privacy policy

1. introduction

subject: local ltd ("subject: local", "we", "us", "our") is committed to protecting your personal data and being transparent about how we use it. this policy explains what data we collect, why we collect it, and what your rights are.

we are the data controller for personal data collected via our website and from our clients (business owners who subscribe to our services). where we process data on behalf of our clients about their customers, we act as a data processor - this is explained in section 5.

this policy applies to: our website (subjectlocal.com), our AI response and review automation service, and any communications between us and our clients.

if you have any questions, contact us at info@subjectlocal.com.

2. who we are

subject: local ltd
company number: 17229925
registered in england and wales
registered address: 128 City Road, London, EC1V 2NX
contact: info@subjectlocal.com

we are registered with the information commissioner's office (ICO) as a data controller and data processor. ICO registration reference: ZC175529.

3. the data we collect

if you are a client (business owner)

when you sign up to use our service, we collect:

• your name, business name, and contact details (email address and phone number)
• business information: the type of business you run, services you offer, areas you cover, and how you prefer to communicate with customers
• intake form responses used to configure your AI agent
• payment information - handled entirely by Stripe. we never see or store your card details
• communications you send to us (email, support requests)
• usage data relating to your account and service performance

if you are an end user (a caller or SMS contact of one of our clients)

when someone misses a call from a business that uses our service, our system may send an automated SMS response. in that process, we collect:

• your phone number
• the content of your SMS conversation with the AI agent
• the time and date of the interaction
• a structured summary of your enquiry (such as service type, appliance or equipment details, and enquiry outcome), which may be retained within that client's account to provide a more informed response if you contact them again in future

if you visit our website

• pages visited, time on site, and referring source (via Google Analytics)
• device type, browser, and anonymised IP address
• cookie data (see section 9)

4. how we use your data and our lawful basis

for clients

• to set up and run your service - including configuring your AI agent, provisioning your SMS number, and connecting your calendar. lawful basis: performance of a contract.
• to send service communications - usage reports, pre-charge summaries, and important account updates. lawful basis: performance of a contract / legitimate interests.
• to process payments - via Stripe. lawful basis: performance of a contract.
• to improve our service - analysing aggregated usage patterns to make subject: local better. lawful basis: legitimate interests. we do not use identifiable client data for this purpose without consent.

for end users (via our clients)

• to respond to missed calls on behalf of the client business - qualifying the lead and keeping the caller warm until the business can respond. lawful basis: legitimate interests of the client business.
• to route and log enquiries - so the client has a record of each lead. lawful basis: legitimate interests of the client business.
• to recognise returning callers within the same client account - a structured summary of a previous enquiry (service type, outcome, and relevant details) may be used to provide a more relevant response if you contact the same business again. this data is siloed to that specific client account and is not shared with or accessible by any other client. lawful basis: legitimate interests of the client business.

for website visitors

• to understand how our website is used and improve it. lawful basis: legitimate interests.

5. our role as a data processor

when our AI agent interacts with callers on behalf of a client business, subject: local acts as a data processor and the client business is the data controller for that end user's data. this means:

• the client is responsible for having a lawful basis to contact their customers via SMS
• we process that data only to deliver the service the client has contracted us for
• we do not use end user data for our own marketing or other purposes
• our data processing obligations are set out in the data processing agreement (DPA) incorporated into our terms of service

clients who use our service are responsible for ensuring their customers are aware that AI-assisted responses may be used when they call and do not get through, and that a structured summary of their enquiry may be retained within that client's account to improve future responses.

6. who we share your data with

we use a small number of carefully selected third-party providers (sub-processors) to deliver our service. we only share the data each provider needs to perform their specific function.

we do not sell your data. we do not share it with third parties for their own marketing purposes.

7. international data transfers

we have chosen EU-based infrastructure wherever possible. Telnyx, Supabase, Cal.eu, and n8n all store and process data within the EU, which is covered by the UK-EU adequacy decision.

Anthropic (AI processing) and Stripe (payment processing) are based in the United States. transfers of personal data to the US via these providers are made under appropriate safeguards, including standard contractual clauses (SCCs) approved by the relevant authorities.

if you would like details of the specific safeguards in place for any provider, contact us at info@subjectlocal.com.

8. how long we keep your data

• client account data - retained for the duration of your subscription and for 6 years after cancellation, in line with UK contract limitation periods.
• end user conversation transcripts - retained for 12 months from the date of the interaction, then deleted.
• end user enquiry summaries (service type, outcome, and relevant details linked to a phone number) - retained within the relevant client account for 3 years from the date of last contact with that client, then deleted. this data is siloed per client and is not accessible by any other client on the platform.
• payment records - retained for 7 years to comply with HMRC requirements.
• website analytics - subject to Google Analytics' data retention settings (default 26 months).

you may request earlier deletion of your data by contacting us (subject to legal and contractual retention obligations).

9. your rights under UK GDPR

you have the following rights in relation to your personal data:

• right of access - you can request a copy of the personal data we hold about you (a subject access request).
• right to rectification - you can ask us to correct inaccurate or incomplete data.
• right to erasure - you can ask us to delete your data, subject to legal and contractual obligations.
• right to restriction - you can ask us to limit how we use your data in certain circumstances.
• right to data portability - you can request your data in a structured, machine-readable format.
• right to object - you can object to processing based on legitimate interests.
• rights relating to automated decision-making - our AI agent makes initial responses automatically. no decisions with significant legal effect are made about you without human review.

to exercise any of these rights, email us at info@subjectlocal.com. we will respond within 30 days. there is no charge for reasonable requests.

end users: if you received an SMS from a business using our platform and want to exercise your rights, please contact that business directly - they are your data controller.

10. cookies

our website uses cookies set by Google Analytics and Google Tag Manager to understand how visitors use the site. these cookies collect anonymised information including pages visited, session duration, and device type. they do not identify you personally.

you can opt out of Google Analytics tracking using Google's opt-out browser add-on, or by adjusting your browser settings to block cookies.

we do not use advertising cookies, tracking pixels, or third-party marketing cookies.

11. changes to this policy

we may update this privacy policy from time to time. when we make significant changes, we will notify active clients by email at least 14 days before the changes take effect. the "last updated" date at the top of this page will always reflect the most recent version.

continued use of the service after the effective date of any changes constitutes acceptance of the updated policy.

12. complaints

if you have a concern about how we handle your personal data and we haven't resolved it to your satisfaction, you have the right to complain to the Information Commissioner's Office (ICO):

• website: ico.org.uk
• phone: 0303 123 1113
• post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

we would always prefer to resolve any issue directly first - please get in touch at info@subjectlocal.com before raising a formal complaint.

13. contact us

for any questions about this policy or how we handle your data:

subject: local ltd
company no. 17229925
128 City Road, London, EC1V 2NX
info@subjectlocal.com