AI and your data
How an assistant on your website handles your customers' information, in plain English.
Who is responsible
TDB Media Solutions is Tom, a sole trader, registered with the Information Commissioner's Office (registration ZC261420). When an assistant runs on your website, you are in charge of your customers' information and I look after it on your behalf.
A data processing agreement, signed before it goes live
Before an assistant answers anyone on your site, we both sign a short data processing agreement. It says what information is handled and why, that I only use it to run the service for you, how it's kept secure, who else handles it, that I'll tell you within 48 hours if anything goes wrong, and what happens to it when the service ends.
It only answers from your information
The assistant answers from two things you approve: your own website, and a facts sheet we write together (your services, the areas you cover, your hours, and your prices exactly as you want them said). It doesn't go anywhere until you've read what it knows and said yes, and if either changes it stops until you approve again.
Every reply is checked before a visitor sees it. A price or time that isn't in your facts, a quote or estimate, a promise of when someone will call or arrive, or a link is never shown: the visitor gets a plain fixed reply instead. Its first message says it's an automated assistant and that a person always calls back.
It asks for three things only: a name, a phone number, and what they need. Never payment details or anything more personal.
Where enquiries go
Each completed enquiry goes into your own CRM, in your name, and to you by email (and WhatsApp if you'd like). If the CRM is ever unavailable, you still get the email: an enquiry always reaches a person.
Who else handles it
- Cloudflare runs the assistant and stores conversations. The database is kept in the EU (Cloudflare doesn't offer a UK-only option).
- Anthropic provides the AI model that writes the replies. Conversation text is sent to its API in the United States to write each reply.
- Your CRM (for example HubSpot) holds the enquiries, in your own account.
- Resend sends each enquiry to you by email. It is based in the United States.
- Twilio sends texts and WhatsApp messages, where your service includes them (United States and elsewhere).
- Google Workspace is my own email, for anything we write to each other about your enquiries (EU/UK).
Where information leaves the UK, it's covered by the UK's adequacy rules or the standard UK transfer agreements, set out in our data processing agreement.
Deleted after 90 days
Conversations, and the names and numbers in them, are deleted from my systems 90 days after the conversation. Enquiries in your CRM are yours and stay there for as long as you want them.
Questions
Ask me anything about this before you decide: [email protected], or text Tom. How I handle information about businesses I contact is in the privacy notice.