We are AI Business Solutions Limited, trading as Whitecroft AI ("Whitecroft AI", "we", "us", "our"). We provide AI implementation services to SME businesses, including voice agents, workflow automation, and AI agent networks.
We are the data controller for the personal data described in this policy.
From enquiries and new client onboarding:
During service delivery:
Voice agent engagements (Pillar 1 only):
Website and communications:
| Purpose | Lawful basis |
|---|---|
| Delivering services under a client contract | Contract (Article 6(1)(b)) |
| Managing enquiries and pre-sales contact | Legitimate interests (Article 6(1)(f)) |
| Keeping records for legal and accounting purposes | Legal obligation (Article 6(1)(c)) |
| Marketing to existing clients and opted-in prospects | Legitimate interests / Consent |
| Call recordings (where applicable) | Consent or Legitimate interests, depending on context |
We use personal data to:
We do not sell personal data to third parties. We do not use personal data for automated decision-making that produces legal or similarly significant effects on individuals.
We use Anthropic's Claude API to power AI features in the services we build for clients. Here is what this means in practice:
Anthropic does not train AI models on data processed via the API. This is a contractual commitment from Anthropic — it is different from consumer AI products like Claude.ai, where conversations may be used to improve the model. When data passes through the Claude API as part of your service, Anthropic processes it to produce a result and does not retain or use it for training.
Data is not stored beyond the session. Anthropic's API does not retain data from API calls after the session ends.
Encryption in transit. All data sent to and from the Anthropic API is encrypted using TLS 1.2 or higher.
Anthropic is SOC 2 Type II certified and operates under Standard Contractual Clauses (SCCs) for international data transfers.
We document exactly what data flows through AI tools for every client engagement. If you want a data flow map for your project, ask us.
To deliver our services we work with the following categories of third parties, each acting as a data processor on our behalf under appropriate Data Processing Agreements:
| Sub-processor | Purpose | Location |
|---|---|---|
| Anthropic PBC | AI model processing | USA |
| n8n GmbH | Workflow automation | Germany / self-hosted |
| Zapier Inc. | Workflow automation | USA |
| VAPI Inc. | Voice agent platform | USA |
| Twilio Inc. | Telephony infrastructure | USA |
Not all sub-processors are used in every engagement. Your Statement of Work will confirm which apply to your project. A full Sub-Processor Disclosure List is available on request.
Some of our sub-processors are based in the United States. Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place — specifically, Standard Contractual Clauses (SCCs) approved under UK data protection law. Anthropic, Zapier, VAPI, and Twilio all operate under SCCs for UK/EU data transfers.
| Data type | Retention period |
|---|---|
| Client personal data (project and account records) | Duration of the contract, then 6 years for legal and accounting purposes |
| Enquiry data (pre-contract contact) | 12 months from last contact |
| Call recordings | As agreed in the Statement of Work, or 90 days by default |
| Website usage data | 12 months |
After these periods, data is securely deleted or anonymised.
You have the right to:
If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve it. If you remain dissatisfied, you have the right to complain to the UK Information Commissioner's Office:
We may update this policy from time to time. When we make significant changes, we will notify active clients by email. The current version will always be available on our website and on request.
This policy was last updated in April 2026.