Privacy Policy

AymexConnect is operated by Aymex LTD (company number 15515557), registered in England and Wales at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. We are registered with the Information Commissioner's Office under registration ZB691380.

For the account data of our direct customers we act as data controller. For the call, message and contact data our customers process through the platform, we act as data processor on their instructions.

We collect only what the service needs to function and to be billed for.

• Account data: name, work email, telephone number, company name and billing details.
• Authentication data: password hashes, session tokens and sign-in timestamps. We never store passwords in plain text.
• Communications data: call detail records (who called whom, when and for how long), voicemails, SMS content, chat messages, and call recordings where recording is enabled.
• AI-derived data: transcripts, summaries, action items and tone labels generated from voicemails, recorded calls and recorded meetings, and the drafts or chat excerpts you submit to writing help (which are processed and not retained by the AI provider).
• Technical data: IP address, device and browser information, and application logs used for diagnostics, security and abuse prevention.
• Enquiry data: anything you send us through the contact form or by email.
• Usage analytics, only if you accept analytics cookies: pages visited, features used and errors, linked to your account if you are signed in.
• App statistics, unless you turn them off: call-quality and feature-use events from the mobile and desktop apps, described under App statistics below.

• To perform our contract with you: providing the phone system, routing calls, delivering messages and hosting your data.
• For our legitimate interests: securing the platform, preventing fraud and abuse, diagnosing faults, and improving the service.
• To comply with legal obligations: telecommunications regulation, emergency-call handling, tax and accounting requirements.
• With your consent where consent is the appropriate basis, such as analytics cookies and optional marketing email. You can withdraw consent at any time.

We store your data in the UK (Amazon Web Services, London) and the European Economic Area (our application hosting and meetings infrastructure in the EU). Some service providers, such as payment, email and AI providers, process data in the United States under UK-approved safeguards (the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum).

Data is encrypted in transit using TLS 1.3, call media is carried over SRTP, and recordings are encrypted at rest. The sub-processor list below gives the location of each provider.

• Account data: for the life of the account. Recordings, voicemail, transcripts and AI summaries follow your organisation's retention settings while the account is open, and you can delete them at any time.
• When an account closes, you have 30 days to download your data. We email the account's administrators and billing contact when it closes and again a week before the deadline, and reopening the account within the 30 days cancels the deletion.
• After those 30 days we permanently delete the account's content: call and meeting recordings, voicemail, transcripts and AI summaries, chat history, the text of stored SMS messages, contacts and uploaded files. Copies in our backups cycle out within a further 60 days, so everything is gone within 90 days of closure.
• SMS messages pass through our SMS gateway provider, which keeps its own copy of message content for its own retention period. That copy is not removed when we delete the account's content. The SMS billing records we must keep do not include message text.
• Invoices, billing and payment records, wallet transactions and call logs (who called whom, when, for how long and at what charge): kept for six years, because UK tax law requires it. They are then deleted.
• Business verification (know-your-customer) records: documents you upload, such as proof of identity or address, are deleted 12 months after the verification decision. The record of the checks we made and their outcome is kept for at least five years after the account closes, as anti-money-laundering rules require, and deleted with the billing records at six years.
• Application logs: typically 90 days, longer where an active security investigation requires it.

We do not sell personal data, and we do not share it for third-party advertising.

We share data with the sub-processors listed below, who help us run the service, each under a written data-processing agreement. Audio and text sent to AI providers is used only to produce your transcript, summary or draft; it is never used to train AI models. We also disclose data where we are legally required to, for example to emergency services or in response to a lawful request.

These are the third parties that process personal data on our behalf. We update this list when it changes.

• Railway (EU - Netherlands) - application hosting and database.
• Amazon Web Services (London, UK) - storage of call and meeting recordings, verification documents and desktop app downloads.
• LiveKit Cloud (EU - Germany) - video meeting audio and video.
• Our own telephony servers (EU - Germany, Nuremberg) - call routing, call detail records and voicemail.
• Our own chat servers (London, UK) - chat messages.
• Telephony carriers (UK) - connecting calls and SMS to and from the public phone network.
• Stripe (United States and EU) - subscription payments, wallet top-ups and identity verification.
• ZeptoMail by Zoho (EU) - transactional email such as sign-in codes, invoices and voicemail notifications.
• Deepgram (EU) - speech-to-text for voicemail, call and meeting transcripts.
• Anthropic (United States) - AI summaries, meeting recaps, writing help and catch me up.
• Telnyx (United States) - phone-number verification codes during account verification.
• PostHog (EU) - product analytics on the website only where you have accepted analytics cookies, call-quality and feature-use statistics in the mobile and desktop apps (see below), and server error reporting.

Under UK GDPR you have the right to access your personal data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, and to receive your data in a portable format.

Account administrators can download a copy of their organisation's data at any time, and for 30 days after the account closes, from Settings > Billing > Data export. If you can no longer sign in, ask us and we will prepare the export for you.

To exercise any of these, contact [email protected]. We respond within one month. If you are an end user of a customer's AymexConnect account, please direct your request to that organisation in the first instance - they control the data and we will assist them in fulfilling it.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk.

We use strictly necessary cookies to keep you signed in and secure, and analytics cookies only if you accept them. You can change your choice at any time from the Cookie settings link at the foot of every page. Each cookie is listed in our cookie policy.

The AymexConnect mobile and desktop apps send a small set of statistics to PostHog (EU) so we can see whether calls ring, connect and stay connected, and which features are used. We use them only to find faults and improve the service, never for advertising, and we do not sell them.

We do not collect phone numbers, contact details, message or chat text, call audio or recordings. Statistics from our own staff and from development builds are not collected.

You are told about this the first time you sign in to an app. You can turn it off at any time in the app under Settings > Share call-quality data; nothing more is sent from that device once it is off.

• Calls: whether an incoming call was received, rang and was answered, whether audio connected, how long the call lasted and the technical reason if it failed.
• Sign-in and set-up: that you signed in, and whether you allowed microphone, notification and camera access.
• Feature use: that an outgoing call was started, an SMS or chat message was sent, or video was turned on.
• With each event: your account and company identifiers, the app version, the operating system, the device model and the network type (Wi-Fi or mobile).

We update this policy when our practices change. Material changes are notified to account administrators by email before they take effect. The date at the top of this page always reflects the current version.