Privacy: what we hold, why, and for how long.

1. Enquiries through this site

When you fill in the enquiry form we receive your name, business name, phone number, email address, what you are interested in and whether you already have a website. We use that to ring you back, build a preview if you asked for one, and follow up about it. The form is delivered by our hosting provider and the details are stored in our customer records. We keep enquiry details for 12 months from the last contact, or for as long as you are a customer.

We do not sell or share enquiry details with anyone for their own marketing.

Keeping robots out, and the free site check. The enquiry form, the free site check and the page after it use Cloudflare Turnstile to check that you are not a robot, which tells Cloudflare your IP address and browser details. The site check fetches only the address you type, once, and we store nothing from it.

2. If you ring the demo number

Calls to 020 8058 5348 are answered by our AI assistant. It tells you at the start that it is an assistant and that the call is recorded. We keep the recording and transcript for the same periods as for customer assistants below, and use them only to follow up your call and to improve the assistant's script.

Trying a sample receptionist on our website. If you make a free sample on our website, we keep the details you type or let us read from your own website (your business name, trade, what you do, area, hours and, if you give it, your name), so the sample can answer as your business would. Cloudflare Turnstile checks that you are not a robot, and we keep your internet address only as a one-way code, so each visitor gets one try. The sample call runs on Vapi, which hears your voice live so it can reply. We switch its audio recording off, so no recording of your voice is kept, but Vapi may keep a written transcript of the call on its own systems. Ask us at any time to delete your sample.

3. Calls handled by the AI receptionist for our customers

When a business uses our AI receptionist, that business is the data controller for its callers' data and Frame Empire is the data processor, acting under a data processing agreement that forms part of our Terms. We process the caller's voice, name, number and the reason for the call in order to take the message, text the caller, send the summary to the business, and transfer the call if asked.

Callers are told at the start of every call that they are speaking to an assistant, and where the call is recorded they are told that too. The call is recorded. Where a business tells us its callers may share health or other sensitive information, recording is turned off for that assistant.

4. How long call data is kept

• Call recordings: 30 days, then deleted.
• Transcripts and call summaries: 12 months, then deleted.
• The text and email summaries sent to the business are the business's own records and are kept by them.

5. Who we use to provide the service

We use a small number of suppliers, each under contract and each processing data only on our instructions. By category:

• Telephony providers, to carry the calls and send the texts.
• Speech and language model providers, to understand what the caller says and to reply.
• Hosting providers, for this website, the enquiry form and our customer records.
• Payment providers, to take payment and to issue invoices and receipts.

A current list of the named suppliers is available on request by emailing hello@frameempire.co.uk. Some of these providers process data outside the UK; where they do, transfers are covered by the UK's international data transfer agreement or an adequacy decision.

6. If we ring your business

Our team rings UK businesses to offer a free website preview and the AI receptionist. We get your business name, trade, town and the phone number you publish for customers from public business listings. If you say yes on a call, we ask for an email address for your business when we do not already have one, and use it to send you a first idea of your website from hello@frameempire.co.uk before your next call, and later your preview; we keep it on our record for your business. That first idea is made only from details your business already shows in public: its name, phone number and town, its star rating and number of reviews on Google, with at most two short reviews shown under the reviewer's first name only and credited to Google (we take these through Google's own service for businesses, never by copying them from Google Maps), and the logo and colours from its own website. It sits at a private link that is kept out of search, and we take it down after 30 days unless you go ahead with us. Every text and email we send tells you how to stop. We rely on our legitimate interest in offering our services to businesses; our assessment of that interest is written down and available on request. Before we make a sales call, the number is checked against the Telephone Preference Service and the Corporate Telephone Preference Service and against our own do-not-call list; a call you asked us to make, or a call about a project you have with us, is checked against our do-not-call list. The caller always gives their name and ours. Our calls, whether to offer our services or about a project you have with us, normally come from 020 8058 5348, or from a Frame Empire mobile number given to one of our team, and are carried by our telephony provider, Twilio: we keep the number called, the number it came from, the time and the length of each call on our record for your business. If you ring 020 8058 5348 back, our AI assistant answers, as in section 2. If you ring a Frame Empire mobile back, the person it belongs to is rung in our CRM first, then our AI assistant answers. If you are a sole trader or a partnership you have the same protection as a consumer: we do not text or WhatsApp you until we have spoken, every message tells you how to stop, and one word from you ends the contact. If you tell us you are not interested we record that and do not ring again; we keep the number only so that we do not. To stop our calls, tell the caller or use the complaints form; we stop at once. If your number has been registered with the TPS or the CTPS for 28 days or more, you can also complain to the TPS at tpsonline.org.uk/complaint, which passes complaints to the ICO. Ask us at any time what we hold and where it came from.

Call recordings. Calls from Frame Empire to your business may be recorded for training and quality, and to show that our calling rules are followed. You hear a short notice as the call connects. Only our director listens to the recordings, and each one is deleted 90 days after the call.

Your right to object. Object on the call or at hello@frameempire.co.uk, and we delete the recording of that call. You can complain to the Information Commission.

7. If you apply to work with us, or work with us as a setter or closer

Who is responsible. Frame Empire Ltd (Company No. 16163944, 4 Thameshill Avenue, Romford, Essex, RM5 3BU) decides how this information is used. Contact: hello@frameempire.co.uk. We have not appointed a data protection officer.

What we collect when you apply. Your name, nickname, address, WhatsApp number, email and country of residence; a short voice or video recording; the IP address and browser details sent with your application, and an error report if sending fails; your training progress and quiz results; which version of our explanation of how working with us works you read before applying, with a fingerprint of its text; and the agreement you sign, with your nationality, which it names, and the IP address and browser details recorded when you sign it.

Only if we decide to go ahead. We send you a private link, and through it you give us pictures of both sides of a photo identity document and a photo of you holding that document, and, if you choose, a photo of you for your CRM profile. If you will work from the UK and are not a British or Irish citizen, you can also give us your share code there. Nobody we turn down has sent us their identity document.

Why we use it, and our legal basis.

• To decide on your application (your photo, recording, training results and details): our legitimate interest in choosing the right people.
• To confirm you are the person we give client data to (the ID pictures and the photo of you holding it): our legitimate interest in keeping client data safe. A person compares them by eye. We do not use face-matching software on them, and we make no decision about you by automated means.
• To prevent abuse of the application form (IP address and browser details): our legitimate interest in keeping the form secure.
• If you will work from the UK, to check your right to work before you start: a legal obligation under the Immigration, Asylum and Nationality Act 2006 and the Immigration (Restrictions on Employment) Order 2007 or, where that law does not apply to our arrangement with you, our legitimate interest in making sure nobody works for us illegally. The check depends on where you will work, not where you live, and on your immigration status: if you hold an eVisa it must be the Home Office online check with your share code, in which case we receive your right to work profile, including your photo, from the Home Office. The other checks are a digital check by a provider on the government's register, a check of your original documents, which you may post to us and we return, or, if you have an application with the Home Office, a check with the Home Office Employer Checking Service. If a provider uses facial recognition, that comparison is biometric data; we rely on Article 9(2)(b) of the UK GDPR and paragraph 1 of Schedule 1 to the Data Protection Act 2018 and keep the policy document that requires. We keep the evidence the law requires for the check we run and no more: wherever your status allows a share code or a digital check, we hold the result of that check rather than a copy of your document. The comparison of your photo can always be done by a person instead of by software. If your permission to work is limited in time, we check again before it ends.
• To run the working relationship and pay commission: our contract with you. That includes complaints made about calls you made, your own complaints, and the record of any pause of your access under clause 10.2 of your agreement, with its reasons and outcome.
• To check your name against the UK Sanctions List before your first payment, and again each quarter: our legal obligation under UK sanctions law and our legitimate interest in not dealing with anyone sanctioned. We record only the date, the list and the result.

Do you have to give it? You do not have to apply. If you do and we decide to go ahead, we cannot approve you without the identity pictures (or, in the Philippines, the video check below), and if you will work from the UK the law does not allow us to engage you without a right to work check.

Who sees it. Only our director, or someone we authorise in writing. If you applied with a team's invite code, that team's manager also sees your name, nickname, country of residence, your message, the role you chose, your quiz results and how far your training got, to give us their view, and, once we have decided, our reason; never your files, contact details, address or nationality. Files are kept in private storage with our providers Supabase (database and file storage) and Netlify (our application server), who act only on our instructions; where a provider processes data outside the UK, the transfer is covered as described in section 5. A file can only be opened through a private link that stops working within minutes, and every time a file is opened we record who opened it and when. For an online right to work check we give the Home Office your share code and date of birth. We never send your files by message and never share them with the businesses you call.

While you work with us. Our CRM records the calls and outcomes you log, your notes and the leads you work; your sales, handovers and commission statements; your training progress and quiz results; the end-of-day reports you choose to send; your messages in the team chat; complaints you log, complaints about calls you made, and your account of them; and any pause of your access, with its reason, the facts you were told, your answer and the outcome. Anything else, such as your online status, a history of your connection speed checks, leaderboards or automatic coaching notifications, is recorded only if we switch it on, and the CRM tells you what is switched on at your first login and again after any change, and keeps a record of when you saw it. Each outcome you log carries the time it was logged, but there is no clock-in and no record of how long you work, and nothing alerts anyone when you have been quiet. We use it to run the working relationship and pay commission (our contract with you), and to show that calls followed the calling rules and keep the CRM secure (our legitimate interests).

Who sees it while you work with us.

• You see everything the CRM records about you, including your own figures and commission statements.
• Andrei, our director, sees all of it, for everyone, because Frame Empire is responsible for the work, the pay and the law. Only he decides on complaints and pauses, and only he opens full applications, agreements and identity documents.
• Your team manager, if you joined a team manager's team. A team manager is a fellow contractor with Frame Empire, paid nothing for recruiting; since 21 October 2026 they earn an override of 5% of the price the client pays on their team's sales (never on their own), paid from Frame Empire's part and never from yours. They have a narrow view in the CRM so they can share out the team's leads, assign previews and help when you ask. They see each person's name, nickname and role; the leads each person works and what is logged on them (outcomes, notes, callbacks and prices); the previews handed over, and who they go to; the team chat; the end-of-day reports each person chooses to send, with the day's figures the CRM adds; whether each person has passed the Essentials; that someone's access is paused, never why or the date it will be decided by; and, for an application sent with the team's invite code, what the paragraph above describes. They never see anyone's commission figures; complaints or anyone's account of one; why someone's access is paused; identity documents, agreements, right-to-work records or PINs; anyone's own phone number or home address, or the notes Andrei keeps on their profile; or the rest of a person's training progress, unless that person chooses to share it. Team managers sign in with two-step sign-in. For it we keep when they set it up, any reset, and which code was used last and how many were wrong, so each code works once; their key is sealed on our server and never shown again after set-up.
• Your team sees your messages in the team chat; your sales, previews and handovers that day in the CRM's Live now bar, by nickname; and how many of the team are online, as a number, never who. When a preview is handed over, the closer sees the lead and the setter's notes, and the setter sees who has it and how it ends.
• ECHO, our team assistant, is software we run, with its own narrow login. It reads names, roles and teams, the leads without notes or addresses, and who logged which outcome and when, to answer questions and to cheer sales and previews in the team chat without naming anyone. It never sees identity documents, agreements, PINs, the team's phone numbers, applications, complaints or pauses. Numbers and email addresses are blanked from what you ask it.

How long we keep it.

• Application declined: your files are deleted straight away. The rest of your application, and any agreement you signed for it, is deleted 9 months after our decision if you live in the UK, and 6 months after it if you live elsewhere, unless a legal claim has been made or is expected.
• Application not finished: the files you uploaded are deleted 30 days after you started, and the details you typed, with any agreement you signed, 90 days after you started.
• Application sent but not decided: if we have not decided within 60 days of you sending it, it lapses. Your files are deleted then, and the rest is kept and deleted as for a declined application.
• Application approved: your photo, ID pictures, the photo of you holding your ID and your recording are deleted within 30 days of approval. We keep a record that we checked your identity, and when, but not the pictures themselves. If you work from the UK, the right to work check below is a separate record kept for a different length of time, and on one of the four routes that record is a copy of your document.
• IP address and browser details sent with your application: deleted 30 days after you started it. A report of a failed send is deleted after 30 days.
• Right to work evidence (UK work only): kept while you work with us and for two years after, then deleted. What this is depends on the check the law allows for you: the Home Office’s answer to your share code, or the report from a provider on the government’s register, or the Home Office Employer Checking Service’s answer. Only a check of your original documents leaves us holding a copy of the document itself, so we use one of the other routes wherever your status allows it. A note of the date and the kind of check stays with your record.
• Your agreement, with the details recorded when you signed it, the record of your identity check, commission records and the record of any pause of your access: six years after we stop working together, for tax and possible contract claims.

Your rights. You can ask for a copy of your information, and ask us to correct it, delete it or limit how we use it. You can object to anything we do on the basis of legitimate interests. You can complain to us with the complaints form or at hello@frameempire.co.uk. If you work with us we acknowledge it within 2 working days and answer in writing within 10 (clause 12.10 of your agreement); otherwise by the end of the next working day and within 15 working days. You can also complain at any time to the UK regulator, the Information Commissioner's Office (ICO), at ico.org.uk/make-a-complaint.

If you live in Nigeria. We process your application under section 25(1)(b)(i) of the Nigeria Data Protection Act 2023 (steps you ask us to take before a contract) and our legitimate interests under section 25(1)(b)(v). Your data goes to the United Kingdom, and to our providers as described in section 5, on the basis in section 43(1)(b) of that Act, and we keep a record of that basis. We delete your files within the periods above. We keep your agreement, the record of your identity check and commission records for six years to meet tax rules and to defend legal claims. You can complain to the Nigeria Data Protection Commission (ndpc.gov.ng), and nothing in your agreement takes that right away.

If you live in the Philippines. Before you upload your identity document we ask for your consent, because the Data Privacy Act of 2012 treats government-issued identifiers as sensitive personal information. You can refuse, or withdraw it before you send; we then check your ID with you live on a video call instead and keep no copy. You can complain to the National Privacy Commission (privacy.gov.ph).

If you work from Nigeria, the Philippines or Pakistan. The leads you see in the CRM stay on our servers; you reach them over an encrypted connection. Because UK adequacy regulations do not cover those countries, your agreement includes the UK International Data Transfer Agreement (version A1.0) as its Schedule 1, and we have written a transfer risk assessment for each country. A summary of each is here, and the full assessment is yours on request.

If you live elsewhere, you can also complain to the data protection authority where you live, where there is one.

8. If you pay us

Paying an invoice or a payment link sends your name, your business name, your email address and your billing address to Stripe, who take the payment for us. Your card details go to Stripe and never to us: we see the amount, the last four digits and whether it cleared, nothing more. We keep the invoice and the receipt for six years because tax law requires it. We rely on the contract between us to take the payment, and on our legal obligation to keep the records.

8a. If you buy a Get Found package

You add us as a manager on your Google Business Profile and a user on Google Search Console; you never give us a password. While we have that access we can see what those accounts show, including the reviews people have left you. We use it only to do the work you bought, we never change, reply to or remove a review, and we keep no copy of what we see once our access ends. We remove our access when the work is done (for Get Found + Search after the 30-day check, for Get Found Everywhere after the 60-day check) unless you ask us to stay.

8b. If we show your site as an example of our work

Once your site is finished and live, we may show it, your business name and your logo as an example of our work: on our website, on our social media and to businesses we are talking to. If you trade under your own name, or a name that identifies you, that is personal data about you. We rely on our legitimate interest in showing the work we do. You can object at any time by emailing hello@frameempire.co.uk, and we take it down within 7 days. We never show a preview before it is live, anything you gave us in confidence, or your customers' details. If you became a client before 25 October 2026, we ask you first, and nothing of yours is shown until you have said yes.

9. If you message us on WhatsApp

Who answers. Once it is switched on, messages to our WhatsApp number, +44 7886 705438, are answered first by ECHO, Frame Empire's automated assistant. Until then a person from the team answers them. ECHO says it is an assistant before it replies and never claims to be a person. It answers general questions about our services from our published information only, and passes anything else, such as accounts, payments, changes to your work, complaints and refunds, to a person from the team. The team can also read the chat and reply themselves.

Reaching a person. Ask for a person at any time, in your own words. ECHO tells the team straight away and then stays quiet in that chat until the team has picked it up. You can also email hello@frameempire.co.uk or use the complaints form.

What we keep, and why. Your WhatsApp number and profile name, your messages and our replies, when each was sent, and whether you asked for a person. If you send a voice note, it is turned into text so ECHO can answer it; we keep the text, and the speech-to-text provider deletes the audio once the text is back. If you work with us, our CRM matches your number to your record on our own server, so ECHO only ever sees your first name or nickname, never your number. We rely on our legitimate interest in answering the messages people send us, or, where you are a customer or work with us, on our contract with you. Chat records are kept for 12 months and then deleted automatically.

Who handles the messages for us.

• Meta (WhatsApp), which carries the messages. Your use of WhatsApp itself is also covered by WhatsApp's privacy policy.
• 360dialog GmbH, Germany, our WhatsApp business provider, which connects our number to our systems.
• Anthropic, whose Claude model writes ECHO's replies.
• Speechmatics, UK, which turns voice notes into text, processing them in the EU.
• Supabase, which stores the chat records.
• Netlify, which runs our application server.

Outside the UK. Some of these providers process messages outside the UK, including in the United States, where Meta holds message content for our number for up to 30 days. Where data leaves the UK, the transfer is covered by UK adequacy regulations or by the UK's international data transfer agreement or addendum, as in section 5.

Your rights. You can ask for a copy of your chat, or ask us to correct or delete it, as in section 11. You can complain to us at hello@frameempire.co.uk, and to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

10. Cookies and analytics

This website sets no cookies of its own. We count page views and clicks on the main buttons with GoatCounter, which stores no cookies and no personal data: it records the page, the referring site, the browser type and screen size, and nothing that identifies you. Our hosting provider keeps standard server logs, including IP addresses, for security, for a short period.

11. Your rights

You can ask us what we hold about you, ask us to correct it or delete it, and object to how we use it. If you rang one of our customers' assistants, the quickest route is to contact that business, since they are the controller; we will help them respond. Email hello@frameempire.co.uk and we reply within one working day. Every answer to a request for your data tells you how to complain.

You can complain to us about how we use your personal data, with the form at frameempire.co.uk/complaints or by email to hello@frameempire.co.uk. We acknowledge it by the end of the next working day, look into it and tell you the outcome. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113, and you do not have to wait for our answer first.

If you complain, we keep the complaint and our correspondence for 6 years after it is closed, any evidence for 12 months, and a request not to be called for as long as we make calls. We use them only to deal with your complaint and to show how we dealt with it.

Frame Empire Ltd, registered in England and Wales, Company No. 16163944. Registered office: 4 Thameshill Avenue, Romford, Essex, RM5 3BU.