Privacy policy

1. Who we are and who controls your data

Minuted is a virtual landline service for small businesses. It is a product of Made Purple Ltd, a company registered in England and Wales with company number 11151840, whose registered office is Keystone Innovation Centre, Croxton Road, Thetford, Norfolk IP24 1JD. Our VAT number is 305187615. In this policy "we", "us" and "Minuted" mean Made Purple Ltd. We are registered with the Information Commissioner's Office under registration number ZA768117.

For the personal data in your account, such as your name, email and billing details, Made Purple Ltd is the data controller. For the content of your calls, the position is different and we explain it below.

If you have any question about this policy or your data, email us at [email protected] and a person will help.

2. The two kinds of data we handle

It helps to separate two things. The first is your account data: the information you give us to set up and run your Minuted account. We are the controller for that.

The second is your call content: the recordings, transcripts, summaries and todos produced from calls to your number. That content belongs to your business and often contains personal data about the people who call you. For that content you are the controller and we act as your processor. This policy covers your account data. The people who ring you are covered by the separate caller privacy notice.

3. What personal data we collect

We keep this to what we need to provide the service:

• Your name, business name, email address and the mobile number your calls divert to
• Your business address, which the carrier needs to issue a UK landline number and to hold an emergency service address
• Your login details, held as a securely hashed password, and your two-factor settings if you turn them on
• Billing information, handled by Stripe, including your plan and payment records (we never see or store your full card number)
• Records of how you use the service, such as call logs, answered minutes and settings changes, which we use for billing and support

4. How we use your data and our lawful basis

We use your account data to provide the service you have signed up for, to take payment, to send you the notes from your calls, to support you and to keep the service secure.

Our lawful bases under UK GDPR are: performance of our contract with you, to run your account and provide the service; legal obligation, to keep tax and accounting records; and our legitimate interests, to secure the service, prevent fraud and improve how Minuted works. We do not sell your data and we do not use it for advertising.

5. Call recordings, transcripts and summaries

Every answered call to your Minuted number is recorded. By default callers hear a short greeting first that tells them the call may be recorded, which you can customise or turn off in your settings. The recording is transcribed and summarised into a plain English note and a short list of todos, which we send to you and show on your dashboard.

These recordings and notes are your business records. We store and process them on your behalf and under your instructions. We do not use the content of your calls for our own purposes.

6. Controller and processor roles for call content

For the content of your calls you are the data controller and Made Purple Ltd is your data processor. That means you decide what happens to your call content and we handle it on your instructions, which is why you can play back and download your calls, and ask us to delete them.

As the controller you are responsible for having a lawful basis to record your callers and for telling them how their data is used. Our recorded greeting and the caller privacy notice are there to help you meet that duty. Our terms of service set out this arrangement in full and act as the processing terms between us.

7. How your calls are written up (Purple Scribe)

Transcription and summarisation are done by Purple Scribe, another Made Purple Ltd product. When a call ends, the audio is passed securely to Purple Scribe, which returns the transcript, the summary and the todos. Purple Scribe is part of the same company, runs under the same security controls and processes the audio only to produce your notes.

Purple Scribe is the same engine trusted by the NHS, local government and the prison service for secure and ethical use of AI. Your call audio is not used to train third-party AI models.

8. Where your data is stored

Your call content stays in the UK. Recordings are made on our own UK-hosted telephony infrastructure, held in private object storage in a London region, and your calls are carried by a UK carrier. The application and database also run on UK-hosted infrastructure.

Three of our suppliers are global companies. Stripe processes payments, Postmark sends our email and ElevenLabs turns the greeting text you write into audio, and each may process limited data outside the UK, including in the United States, under approved safeguards for international transfers. Ask us and we will tell you which safeguard applies to a particular supplier and how to see a copy of it. We keep the personal data they handle to the minimum needed: ElevenLabs receives only the greeting text you choose to synthesise, never your calls.

9. How long we keep your data

We keep your account data for as long as you have an account with us. When you close your account we delete or anonymise your personal data within a reasonable period, except where we must keep it longer by law.

Our retention policy is to keep call recordings, including voicemail, for six months, and transcripts, summaries, todos and the content of text messages for twenty-four months. An automatic purge enforces these periods. If you want a call removed sooner, ask us and we will delete it. We keep billing and tax records for six years to meet HMRC requirements.

Some supporting data has its own lifetime. Greeting audio you create is kept while your account is open. Documents supporting a number port are kept for at least a year after the port, as porting rules require, and then deleted. Security and audit logs are kept while your account is open and are removed or anonymised when we erase your data at your request. Data we hold about partners in our referral programme is kept for the life of the partnership, with payment records kept for six years.

When data is deleted, copies in our encrypted backups expire automatically within 30 days.

10. Who we share data with

We do not sell your data. We share it only with the suppliers that make the service work, each under a contract that requires them to protect it and use it only on our instructions:

• Simwood, our UK telephony carrier, which provides your number and carries your calls
• DigitalOcean, which provides UK-based hosting and the object storage for recordings
• Purple Scribe, which transcribes and summarises your calls (part of Made Purple Ltd itself, so this step never leaves our company)
• ElevenLabs, which turns the greeting text you write into natural speech (it receives only that text, never your calls, and may process it in the United States under approved safeguards)
• Stripe, which processes payments and handles VAT
• Postmark, which delivers our email such as your call notes and receipts
• Cloudflare, which sits in front of our websites for security and performance and provides our cookie-free, aggregate-only website statistics

11. Your rights under UK GDPR

You have the right to:

• Ask for a copy of the personal data we hold about you
• Ask us to correct data that is wrong or incomplete
• Ask us to delete your data, subject to records we must keep by law
• Ask us to restrict or object to how we use your data
• Ask for your data in a portable format
• Withdraw consent where we rely on it, without affecting past processing

12. Security

We protect your data with encryption in transit, encrypted private storage for recordings served only through signed links that expire within minutes, hashed passwords, brute-force protection on login and optional two-factor authentication. Access to systems is limited to the people who need it and billing and settings changes are logged.

Minuted is built and run under Made Purple's information security management system. Made Purple Ltd is certified to ISO 27001 and Cyber Essentials Plus.

13. Cookies and the website

This marketing website uses no advertising trackers and sets no cookies of its own. The one exception is when you follow a Minuted partner's link: we then ask, and only if you agree do we set a single first-party referral cookie that remembers the partner code for 30 days so your first month free is applied when you sign up. It is never used for advertising or to track you across sites, and you can always type the code in by hand instead. We measure how the website is used with Cloudflare Web Analytics, a cookie-free tool that collects anonymous, aggregate statistics only and cannot identify you. You can turn it off, and read the full detail on the referral cookie, on the cookie policy page. When you log in to the Minuted app we set one strictly necessary cookie to keep you signed in.

14. How to contact us or complain

To exercise any of your rights or to ask a question about this policy, email [email protected]. We will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113, quoting our registration number ZA768117. We would rather you told us first so we can put things right.

For complaints about the service itself rather than your data, see the complaints page on this website, which also explains the independent dispute resolution scheme available to you.