal advice.