Privacy policy
Last updated 10 October 2026
This policy explains how Tilly uses personal data: what we collect, why, who we share it with, how long we keep it and the rights you have. It covers visitors to tillyanswers.co.uk, people who try our demonstrations, our customers and their teams, and anyone who contacts us. If you called a business and Tilly answered, read section 2 first.
1. Who we are
We are [company name], a company registered in England and Wales with company number [number], whose registered office is at [address], trading as Tilly. We are the controller of the personal data described in this policy, except where section 2 says otherwise. We are registered with the Information Commission (the UK data protection regulator, known as the ICO) under number [ICO registration number].
You can contact us about anything in this policy at hello@tillyanswers.co.uk or by post at [registered office address]. We have not appointed a data protection officer, as the law does not require one for a business like ours; the same email address reaches the person responsible.
2. If you called a business that uses Tilly
Businesses use Tilly to answer their phones. When you call one of them, the business decides how your information is used and is the controller of it. We handle your call for the business, as its processor, under a contract that only lets us use your information to provide our service to that business.
What happens on the call:
- the call is answered by an AI receptionist, which normally tells you at the start that calls are recorded;
- the call is recorded and turned into text, and the AI uses what you say to answer you, take a message or book an appointment;
- the business receives a summary, the transcript and any message or booking, by email, text message or WhatsApp, and can listen to the recording;
- the recording, and our voice provider's copy of the transcript, are deleted 90 days after the call. The business keeps its own record of the call for as long as it uses Tilly, and we delete it 90 days after the business stops using us.
For anything about your information, including to see it or have it deleted, please contact the business you called and read its own privacy notice. If you contact us, we will pass your request to the business.
3. What we collect, why, and our lawful basis
| Whose data | What we collect | Why | Lawful basis |
|---|---|---|---|
| Website visitors | Internet address, browser and device details, the pages you ask for | To run the website, keep it secure and find faults | Our legitimate interests in running a secure website |
| Website visitors who allow analytics cookies | How you use the site, through the tools listed in our cookie policy | To understand how the site is used and improve it | Your consent, which you can withdraw at any time |
| Website visitors who allow marketing cookies | Which of our adverts brought you here, and your visit, through the tools listed in our cookie policy | To measure our advertising and show our adverts to people who have visited | Your consent, which you can withdraw at any time |
| People who try the live demo | Your voice, the recording and transcript of the call, and anything you say during it (we ask you to make up any names and numbers) | To let you talk to a demonstration receptionist and show you what a business would receive | Our legitimate interests in showing how Tilly works, at your request |
| People who try voices on the demo page | The business name you type, and the audio we make from it | To let you hear your business name in different voices | Our legitimate interests, at your request |
| People who ask for a copy of a demo call, or contact us | Your name, email address, phone number, business name and message | To send what you asked for and reply to you | Our legitimate interests in answering enquiries, or taking steps you asked for before a contract |
| People who agree to hear from us after a demo | Your email address and the fact that you agreed | To email you about Tilly | Your consent |
| Customers | Your name, business name, email address, mobile number, website, town, and the details you enter about your business | To set up and provide the service, and to contact you about your account | Our contract with you |
| Customers' team members | Name, email address and role, given to us by the account owner who invited you | To give you access to the account | Our legitimate interests in providing the service the business asked for |
| Customers | Plan, payments, invoices and the details needed for them (Stripe handles your card; we never see the full number) | To bill you and keep accounting records | Our contract with you, and our legal obligation to keep tax records |
| Customers | What you agreed to at checkout (which versions of our terms), when, your internet address and browser | To have a record of our contract | Our legitimate interests in being able to show what was agreed, and to defend legal claims |
| Customers | Sign-in records, sessions and a log of important account actions | To keep accounts secure and prevent fraud | Our legitimate interests in keeping the service secure |
| Customers | Your email address, to send tips, product news and offers about Tilly | To tell you about our service | Our legitimate interests in marketing our own similar services to customers (you can opt out at checkout and in every email) |
| Customers who allow marketing cookies | Your sign-up, with your email address and phone number in scrambled (hashed) form, and the advert you clicked | To tell Google, Meta and Microsoft that one of their adverts led to a sign-up (for Google, "enhanced conversions" and "offline conversion import") | Your consent through the cookie banner |
| Customers who tick the box at checkout | Your email address in scrambled (hashed) form | To measure and tailor our adverts on Google and Meta, for example so we do not show adverts to existing customers (Google "Customer Match") | Your consent, which you can withdraw at any time |
| Customers who use website or document reading (Pro and Business) | The website address or documents you give us, and what we draft from them | To fill in your receptionist's answers for you | Our contract with you |
You do not have to give us personal data, but without your name, email address and payment details we cannot provide the service.
4. Advertising and the data we share with ad platforms
We advertise Tilly on Google and may advertise on Meta (Facebook and Instagram), Microsoft (Bing) and LinkedIn. We only use their tags on our website if you allow marketing cookies in our cookie banner, and nothing is loaded before you choose.
If you allow marketing cookies and then sign up, we tell the ad platform about your sign-up so it can work out which adverts work. With Google we use enhanced conversions, which sends your email address and phone number in scrambled form (hashed with the SHA-256 algorithm, so they cannot be read) so Google can match the sign-up to a click on one of our adverts. We may also report sign-ups to Google later using the advert's click identifier (offline conversion import).
If you also tick the box at checkout, we may share your email address, in scrambled form, with Google and Meta to measure and tailor our adverts, for example to stop showing our adverts to existing customers. You can withdraw this at any time by emailing us.
Google, Meta, Microsoft and LinkedIn use this information under their own terms, in some cases as separate controllers. You can read how Google uses information from sites that use its services, and manage the adverts Google shows you in Google's My Ad Center. You can change your cookie choices at any time from "Cookie settings" at the bottom of every page.
5. AI and automated processing
Calls are answered by AI, as section 2 explains, and so are the demonstrations on our website. When you ask us to fill in your answers from your website or documents, an AI model reads them and drafts the answers for you to check.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.
6. Who we share personal data with
We share personal data only as this policy describes, and we never sell it. We use these service providers, who act on our instructions under contracts that protect your data:
| Provider | What it does for us | Where |
|---|---|---|
| ElevenLabs (Eleven Labs Inc.) | Answers calls and demonstrations: speech recognition, the AI conversation and voices, with Google's Gemini model writing the replies | United States |
| Twilio (Twilio Ireland Limited) | Phone numbers, carrying calls, and text message and WhatsApp alerts | United States and Ireland |
| Resend (Plus Five Five, Inc.) | Sends our emails | United States |
| Anthropic (Anthropic Ireland, Limited) | Reads websites and documents customers ask us to learn from | United States |
| Fasthosts Internet Limited | Hosts our website, database and backups | United Kingdom |
| Stripe (Stripe Payments Europe, Limited) | Takes card payments and manages subscriptions. Stripe also uses payment data as a separate controller to prevent fraud and meet its legal duties | United States and Ireland |
| Google, Meta, Microsoft, LinkedIn | Analytics and advertising, only with your consent, as section 4 explains | United States and Ireland |
We may also share personal data with our professional advisers; with the police, regulators or courts when the law requires it or to protect rights and safety; and with a buyer if we sell our business, who would be bound by this policy.
7. Transfers outside the UK
Our own systems are in the United Kingdom. Some of the providers above process personal data in the United States or the European Economic Area. We only make those transfers with a safeguard that UK law recognises: UK adequacy regulations (including the UK-US data bridge for providers certified to it), or the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Email us for a copy of the safeguard that applies.
8. How long we keep it
| Personal data | How long |
|---|---|
| Live demo calls and what they produced | 7 days |
| Voice samples made on the demo page | 7 days |
| Call recordings, and our voice provider's copy of transcripts | 90 days after each call |
| A customer's account, calls, messages, contacts and settings | While the account is open, then deleted 90 days after the subscription ends (voices a customer designed: 30 days) |
| Orders, invoices and the record of what was agreed at checkout | 6 years, for tax and legal claims |
| Enquiries, demo copy requests and saved baskets | Enquiries: 2 years; baskets: 90 days |
| Copies of emails we sent, and the content of webhook messages | 30 days |
| Sign-in links and sessions | Until they expire (sessions last up to 30 days) |
| The security log of account actions | 2 years |
| Records of cookie choices | 1 year |
| Web server logs (internet address, pages requested, browser) | Up to 4 months |
| Our application's error and diagnostic logs | Up to 1 month |
| Database backups | 14 days |
| Marketing preferences, including a request to stop | Kept for as long as we need to respect it |
9. Your rights
You have the right to:
- ask for a copy of your personal data;
- ask us to correct it if it is wrong or incomplete;
- ask us to delete it;
- ask us to restrict how we use it;
- object to how we use it when we rely on our legitimate interests, and to object to direct marketing at any time (we will stop);
- ask for data you gave us in a format you can take elsewhere;
- withdraw your consent at any time, where we rely on it (this does not affect what we did before);
- not be subject to decisions made solely by automated means that have legal or similarly significant effects on you.
To use any of these rights, email hello@tillyanswers.co.uk. It is free. We may ask you to confirm your identity, and we will reply within one month, or tell you within that month if we need longer for a complicated request. Some rights only apply in certain circumstances; if we cannot do what you ask, we will explain why.
10. Complaints
If you are unhappy with how we have used your personal data, please complain to us first: email hello@tillyanswers.co.uk or use our contact form. We will acknowledge your complaint within 30 days, look into it and tell you the outcome without undue delay.
You also have the right to complain to the Information Commission (the UK regulator, known as the ICO) at ico.org.uk or on 0303 123 1113.
11. Cookies
We use essential cookies to run the site, and analytics and marketing cookies only if you allow them. Our cookie policy lists them all, and you can change your choice at any time from "Cookie settings" at the bottom of every page.
12. Children
Tilly is a service for businesses and is not aimed at children. We do not knowingly collect children's personal data, other than where a child calls a business that uses Tilly, which section 2 covers.
13. Keeping your data secure
We protect personal data with encryption in transit, single-use sign-in links, two-step sign-in, strict separation between customer accounts, rate limiting, round-the-clock monitoring, daily backups and automatic deletion on the schedule above. Our data processing agreement describes these measures in more detail.
14. Changes to this policy
We will update this policy when our use of personal data changes. The date it was last updated is shown at the top. If a change is significant, we will tell customers by email before it takes effect.