The short version. We answer phone calls for businesses, so we handle recordings and transcripts of calls their customers make. The suppliers that carry, transcribe and answer those calls are in the United States, so that is where call data is processed, under the standard UK transfer clauses. A caller's actual voice reaches three of them. The AI that writes the replies and the voice that speaks them only ever receive text. We keep call data no longer than 90 days, usually far less, and we never sell it. If you called a business and reached our assistant, that business, not us, decides what happens with your information. Ask them or us using the details below.
If you got a letter from us, none of the above is about you. Go straight to section 3: what we hold, where we got it, and how to make us stop.
If one of our team rang your business, go to section 3A. It says what we hold, where the number came from, and how to make sure we never call again.
1. Who we are
CatchEveryCall is a service operated by Mercia Sales Engine Ltd ("we", "us"), a company registered in England and Wales (Company No. 16966606), registered office 139 Solihull Road, Solihull, West Midlands, B90 3HW. VAT registration GB 527 2147 03. We are registered with the Information Commissioner's Office as a data controller, reference ZC240991 — you can check that on the ICO's public register at ico.org.uk.
For privacy questions or to exercise your rights, email privacy@catcheverycall.co.uk.
2. Two different roles we play
This matters, because it determines who is responsible for what.
When you visit this website or enquire about the service
We are the data controller. We decide why and how your information is used.
When we write to your business by post
We are the data controller. We chose to write to you, so the responsibility is ours. Section 3 sets out what we hold and how to stop it.
When we phone your business
We are the data controller. We chose to call you, so the responsibility is ours. Section 3A sets out what we hold and how to stop it.
When our assistant answers a call for one of our client businesses
We are the data processor. The client business (for example, the plumbing firm you rang) is the data controller. They decide what the service is used for; we handle the call data on their written instructions under a contract that meets Article 28 of the UK GDPR. If you are a caller and want your information removed, you can ask either us or that business — we will act on their instruction and help them respond.
3. If we wrote to you by post
You did not ask to hear from us, so this section comes before the rest.
To stop it: email privacy@catcheverycall.co.uk, or ring 0121 816 1991, and say so. You do not have to give a reason. Your business then goes on a suppression list that is checked before every mailing we send, which is the only record we keep about you afterwards and the only thing that stops your details being found again in the public register and used a second time.
What we hold: the director's name, the company name, the registered office address and the company number. Nothing else. No personal address, no personal email, no personal phone number, nothing about anyone outside their working role.
Where it came from: Companies House, the public register of UK companies. We did not buy a list.
Why we are allowed to: our lawful basis is legitimate interests — our interest in reaching businesses that may need the service. The rules on marketing by electronic mail (PECR) do not apply to post, but data protection law applies in full, and your right to object to direct marketing is absolute: there is no balancing test we get to apply. We write to limited companies at their registered office, about their business, once. We never write to a generic "Managing Director", and where the registered office looks like an accountant's or a formation agent's, we drop the record rather than post into a client pile.
Who else sees it: only the printer that produces and posts the letter (Stannp, section 7). It is not shared with anyone else and never sold.
3A. If we phoned your business
You did not ask us to call, so this comes before the rest.
To stop it: say so on the call, reply STOP to any text from us, email privacy@catcheverycall.co.uk, or ring 0121 816 1991. You do not need to give a reason. We mark your business "do not call" at once, and it stays on our suppression list permanently, so it is never called again even if we find your listing a second time.
Where your details came from: your business's public listing on Google Maps: the business name, town and the kind of work you do. We did not buy a list.
Your phone number: we look it up from that same public listing at the moment we dial and do not keep it. We only store a number if you give it to us on the call, or agree to receive a text.
What we hold: the business name, town and trade; the first name of the person we spoke to, if they gave it; the caller's notes on the conversation; the outcome (for example "call back Thursday" or "not interested"); a recording and written transcript of the call; any texts we sent you or you sent us; and a record of what you agreed to, such as receiving a text.
Checks before every call: we screen each number against the Telephone Preference Service (TPS) and the Corporate Telephone Preference Service (CTPS) in the 14 days before every call, half the 28 days the law allows, and we do not call numbers on either register. If the check cannot be made, the call does not go out. We only call on weekdays from 8am to 7:30pm and Saturdays from 9am to 1pm, try a business no more than three times in 14 days if nobody answers, and never call again after someone says they are not interested.
Who rings you: a member of our sales team who works for us under contract from the Philippines. They make the call through our own system, which keeps all the data on our servers. They see the business name, town and trade, plus the notes on earlier calls, but not your phone number: our system dials it for them. They cannot download, export or copy records, and every record they open is logged. The caller will always tell you their name and that they are calling from CatchEveryCall, and, if you ask, where they are based and our postal address.
Recording: every sales call is recorded, both sides, and we tell you so at the start. The recording is turned into a written transcript, and the transcript is checked by us and by an AI tool for accuracy, honesty and compliance with these rules. We use recordings to train our team, check what was said, and deal with any complaint. Recordings and transcripts are deleted within 90 days.
Texts: we only text you if you agree on the call, and only from our own number. Every text says how to stop them. Reply STOP and we stop at once.
If you rang our demo line: a member of our sales team may ring you back about the service, on the number you called from. The same rules apply as above: the number is checked against the TPS and CTPS before every call and not rung if it is listed, the same calling hours and limits, and we stop the moment you say you are not interested. Our system keeps that number, so it can dial it, for no longer than 12 months from our last contact with you; the person calling you never sees it.
If you ring that number back: the call goes to the person who rang you if they are available. If not, our assistant answers and takes a message, as described in section 5.
Why we are allowed to: our lawful basis is legitimate interests, our interest in offering the service to businesses that may need it. UK data protection law names direct marketing as an example of a legitimate interest. We have written down why we think our calls are fair to you (a legitimate interests assessment), and you can ask for a copy. The phone marketing rules (PECR) allow live business calls to numbers not on the TPS or CTPS, and to anyone who has not told us to stop. Your right to object to direct marketing is absolute: if you tell us to stop, we stop, with no balancing test.
4. What we collect, and why
| Information | Why we have it | Lawful basis |
|---|---|---|
| Name, business name, email, phone number, trade and location — when you book a setup call or enquire | To respond to your enquiry, run the call, and provide a quote | Legitimate interests (responding to a business enquiry); steps prior to a contract |
| Call recordings and written transcripts of calls answered for a client | To take the caller's details accurately, book the job, send confirmations, and let the business check what was said | Controlled by our client business; typically their legitimate interests in running their business and serving customers |
| Caller details captured on a call: name, phone number, postcode or address, and what the job is | To book the appointment and pass it to the business | As above — controlled by the client business |
| Director name, company name, registered office and company number — for businesses we write to by post | To send one letter introducing the service | Legitimate interests (business-to-business marketing by post). You can object at any time and we must stop — see section 3 |
| Client account and billing records | To run the contract, invoice, and meet accounting obligations | Contract; legal obligation |
| Business name, town and trade, from the business's public Google Maps listing — for businesses we phone | To decide which businesses to call and to make the call | Legitimate interests (business-to-business marketing by phone). You can object at any time and we must stop — see section 3A |
| Phone number, looked up at the moment we dial and not kept; stored only if you give it to us or agree to a text | To make the call, and to send a text you asked for | Legitimate interests; for texts, your agreement on the call |
| First name, call notes, outcomes and callback times — from our sales calls | To follow up the way you asked, and never call those who said no | Legitimate interests |
| Recordings and transcripts of our sales calls | To check what was said, train our team, and handle complaints | Legitimate interests |
| Our suppression ("do not call") list | To make sure anyone who has opted out is never contacted again | Legal obligation; legitimate interests |
We do not use cookies for advertising or run third-party advertising trackers on this site.
5. Call recording
Calls answered by a CatchEveryCall assistant are recorded and transcribed. Callers are told this at the start of the call, before any details are taken.
If a caller objects to being recorded, the assistant offers to take a name and number and have a person ring them back instead. We cannot run the assistant without converting speech to text, so that is the honest alternative rather than a quieter version of the same thing.
We do not ask for, and instruct our assistants never to take, payment card details, bank details, or account passwords over these calls.
If you ring our own demo line or support line rather than a client business, we are the controller for that call. It is recorded and transcribed, a summary reaches our mailbox, we use it to answer you and to follow up on your enquiry (for the demo line, that can include one of our team ringing you back, as described in section 3A), and we keep the recording and transcript no longer than 90 days.
6. How long we keep things
- Call recordings and transcripts: no longer than 90 days, and usually far less. Our call platform's current plan removes them after 14 days on its own. A client business may instruct us in writing to use a shorter period, or a longer one where they have their own lawful reason.
- Call summaries and transcripts emailed to us: held in our business mailbox and cleared on the same 90-day cycle. Our mail provider finishes purging deleted mail within a further 30 days.
- Calls to our own demo and support lines: no longer than 90 days.
- Booking details passed to the business: held by that business under their own retention policy — ask them.
- Enquiries and onboarding forms submitted on this website: up to 12 months if you don't become a customer.
- Business details used for a postal mailing: reviewed at least once a year and deleted when we no longer intend to write.
- Sales call recordings and transcripts: deleted within 90 days, at our call carrier as well as on our own system.
- Sales call notes and outcomes: 12 months from the last contact, unless you become a client.
- Records of what you agreed to on a sales call (for example, receiving texts): for as long as we rely on that agreement, and two years after, so we can show what you agreed and when.
- Suppression list: kept indefinitely. That is what makes an opt-out permanent — deleting it would let the same details be found again in the public register.
- Client account and billing records: six years after the contract ends, as required for tax and accounting.
7. Who we share it with
These are the suppliers that make the service work. Each does one job. They do not all receive the same thing: a caller's recorded voice only ever reaches the first three.
| Supplier | What it does, and what it receives | Where it processes |
|---|---|---|
| Twilio | Carries phone calls and their audio, and sends text messages: for the call answering service and for our own sales calls. For sales calls it also makes the recording and holds it until we delete it, within 90 days. | United States. Twilio processes in one of three regions and we have not moved ours off the default, which is the United States. |
| Vapi | Runs the assistant during the call, and stores the call record, the recording and the transcript. | United States. Vapi offers only a US and an EU region, has no UK region, and our account is on its US infrastructure. |
| Deepgram | Turns the caller's speech into text so the assistant can understand it. Reached through Vapi during the call. | United States. No UK region exists. |
| Anthropic | The AI model that composes the assistant's replies. It receives the text of the conversation, not the caller's voice. Reached through Vapi during the call. It also checks the written transcripts of our sales calls against our calling rules; it receives the transcript text, not the recording. | United States. No UK or EU region is offered. |
| ElevenLabs | Turns the assistant's written reply into speech. It receives the words we ask it to say and returns audio. It does not receive the caller's voice. Reached through Vapi during the call. | United States. Regional options exist only on enterprise plans, which we do not hold. |
| Google Workspace | Our business email. A summary and transcript of each call is emailed to us, so a copy sits in our mailbox as well as at Vapi. Access is restricted and those copies are cleared on the 90-day cycle in section 5. | United States and other countries where Google operates. |
| Cal.com | Booking tool, used when you book a setup call with us. Where a client business has diary booking set up, the booking passes through Cal.com into their calendar, carrying the caller's name, number, postcode and job. | United States. |
| Stripe | Collects subscription payments from client businesses and holds their billing details. It never receives call data. | United States and Europe. |
| Stannp | Prints and posts our letters. It receives the director name, company name and postal address for that mailing. It never receives call data. | United Kingdom. Stannp Ltd is registered in England (Company No. 09086822) and we use its EU-region platform. |
| Netlify | Hosts this website and receives whatever you type into the enquiry and onboarding forms on it. | United States. |
| Google Cloud (Firebase) | Runs our sales call system: the database of businesses, notes and outcomes, the sign-in for our team, and a short-lived copy of each recording while it is transcribed. | United Kingdom (London). |
| Google Cloud Speech-to-Text | Turns sales call recordings into written transcripts. | European Union. |
| Google Maps Platform | Supplies the business listings we call from, and looks up the phone number at the moment we dial. | United States and other countries where Google operates. |
| 121prodata | Checks each number against the TPS and CTPS registers before we call. It receives the phone number only, and keeps a record of the numbers we checked for our compliance records. | United Kingdom. |
| Our sales caller | A contractor in the Philippines who makes sales calls for us through our system. Sees business name, town, trade and call notes, never phone numbers, and cannot download or copy them. | Philippines (viewing only; the data stays on our systems). |
Which of them can learn from the data. Through the call platform, Anthropic is contractually barred from training its models on anything sent to it, and holds it for 30 days or less. For the check of our own sales call transcripts, our Anthropic account is set so that what we send is not used to train its models. ElevenLabs logs the text sent to it and the audio it returns by default on standard plans; that is the assistant's own words, not the caller's voice. Speech-to-text runs on the Vapi platform's own account, and Vapi's processing terms govern whether that audio may be used to improve speech models.
We do not sell personal data, and we do not share it for anyone else's marketing.
8. Where your data is held
Not everything leaves, and it is worth being exact. The caller's voice reaches three suppliers: the phone carrier, the call platform and the speech-to-text service. The AI model that writes the replies receives the text of the conversation. The voice supplier receives the words it is asked to say. Neither of those two receives the caller's recorded voice.
Beyond that, call data is processed in the United States. There is no UK-only version of this service. No supplier in the chain offers a UK region, so we cannot build one.
Data you give us yourself — an enquiry, an onboarding form, a booking for a setup call — is also processed in the United States, by the website host, the booking tool and our email provider named in section 7.
The business details used for a postal mailing do not follow that route. They go to the printer named in section 7 and no further.
Our sales calls work differently from the call answering service. The records of the businesses we call, our notes and outcomes are held by Google in London. Recordings are carried and held by Twilio in the United States until we delete them, and transcribed by Google in the European Union. The person making the calls works from the Philippines and views records on our system without them leaving it. In law that viewing still counts as a restricted transfer, so it is covered by the International Data Transfer Agreement issued by the Information Commissioner's Office, signed with that person, alongside a contract that limits what they may do with the data.
Sending personal data outside the UK is a restricted transfer, which means it is allowed only where specific safeguards are in place. Ours is the International Data Transfer Addendum to the EU Standard Contractual Clauses, issued by the Information Commissioner's Office, which forms part of the data processing terms we hold with our suppliers. Where a supplier is engaged by the Vapi platform rather than by us, Vapi's own processing terms and transfer safeguards cover it.
You can ask for the current supplier list and the transfer terms we rely on by emailing privacy@catcheverycall.co.uk.
9. Your rights
Under UK data protection law you can ask us to: give you a copy of your data; correct it; delete it; restrict or object to how it's used; or provide it in a portable format. Where we act as a processor for a client business, we will pass your request to them and support their response.
To make a request, email privacy@catcheverycall.co.uk. We respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, though we'd appreciate the chance to put things right first.
10. Security
Access to call data is restricted to the people who need it to run or support the service. We do not ask for, and our assistants are instructed never to take, card numbers, bank details or passwords. The data itself sits with our suppliers, so the encryption and access controls around it are theirs, and we choose suppliers that provide them.
Deletion works like this. Vapi holds the call record, the recording and the transcript, and on our current plan removes them after 14 days. We also run a scheduled sweep that deletes anything older than 90 days on the platform, clears the copies in our mailbox, and writes a log of what it deleted so we can show our working. Deleted mail is purged by our mail provider within a further 30 days. We keep no separate archive of recordings.
11. Changes
If we change this policy we will update the date at the top of this page, and tell client businesses directly where the change is material.