Privacy

Who we are

FlowPilot is an Irish sole trader business. For anything on this page — including a request to see or delete data we hold — email adam@flowpilot.ie and you will get a reply from a person.

Two different jobs at once

This distinction decides who is responsible for what, so it is worth being plain about.

For the business owner — the tradesperson who signs up — we are the data controller. They gave us their details and we decided what to collect.

For their callers, we are only a processor. When a member of the public rings a plumber and FlowPilot answers, that plumber's business is the controller of whatever the caller says. We hold it on their behalf and act on their instructions. If you are a caller wanting your details removed, you can contact us and we will pass it on, but the business you rang is the one that decides.

What we collect from callers

• Their phone number, which the network provides automatically
• Their name, if they give it
• The address the work is at
• What the job is, and when they want it done
• A written record of everything said on the call, both sides
• The time and length of the call
• Anything else the business has configured its receptionist to ask

Calls are not recorded

There is no audio file of your call, anywhere. Speech is converted to text as the call happens and only the text is kept. Nobody can play back a recording of you, because none exists.

Callers are told before they speak

Every call opens with this, before the business's own greeting, and it cannot be switched off:

“Thanks for calling O'Brien Plumbing. I'm their automated assistant — I'll take your details and pass them straight on.”

Somebody describing a problem in their home deserves to know what they are speaking to. That is why it is not configurable.

What we collect from business owners

• Email address and a hashed password, for signing in
• Business name, the trades they cover, and their service areas
• Their own mobile number or email, so we know where to send jobs
• Billing identifiers from Stripe. We never see or store card details — the payment page is Stripe's, not ours

Who else sees it

These companies process data on our behalf. They are not permitted to use it for anything except providing their service to us.

• Twilio — Carries the phone call and converts speech to text. Both phone numbers, and everything the caller says.
• Anthropic — Decides what the receptionist says next. The conversation so far, including any name and address given.
• Supabase — Database and sign-in. Everything above, plus the business's own account details.
• Vercel — Runs the website and the code that answers each call. Request metadata, including IP addresses in server logs.
• Stripe — Subscription billing. The business owner's billing details. Never a caller's data.

Where any of these process data outside the European Economic Area, they do so under the European Commission's Standard Contractual Clauses.

We do not sell personal data, and we never will.

How long it is kept

Caller details are erased after 365 days. That removes the written record of the call, the caller's phone number, and the job with their name and address. A record that a call happened, and how long it lasted, is kept so businesses can check what they have been billed for — but nothing identifying the caller remains.

A year is long enough for a tradesperson to find a customer who rang last season, or to answer “you fitted this in April and it's leaking”. It is not indefinite.

Your rights

Under the GDPR you can ask for a copy of your data, ask for it to be corrected or erased, object to how it is used, or complain to a regulator.

Erasure works today and does not wait for the year to be up.A business can delete a caller entirely from their dashboard, which removes the job and clears the caller's details from the call record.

Requests for a copy of data, or for it in a portable format, are handled manually at present — email us and we will deal with it within one month, as the GDPR requires.

If you are unhappy with how we have handled your data you can complain to the Irish Data Protection Commission at dataprotection.ie.

Cookies

We use a cookie to keep you signed in. That is all — there is no advertising, no analytics following you around, and nothing shared with anybody for marketing.

Changes

If this changes materially we will say so here and date it. The date at the top is when it was last altered.