Privacy Policy

The controller for Cailub's own website, account administration, enquiries, billing, security and business operations is Lyndon Mukandavire trading as Cailub.

Cailub is a trading name of Lyndon Mukandavire, a sole trader based in the United Kingdom at 60 Stockport Road, Manchester, M12 6AL, United Kingdom.

Because Cailub is established in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply to all of our processing, wherever you are located. Our lead regulator is the Information Commissioner’s Office (ICO), where we are registered under number ZC289253. If you are outside the UK, your local law may give you additional rights; these are set out in the Market Supplement for your country.

When we run a chatbot or automation for a business customer, that business is usually the controller of its visitors’ information and we act as its processor. Section 9 explains this.

We only collect information relevant to a documented purpose.

Account information

• First and last name.
• Email address.
• Country.
• How you signed in (Google or email).
• Account creation date.
• Login and security information.

Business information (optional)

• Business name and website URL.
• Industry.
• Job title.
• Company size.
• Business requirements and objectives.

Payment information

• Transaction references and invoice information.
• Billing details.
• Payment and subscription status.
• Relevant Stripe payment metadata. We never see or store your full card number.

Technical information

• IP address. Our own systems keep only a scrambled (hashed) version for rate limiting and abuse prevention; our hosting and sign-in providers keep IP addresses in their security logs for a limited time.
• Device and browser details.
• Security logs.
• Referral source.
• Error and performance information.
• A random chat ID stored in your browser, created only when you use a chat.

Service information

• Website URLs you submit.
• Publicly accessible website content submitted for analysis.
• Uploaded material.
• Chatbot configuration.
• Prompts, conversations and AI-generated responses.
• Appointments booked through a business’s chatbot (name, email, optional phone and notes, and the time booked).
• Messages between a website visitor and a business’s team when the visitor asks to speak to a person.
• Automation instructions.
• Customer support correspondence.

Business prospect information

• Business names and websites.
• Country and general business location.
• Public business information and industry.
• Professional contact information, where lawfully obtained.
• Contact source and previous contact history.
• Sales enquiries, marketing preferences and relevant business interests.

We may use information to:

• Create and administer accounts, and authenticate you.
• Deliver purchased services, including developing websites, operating chatbots, configuring AI assistants and agents, and running authorised automation.
• Crawl and analyse website information you submit.
• Provide customer support.
• Process payments and manage subscriptions.
• Keep the platform secure, prevent fraud and abuse, and diagnose faults.
• Improve product performance.
• Analyse demand for our services, identify business opportunities and understand geographical markets.
• Carry out lawful business-to-business (B2B) marketing.
• Meet our legal and accounting obligations.

Understanding who is interested in our services is an important part of how Cailub operates. We analyse activity on our own website and our own customer acquisition to understand:

• Which services receive the most interest and are most often purchased.
• Which industries and business categories generate enquiries.
• Which countries generate registrations and which markets show potential demand.
• How visitors discover Cailub.
• Which demos users create and which services customers request.
• Which pages and features lead to sign-ups and purchases.

These insights help us improve our services, plan our marketing and decide which businesses and geographical markets to focus on. We use aggregated and genuinely anonymised statistics wherever possible.

This analysis uses only information from our own website, accounts and sales activity. It never uses information we process on behalf of our customers (see section 10).

We may identify businesses that could benefit from our services using relevant, lawfully obtained business information. Sources may include public business websites, directories and registers, public professional profiles, published business contact details, public announcements, enquiries we receive and information submitted to us through Cailub.

This may include business name, website, industry, country, general location, publicly listed professional contact details and business requirements.

Where a prospect record includes an identifiable person, we:

• Establish an appropriate lawful basis, normally legitimate interests.
• Record where the information came from and why we hold it.
• Collect only what is relevant.
• Keep it accurate.
• Respect objections and your other rights.
• Delete or anonymise it when it is no longer needed.

If we collect your information from somewhere other than you, we will give you this privacy information within a reasonable period and at the latest within one month, or when we first contact you if that is sooner.

Information being publicly available does not mean we treat it as free to use for any purpose.

If we send your business a demo

We sometimes research a UK organisation’s public website, build a private demo of an AI assistant from it and email it to that organisation. When we do:

• We read a small number of public pages (such as the home, contact, about, services, pricing and FAQ pages), following robots.txt, and keep their text for up to 30 days. We check the public Companies House register to confirm the organisation is a company.
• We only email organisations at business addresses they publish themselves, never guessed, and only where the local rules allow it. In the UK that means limited companies, PLCs, LLPs and public bodies, never sole traders or partnerships unless they have agreed to hear from us. We do not email anyone whose website says they do not want unsolicited messages.
• We may find UK companies through the public Companies House register, then find their website and published business address.
• Our email says who we are, gives our postal address, says where we found your address and links to this notice.
• We send one introduction and at most two short follow-ups, and stop as soon as you reply. We do not use tracking pixels or tracked links; we record whether the demo link was opened, when, and how many messages were sent in the demo, and we check our own inbox for replies and undelivered-mail notices so that we stop when we should.
• The demo is private to its link and is deleted after 30 days.
• So that we never email the same organisation twice, we keep a permanent record that we have contacted it, stored only as scrambled (hashed) versions of its company number and website domain, with the date.
• You can opt out with the link in the email, by replying, or through the contact page. We then delete the demo, stop all contact and keep only a scrambled (hashed) copy of your email address and website domain on our do-not-contact list.

We keep a record of processing activities, as required by Article 30 of the UK GDPR, covering prospects, customers and the processing we carry out on our customers’ instructions.

Which markets we research

We only research and contact organisations in countries whose email rules we have reviewed and which allow business email without prior consent under conditions we follow (currently: GB, US, IE, NL, BE, CA, AU, NZ, SG, HK). In some of these, each email is approved by a person. Every other country stays switched off.

We use internal tools to organise and prioritise business opportunities. Criteria are business-level, such as industry, business size, geographic market, website functionality and quality, whether a website already has a chatbot, publicly described services, and expressed interest such as enquiries or demo requests.

Where scoring involves an identifiable individual, we explain it here, rely on legitimate interests supported by an assessment, respect objections and avoid special category data.

Lead scoring uses business-level facts only. We do not use AI to infer personal characteristics of individuals.

Scores are used only to prioritise potential business opportunities. We do not make significant decisions about people based solely on automated profiling.

We send transactional messages needed to manage your account or service, such as verification emails and order updates. These are not marketing.

Optional marketing is managed separately. Agreeing to our Terms and Conditions is never treated as consent to marketing.

We distinguish between corporate subscribers (such as limited companies) and individual subscribers (including sole traders and some partnerships), and apply the UK GDPR and PECR rules for each recipient type and channel. For individual subscribers we send electronic marketing only with consent, unless a valid legal exception applies.

Every marketing message identifies Cailub and includes an easy way to opt out. We screen marketing calls against the TPS and CTPS registers where required and do not make automated marketing calls unless legally permitted.

We keep a suppression list so that people who opt out are not contacted again. You can change your marketing preferences at any time from your dashboard or by emailing us.

Accepting our Terms and Conditions does not provide consent for every type of processing. Where we rely on legitimate interests, we document the purpose, why the processing is necessary and how we have balanced it against your rights. You can ask us for details.

Cailub is an independent controller for customer accounts, our own enquiries, customer billing, business administration, platform security, and our own marketing and prospecting.

Cailub acts as a processor when it handles a business customer's personal data on its instructions, for example chatbot conversations, website enquiries, customer databases, uploaded personal information, customer-authorised automation and information about the customer's website visitors. The customer's documented instructions and our Data Processing Agreement apply.

This includes appointments booked through a business’s chatbot and messages exchanged with that business’s team after a visitor asks to speak to a person. The business decides who on its team can read and reply to those chats.

In those cases the business customer is responsible for its lawful basis, privacy notices, any required consent, retention periods, lawful instructions and configuring its AI services responsibly.

If a business customer buys AI Appointment Booking, its owner can connect the business’s own Google Calendar. Google shows exactly what Cailub asks for, and the owner can say no. We ask only for what booking needs:

• The list of your calendars, so you can choose which one bookings go into.
• Your free and busy times in that calendar, so visitors are only offered times you are free. We see that a time is busy, not what the event is.
• Permission to add, move and delete events, which we use only for appointments booked through your chatbot.
• Your Google account’s email address, so you can see which account is connected.

Cailub’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, we use Google Calendar data only to provide and improve the booking feature you can see in your dashboard. We do not sell it, use it for advertising, use it to train AI models, or use it for credit or lending decisions. No one at Cailub reads it unless you ask us to for support, it is needed for security or to investigate abuse, or the law requires it.

Your Google sign-in tokens are stored encrypted and are never sent to your browser or your website. You can disconnect at any time in your dashboard, which revokes our access with Google and deletes the tokens; you can also remove access from your Google Account’s security settings. If the AI Appointment Booking subscription ends, we revoke access and delete the tokens after 30 days.

If a business uses AI Phone & SMS, Cailub handles its calls and texts on its behalf, as its processor. The business is the controller and its own privacy notice applies to you.

• Calls: an AI voice agent answers or makes the call and always says at the start that it is an AI assistant. We keep the caller’s number, call times and length, a summary, any message or callback request, and a transcript unless the business has switched transcripts off. Calls are recorded only if the business has switched recording on, and the agent says so at the start of the call.
• Transfers: if the business has set this up, the agent may put you through to a member of its team. If nobody answers, the agent says so and offers to take a message or arrange a callback.
• Texts: we keep the message, the number it went to or came from, and whether it was delivered. Texts about something you asked for, such as a booking, its reminders or a callback, are service messages.
• Marketing texts: sent only where the business has recorded your consent (with where and how you gave it), or where the law in your country allows it for existing customers. Every marketing text explains how to opt out. Reply STOP, or use the opt-out link, and marketing texts stop straight away; we keep a record of the opt-out so it is honoured.
• Feedback: after an appointment you may get a link to rate it. Your rating and comment go to the business only and are not published.

Calls and texts are carried by Twilio, and the AI voice agent is provided by Retell AI. Both process the information in the United States.

Phone number verification: in many countries the telephone regulator requires details of the business (and sometimes of a named representative) and supporting documents before a number can be issued. The requirements are read live from Twilio. We collect only what the regulator requires, encrypt it, and send it to Twilio for that purpose only. We never alter documents or submit information we have not been given.

US texting registration: US mobile carriers require businesses that text US numbers to be registered (A2P 10DLC through The Campaign Registry, or toll-free verification). If a business asks us to register it, we collect the business details, a named authorised contact and example messages that carriers require, encrypt them, and send them to Twilio, which passes them to The Campaign Registry and the carriers for that purpose only. We keep the record of what was submitted, the fees approved and paid, and the decision while the registration is in use and for 2 years afterwards.

Electronic signing: when you sign a document in your Cailub dashboard, we record your typed full name, your account, your verified email address, the time, your network (IP) address and browser type, and a fingerprint (SHA-256 hash) of the exact document you signed, and add them to an evidence page in the signed PDF. Our lawful basis is the contract with you and our legitimate interest in being able to show what was agreed.

AI safety monitoring: to protect businesses, their customers and our platform, we screen chatbot messages, call transcripts, texts and knowledge content for attempts to manipulate the AI, and record security events. An event keeps only a short extract with email addresses, phone numbers, card-like numbers and secrets masked. Our lawful basis is our legitimate interests (and those of our business customers) in keeping the service secure. Safety events are kept for 2 years, then deleted.

Conversation and call summaries: after each chatbot conversation and each call, an AI system writes a short summary for the business, which we email to it (or include in a daily digest) unless it switches this off. Summaries are written only from that conversation, and are told not to repeat email addresses, phone numbers or payment details.

The "Talk to Laila" demo on our website: if you choose to start it and agree to the notice shown, your microphone audio is processed in real time by Retell AI (United States) so Laila can reply. We do not record the call or keep a transcript, and Retell is set to keep only basic call details. We keep that a demo call happened, when, how long it lasted and a daily-changing scrambled network identifier, to apply fair-use limits, for 13 months. Our lawful basis is your consent, which you can withdraw by ending the call.

Information belonging to a Cailub customer is never automatically repurposed for Cailub's own lead generation. We do NOT use any of the following to create our own sales prospects or cross-customer marketing profiles:

• Customer chatbot conversations.
• Recruitment applications and uploaded CVs.
• Customer email lists.
• Customer website visitor information.
• End-user personal information.
• Confidential customer documents.

We keep these datasets separate: (A) our own website and sales information; (B) customer account and billing information; (C) third-party business prospect information; (D) customer chatbot and end-user personal data; and (E) customer documents and confidential information. Each is used only within its own purpose and lawful basis.

We may use genuinely anonymised, aggregated technical metrics for product improvement. We do not describe pseudonymised personal data as anonymous.

We do not use identifiable end-user conversations, confidential business information or personal records processed on behalf of customers to train general-purpose AI models, or for unrelated cross-customer development, without an appropriate lawful basis and the required authorisation.

We may use aggregated usage statistics, error rates, performance statistics, general feature usage trends and genuinely anonymised operational information to understand demand and improve reliability.

Any other use of identifiable information would be separately assessed, explained to you and lawful.

We use strictly necessary cookies to keep you signed in and the site secure. Non-essential technologies are only activated after you agree to them in our cookie banner, and you can change your choice at any time using "Cookie preferences" in the footer.

We do not secretly build identifiable profiles of anonymous visitors, and we do not use device fingerprinting to get around your cookie choices. Full details are in the Cookie Policy.

The Subprocessor Register lists each provider’s role, the information involved, where it is processed and the transfer safeguard used.

Our main database is hosted in the EU (Stockholm, Sweden) and our application servers in the EU (Frankfurt, Germany). Some processing happens in the United States: AI replies are generated by Anthropic, website pages are read by Firecrawl, and our providers may access, support or back up information there.

We distinguish between primary storage location, backup location, technical processing location and support access location, and show each provider’s locations in the Subprocessor Register. We do not claim that all data is stored and processed only in the UK.

Where a restricted international transfer takes place, we use a lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with any required transfer risk assessment.

We keep information only for as long as we need it for the purpose we collected it for, then delete or anonymise it. We do not keep personal data indefinitely.

We use appropriate technical and organisational safeguards. Currently in place: encryption in transit (HTTPS); passwords handled by our authentication provider and never stored by us in plain text; a database that only our own servers can read, with every request checked against the customer’s organisation; two-factor authentication for administrators; server-only storage of secret keys; an audit log of administrative actions; and payment card details handled entirely by Stripe.

We are reviewing further controls, including encryption at rest settings, backups, access monitoring and incident response procedures, with each provider. No system is perfectly secure and we do not claim absolute security.

Depending on the circumstances, you have the right to:

• Access the personal information we hold about you.
• Have inaccurate information corrected.
• Have information erased.
• Restrict how we use it.
• Data portability, where applicable.
• Object to processing, including direct marketing, which we will always honour.
• Withdraw consent at any time.
• Not be subject to solely automated decisions with legal or similarly significant effects.

Send requests to cailub.solutions@gmail.com, or use our contact form and choose "Privacy or data protection request". You can also download a copy of your account data from your dashboard at any time. We will respond within one month, which may be extended in limited circumstances.

If your request relates to a chatbot run by one of our business customers, that business is usually the controller. We may pass your request to them or ask you to contact them, and we will help them respond.

You can make a data protection complaint using our contact form (choose "Complaint" or "Privacy or data protection request"), by email, or in writing to our business address. We will:

1. Acknowledge your complaint within 30 days.
2. Make appropriate enquiries.
3. Respond without undue delay.
4. Keep you informed of progress.
5. Explain the outcome without undue delay.
6. Keep a record of the complaint and how it was resolved.

You also have the right to complain to the Information Commissioner’s Office, or any successor regulator (ico.org.uk, 0303 123 1113), or, if you live outside the UK, the supervisory authority where you live. We would appreciate the chance to resolve your concern first.

Cailub operates from the UK and serves business customers in these markets: United Kingdom, European Union, United States, United Arab Emirates, Canada, Australia. We do not claim compliance with every privacy law in every country, but we will respect the rights that apply to you. The Market Supplement for your region gives the detail.

Quebec and the DIFC and ADGM free zones are not yet supported.

Please contact us first so we can try to resolve your concern. Requests about data a business customer controls, such as conversations with that business’s chatbot, may need to be passed to that business.

Our services are for businesses and are not directed at children. We do not knowingly collect children’s personal data for our own purposes.

Business customers who deploy a chatbot that children are likely to use are responsible for assessing that use, including whether the ICO Age Appropriate Design Code applies.

Cailub does not make significant decisions about individuals solely by automated means.

Business customers who use AI to make decisions that have legal or similarly significant effects on people must comply with the rules on automated decision-making in the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.