QuickAIHQ Privacy Policy

UK GDPR Compliant | Effective Date: November 22, 2025

1. Introduction and Scope

This Privacy Policy explains how QuickAIHQ (referred to as "we," "us," or "our Agency") collects, uses, stores, and protects Personal Data.

This policy applies to data processed in two main contexts:

• Agency Data: Personal Data relating to our direct clients (you, the business owner) when you sign up for our services, manage your account, or visit our website.
• Client Customer Data (Interaction Data): Personal Data collected and processed by our AI Voice Agents and AI Voice Chat Agents during live interactions with your end-customers (e.g., wellness clinic clients, healthcare patients).

Our processing activities are governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

2. Definitions of Legal Roles

In the context of the services we provide, the following roles are defined under UK GDPR:

Role	Definition	Our Relationship
Data Controller (Our Client)	The business (e.g., the wellness clinic, healthcare practice) that determines the purposes and means of processing Personal Data.	Our client is the Controller of the data related to their end-customers.
Data Processor (QuickAIHQ)	The entity that processes Personal Data on behalf of the Controller.	We act as the Data Processor, implementing and operating the AI agents strictly according to our client's instructions.

For all Agency Data (data about you, our direct client), QuickAIHQ acts as the Data Controller.

3. Personal Data We Collect

We collect and process the following categories of Personal Data:

3.1. Agency Data (Data about QuickAIHQ Clients)

Category	Examples of Data Collected	Purpose	Legal Basis
Identity & Contact Data	Name, business name, address, email, phone number	To manage your account and communicate about platform updates	Contractual Necessity
Financial & Billing Data	Payment card details (via secure processor), invoice history, subscription plan	To process payments and for accounting	Contractual Necessity and Legal Obligation
Technical Data	Login credentials, IP address, browser type, usage data	To ensure security and maintain service availability	Legitimate Interests

3.2. Client Customer Data (Interaction Data)

This data is collected and processed by us on behalf of our clients (the Data Controllers) when their customers interact with the AI Agents.

Category	Description	Source
Voice Data (Call Records)	The actual audio recording of the conversation	AI Voice Agent
Textual Transcripts	The automatically generated text version of calls or chat sessions	AI Voice Agent and AI Voice Chat Agent
Conversation Metadata	Date, time, duration, phone number, IP address, caller intent, sentiment analysis	AI Voice Agent and AI Voice Chat Agent
CRM Data	Personal information provided during conversation (name, appointment preferences)	AI Voice Agent and AI Voice Chat Agent

4. How We Use and Share Personal Data

We use and share Personal Data only as necessary to provide, maintain, and improve the contracted AI services. We do not sell any Personal Data.

4.1. Processing Client Customer Data

We process Interaction Data to perform the following core functions on your behalf:

• Service Fulfillment: Running the AI agent, handling customer queries, booking appointments, and capturing leads.
• Quality Assurance: Monitoring conversation transcripts and recordings to ensure the AI agent is performing as instructed.
• AI Model Refinement: Using anonymized and aggregated interaction data to refine the AI agent's conversational flow. We do not use your customer's sensitive or confidential data to train underlying LLMs without explicit written consent.

4.2. Sharing Data with Sub-processors

To deliver our service, we engage third-party providers (Sub-processors) who process data strictly under our instruction:

Sub-Processor Type	Function
AI/LLM Platforms	Core platforms providing the low-latency Voice and Chat AI execution engine (e.g., Retell AI)
Telephony Providers	Services that manage phone numbers and call routing
Payment Processors	Secure services (e.g., Stripe, GoCardless) for payment processing
Cloud Hosting Providers	Data centers for secure storage of transcripts and recordings

5. Data Retention and Security

Retention: We retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements.

Security: We have implemented appropriate security measures, including encryption, access controls, and secure physical and technical safeguards. Our payment processing is outsourced to Stripe/GoCardless, which adheres to PCI-DSS standards.

6. International Data Transfers

As a UK-based agency, we primarily store data within the UK or European Economic Area (EEA). If we, or our Sub-processors, transfer Personal Data outside the UK/EEA (e.g., to US-based LLM providers), we ensure the transfer is protected by appropriate safeguards, such as approved Standard Contractual Clauses (SCCs).

7. Your Data Protection Rights

Under UK GDPR, you have the following rights regarding your Personal Data:

• The Right to Access: The right to request copies of your Personal Data.
• The Right to Rectification: The right to ask us to correct inaccurate Personal Data.
• The Right to Erasure: The right to ask us to delete your Personal Data in certain circumstances.
• The Right to Restrict Processing: The right to ask us to restrict the processing of your Personal Data.
• The Right to Object to Processing: The right to object to processing where we are relying on a legitimate interest.
• The Right to Data Portability: The right to request that we transfer data to another organization.

8. Changes to this Privacy Policy

We regularly review and, if necessary, update this Privacy Policy. Any changes will be published on our website. We recommend checking this page periodically for updates.

9. Contact Information