Privacy Policy

Extra Hands is operated by The Local Post Media Ltd, a company registered in England and Wales, of 128 City Road, London, United Kingdom, EC1V 2NX (“Extra Hands”, “we”, “us”, “our”). We are the data controller for the personal data described in this policy unless stated otherwise.

Questions or requests about this policy: privacy@extrahands.io.

Because of how the service works, we handle two different kinds of personal data, as two different roles:

• Your data, as our customer (you sign up for an account, or you are a member of staff we deal with) — here we are the data controller, and this policy tells you what we do with it.
• Your callers’, texters’ and website visitors’ data, when you use Extra Hands to answer your own customers — here you (our customer) are the data controller, and we are the data processor, acting only on your instructions under the terms of our Data Processing Addendum. If you are one of our customer’s customers and want to exercise your rights, please contact that business directly; we will assist them in responding to you.

• Account and business data — name, email, phone number, business name, address, opening hours, services and prices (some drafted automatically from your website), to create your account and provide the service. Legal basis: performance of our contract with you.
• Payment data — handled by our payment provider, Whop; we receive the outcome of a payment (paid, failed, refunded) and a reference, never your card details. Legal basis: performance of our contract with you.
• Content you give the AI agent to work from — your website content, your answers when reviewing what it drafted, and any voice recording you make if you choose to clone your own voice for the phone agent (see FAQ and our voice-cloning notice in the product). Legal basis: performance of our contract with you, consent for the voice recording specifically.
• Support communications — anything you send us by email or in-app. Legal basis: our legitimate interest in running a support function, and performance of our contract with you.
• Technical and usage data — IP address, device and browser information, pages visited, and diagnostic logs, to keep the service secure and working. Legal basis: our legitimate interest in operating and securing the service.

When you connect a phone number, WhatsApp, SMS or web chat and switch a channel on, we process, as your processor:

• Callers’, texters’ and chatters’ phone numbers, names (if given) and messages;
• Call audio, transcripts and AI-generated summaries;
• Appointment details booked through the service and calendar availability read from your connected Google Calendar;
• Leads and pipeline notes your team records about these people.

We only process this data to provide the service to you, following your instructions and settings (for example, which channels are switched on, and which follow-ups are enabled). You are responsible for having a lawful basis to have us process this data on your behalf — including, where the law requires it, telling your own customers that calls and messages may be handled by an AI system, and obtaining any consent needed for automated calls, texts or WhatsApp messages under the rules that apply to your business and the countries you operate in.

We use specialist providers (“subprocessors”) to run the service. Each is bound by a contract that limits them to processing data only as we instruct, and only for the purposes below. We do not sell personal data, and we do not use it to train third-party AI models beyond what each provider below discloses in its own terms.

We may also disclose personal data if required by law, to protect our rights, or as part of a merger, acquisition or sale of assets (with notice to affected customers where practical).

Some of the providers above are based in, or process data in, the United States. Where personal data originating in the UK or EEA is transferred there, we rely on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses (as applicable) with each such provider, or another lawful transfer mechanism they offer, to protect it to UK/EU standards.

• Your account and business data: for as long as your organization exists with us, plus what we need to keep afterwards for accounting and legal reasons.
• Usage and billing records: for as long as your organization exists with us.
• Audit log entries (who did what, e.g. an export or an erasure): kept until your organization is deleted; entries contain no personal data themselves.
• Rate-limiting records: 2 days. Webhook failure records (for diagnosing provider issues): 90 days.
• Call recordings: held at Retell AI under their retention settings, which you or we can configure to match your own policy.

You can export or delete your organization’s data, or your own account, at any time from the app; deleting an organization also releases its phone numbers, deletes its voice agents and call history at Retell, and revokes its Google Calendar connection.

If we are the controller of your data (see “Two kinds of personal data” above), you have the right, subject to some exceptions, to: access the personal data we hold about you; have inaccurate data corrected; have it erased; restrict or object to our processing of it; receive a portable copy of it; and withdraw any consent you have given, at any time.

You can exercise most of these rights yourself from the app (data export, account deletion). For anything else, email privacy@extrahands.io. We will respond within one month. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk) or, if you are in the EEA, your local data protection authority.

Extra Hands uses AI models to draft business profiles, answer calls and messages, summarise calls and suggest appointment times. A booking or a reply can be completed automatically without a person reviewing it first. This does not produce legal or similarly significant effects on the people it responds to (for example, it does not decide whether to extend credit or refuse a service to anyone); you, as the business, can review and take over any conversation, and configure when the AI hands off to a human.

We use a small number of strictly necessary cookies to keep you signed in, remember your language, and complete secure connections like Google Calendar. See our Cookie Policy for the full list.

We use encryption in transit and at rest, database-level access controls that isolate each customer’s data, and signature checks on every webhook we receive from a provider. No online service can be guaranteed 100% secure, and we will tell you and, where the law requires it, the relevant regulator without undue delay if we become aware of a breach affecting your data.

Extra Hands is a business tool. It is not directed at, and we do not knowingly collect personal data from, children.

We may update this policy from time to time. If a change is material, we will let account holders know by email or in-app notice before it takes effect. The date at the top of this page shows when it was last updated.

The Local Post Media Ltd, 128 City Road, London, United Kingdom, EC1V 2NX. privacy@extrahands.io.