Privacy policy
Last updated: 19 September 2026
DUTA AI provides two services to small businesses: a WhatsApp assistant that answers customers' messages, and an AI voice receptionist that answers their phone calls. Both can book appointments. This policy explains what personal data is involved, why, who handles it, and what rights you have. If anything is unclear, contact us using the details at the bottom of this page.
1. Who we are
DUTA AI is a trading name of DUTA LTD, a company registered in England and Wales (company number 17463780). Our registered office is 128 City Road, London, EC1V 2NX, United Kingdom.
2. Our two roles
- You contact a business that uses our assistant — you message it on WhatsApp or call its phone number, and our assistant answers. That business decides how your data is used, so it is the controller. We process your data on its behalf, under a written data processing agreement.
- You deal with us directly — you visit this website, request a demo, contact us, or your business is our customer. Here DUTA LTD is the controller.
If you're in the first group, you can still contact us — we'll pass your request to the business, or help them act on it.
3. The WhatsApp assistant
What we process: your WhatsApp phone number, your WhatsApp profile name, the messages you send and receive, and any booking details you give (such as your name, email address and preferred time).
How it works: your messages reach the business through Meta's WhatsApp Business Platform. An AI model writes the replies. We store the recent conversation on our server in Frankfurt, Germany, so the assistant can follow what you've already said. If you ask for an appointment, the assistant checks the business's calendar and books it for you.
Your use of WhatsApp itself is also covered by WhatsApp's own terms and privacy policy.
4. The AI voice receptionist
What we process: your phone number, the audio of the call, a recording and transcript of it, a short summary, and any booking details you give.
How it works: when you call the business, the call is forwarded to a phone number provided by our telephony provider (Twilio or Telnyx), which connects it to Retell AI. Retell runs the voice assistant: it turns your speech into text, generates the replies, and speaks them back. At the start of the call the assistant tells you it's an AI assistant and that the call may be recorded. The recording, transcript and summary are kept so the business can see what was discussed and follow up with you.
5. Bookings
When either assistant books an appointment for you, your name, contact details and the appointment details are saved in the business's calendar on Cal.com. You may receive a confirmation email, and reminders, from Cal.com or from us.
6. What the assistants do and don't do
- They tell you at the start that you're talking to an AI assistant.
- They only book an appointment when you ask them to. They don't make decisions that have legal or similarly significant effects on you.
- If they can't help, they take a message so the business can contact you.
- We don't sell your data, and we don't use your conversations or calls to train AI models.
7. When you deal with us directly
| What | Why we use it | Legal basis |
|---|---|---|
| Demo requests: your name, business name, phone or email, and anything you tell us about your business | To build and send you a demo, and to follow up about it | Taking steps at your request before a contract; our legitimate interest in responding to enquiries |
| Customer details: contact and billing details, and information about your business (hours, services, prices, booking setup) | To set up, run and support your assistant, and to invoice you | Performing our contract with you; legal obligations such as keeping accounts |
| Emails, calls and WhatsApp messages you send us | To reply and keep a record of our conversation | Our legitimate interest in running our business |
| Technical data when you visit this website, such as your IP address and browser type | To deliver the site and keep it secure (handled by our hosting provider) | Our legitimate interest in operating a secure website |
Cookies and tracking: this website doesn't use cookies, analytics or advertising trackers. Everything on it, including the fonts, is served from our own hosting, so visiting it doesn't send your data to third parties such as Google.
8. Who handles your data
We use the following service providers. They process data only to provide their service to us, under contracts that protect it.
| Used for | Provider | What they do | Location |
|---|---|---|---|
| WhatsApp assistant | Meta Platforms (WhatsApp Business Platform) | Delivers messages between you and the business | Ireland / USA |
| WhatsApp assistant | OpenAI | Writes the assistant's replies | USA |
| WhatsApp assistant | Alibaba Cloud | Hosts our server, which stores the conversation history | Frankfurt, Germany |
| Voice receptionist | Retell AI | Runs the voice assistant and stores call recordings, transcripts and summaries | USA |
| Voice receptionist | Twilio or Telnyx | Provides the phone number and carries the call | USA |
| Bookings | Cal.com | Calendar and booking system; booking emails | USA |
| Bookings | Resend | Sends booking confirmation emails | USA |
| All services | Cloudflare | Domain, secure connections to our server, and email forwarding | Global network (USA-based company) |
| Website and demos | Netlify | Hosts this website and receives demo request forms | USA |
| Website and demos | Anthropic | Writes replies in the chat on demo websites we build for prospective customers | USA |
| Running our business | Our email inbox | USA |
We may also disclose data if the law requires it, or to protect our rights.
9. International transfers
Several of our providers are based outside the UK and the European Economic Area, mainly in the USA. When your data is transferred there, we rely on safeguards recognised by data protection law — such as the UK Extension to the EU–US Data Privacy Framework for certified providers, or standard contractual clauses together with the UK International Data Transfer Addendum.
10. How long we keep data
- WhatsApp conversation history: while the business uses our service, and no longer than 12 months after the last message.
- Call recordings, transcripts and summaries: no longer than 12 months after the call.
- Call logs (phone number, time and duration): kept by our telephony provider for its billing and legal obligations.
- Bookings: in the business's calendar for as long as the business keeps them.
- Demo requests and correspondence: up to 24 months after our last contact, unless you become a customer.
- Customer records: for as long as we provide the service, then invoices and accounting records for 6 years, as UK law requires.
We delete data sooner if you or the business ask us to, unless the law requires us to keep it.
11. Your rights
Under UK data protection law (and EU law, if you're in the EU), you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to how we use it;
- receive your data in a portable format;
- withdraw consent, where we rely on it.
To use any of these rights, contact us. We'll reply within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ico.org.uk), or to the data protection authority in your country if you're in the EU.
12. How to request deletion of your data
You can ask us to delete your data at any time:
- Email contact@dutasolutions.com with the subject "Delete my data", or call us on +44 20 8050 1428.
- Tell us the phone number or email address you used, so we can find your data.
- If you messaged or called a business through our assistant, tell us which business.
We'll confirm your request and delete your data within 30 days, including WhatsApp conversations and call recordings, and ask our service providers to delete their copies too. We can only keep data that the law requires us to keep (such as invoices), and we'll tell you if that applies.
Deleting a chat in your own WhatsApp app only removes it from your phone. To remove it from the business's records, contact us as described above.
13. How we protect your data
Connections to our website and systems are encrypted. Our server only accepts WhatsApp messages that carry Meta's signature, access to data is limited to people who need it, and passwords and API keys are stored securely. No system is completely secure, but we take reasonable steps to protect your data and will notify you and the authorities of a serious breach as the law requires.
14. Children
Our website and services are for businesses and aren't intended for children. We don't knowingly collect data from children.
15. Changes to this policy
We may update this policy as our services change. We'll post the new version on this page and change the date at the top.
16. Contact us
DUTA LTD
128 City Road, London, EC1V 2NX, United Kingdom
Email: contact@dutasolutions.com
Phone: +44 20 8050 1428