Privacy policy

1. Who we are

INJAI is owned and run by Charlie Preite, a sole trader based in England. When this policy says "we" or "us", it means INJAI.

We are the data controller for information about the people who sign up for and use INJAI. Contact us about anything in this policy:

• Email: INJAI.ai@hotmail.com
• Phone: 07444 730404

2. Your customers' information

Businesses use INJAI to deal with their own callers, customers and contacts. For that information, such as a caller's name, number, voicemail or email, the business is the data controller and INJAI is its data processor. We only use it to provide INJAI to that business and follow its instructions.

Each business must tell its customers how their information is used, for example that calls may be answered by an AI receptionist or logged, and must have a lawful reason to use it. If you are a customer of a business that uses INJAI, please contact that business first. We will help them respond.

3. What we collect

• Account details: your name, email address, job title or position, password (stored scrambled, so nobody can read it), an optional profile photo, and when you agreed to this policy and our terms.
• Joining a business: the company name and company ID you enter, your request to join, your role (owner, admin or employee), the location you're assigned to, and whether you've been removed or blocked.
• Business setup details: your phone number, and the business's name, description, address, contact details, opening hours, services, prices, areas covered, booking rules, common questions and locations.
• Calls and voicemails: once your phone line is live, the caller's number, the time and length of the call, what was said, voicemails, and whether the call has been opened or called back. Phone settings such as your business number and whether the AI answers or just logs calls.
• Emails: emails you add or bring in from a linked inbox, and the labels INJAI gives them.
• Tasks, goals and calendar: your tasks and personal goals (private to you), calendar events, and events from calendars you link.
• The INJAI assistant: your conversations with it and its settings. If you ask a question out loud, the recording is turned into text to answer you. We keep the text, not the recording.
• Tools you link: if you sign in to a tool such as Gmail, Outlook, Google Calendar or Microsoft Teams, we keep a protected link to that account and use it only for the features you switched on. We never see your password for that tool.
• Payments: your plan, payment status, invoices, refunds, discount codes used and free trial dates. Card details are handled by Stripe; we never see your full card number.
• Activity records: on Enterprise and Custom plans, an audit log of who added, changed or removed records and settings in the business, and when. Tasks are never included.
• Usage and technical information: sign-in records, how many AI requests and email sorts you use, tutorial progress, display choices (such as colour theme and dark mode), and device, browser and IP address information in security logs.

4. How we use it and why

UK GDPR requires a lawful reason for each use of personal information. Ours are:

• Contract: to run your account and business on INJAI, provide calls, voicemail, emails, tasks, calendar, the AI receptionist and assistant, take payments, manage free trials and refunds, and send service emails such as sign-in links and "your free trial is up" reminders.
• Legitimate interests: to keep INJAI secure, prevent fraud and misuse (including daily AI limits), keep audit logs for businesses that use them, fix problems, give support and improve INJAI. When online look-ups are switched on, we search public websites for information about your business, never about callers.
• Legal obligation: to keep financial and tax records and respond to lawful requests.
• Consent: for optional features that need it, such as using your microphone. You can withdraw it at any time in your browser or in Settings.

We don't send marketing messages unless you have agreed to receive them.

5. How INJAI uses AI

INJAI uses AI models from trusted providers (such as Google and OpenAI) to answer calls and questions, sort emails, suggest tasks from emails and calls, turn speech into text and create spoken voices. Only the information needed for each request is sent to them, under contracts that keep it confidential.

• AI suggestions, such as tasks found in emails, are only added once you choose them.
• The assistant only changes anything after you confirm it.
• INJAI doesn't make decisions about you based only on automated processing that have legal or similarly significant effects.
• AI can make mistakes, so please check important answers.
• You can switch off the assistant's access to your records and online look-ups in Settings.

6. What your team can see

• People in the same business can see its shared records, such as calls and emails, depending on their role.
• Tasks and personal goals are private to the person who set them.
• Only the owner sees billing. The owner and admins see join requests, the team and, where included, the audit log.
• Each business can only ever see its own records.

7. Who we share it with

We never sell personal information. We only share it with:

• Providers who run INJAI for us, under contracts that require them to protect it: Lovable (hosting, database, sign-in and email delivery), AI model providers, Stripe (payments), Firecrawl (online look-ups) and Twilio (phone calls, once your line is live).
• Tools you choose to link, such as Google or Microsoft, under their own privacy policies.
• Authorities or professional advisers, when the law requires it or to protect our rights, users or the public.
• A buyer or successor, if all or part of INJAI is sold or reorganised, with the same protections.

8. Transfers outside the UK

Some providers store or process information outside the UK, for example in the European Economic Area or the United States. When this happens it is protected as UK law requires: through UK adequacy regulations (including the UK–US Data Bridge where the provider is certified), or the ICO's International Data Transfer Agreement or Addendum, with extra safeguards where needed.

9. How long we keep it

• Account and business information: while your account is open.
• Records you add (calls, voicemails, emails, tasks, events, notes): until you or your business delete them, or the account closes.
• Audit logs: while the business is on INJAI.
• After you terminate your account: all data related to you is kept for 10 days, then erased. If you own a business, this includes that business and all its records.
• Payment and invoice records: kept by Stripe for 6 years after the end of the financial year, as UK tax law requires.
• Security logs: only as long as needed, normally no more than 12 months.

10. How we keep it safe

Information is encrypted while it travels between your device and INJAI. Strict permission rules mean each business can only see its own records and each person only what their role allows. Links to tools you sign in to are stored encrypted, and passwords are never stored in a readable form. No system is completely secure; if a breach puts your rights at risk, we will tell you and the ICO as the law requires.

11. Your rights

Under UK data protection law you have the right to:

• get a copy of your personal information;
• have inaccurate information corrected;
• have your information deleted;
• restrict how we use it;
• object to us using it, including for our legitimate interests;
• receive it in a portable format, or have it sent to another provider;
• withdraw consent at any time, where we rely on it;
• not be subject to decisions based only on automated processing that significantly affect you.

To use any of these rights, email INJAI.ai@hotmail.com. It's normally free and we reply within one month. You can update most of your details yourself in Settings.

12. Terminating your account

You can terminate your account at any time in Settings, then Account, then Terminate account. By agreeing to this policy, you accept that:

• you won't get a refund on anything you have already paid for, and any paid plan on a business you own ends straight away;
• all data related to you is kept for 10 days after you terminate, then erased for your privacy;
• you are signed out and can't sign in to that account again.

13. Cookies and storage on your device

INJAI only uses storage on your device that is strictly necessary: to keep you signed in and secure, and to remember display choices such as colour theme and dark mode. We don't use advertising or tracking cookies. Under PECR this doesn't need your consent. Stripe's checkout may use its own cookies to prevent fraud when you pay.

14. Children

INJAI is a service for businesses and is not for anyone under 18.

15. Complaints

If you're unhappy with how we use your information, please contact us first so we can put it right. You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint, phone 0303 123 1113, or write to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

16. Changes to this policy

We may update this policy. The date at the top shows the latest version. If we make important changes we will tell you in INJAI or by email, and ask you to agree again where needed.