LEGAL FRAMEWORK

Privacy Policy

At Leighton AI, we are committed to protecting the privacy and security of the professional plumbing networks we serve. This policy outlines our standards for high-performance neural integration and data automation integrity.

Leighton AI Limited – Privacy Policy

Effective Date: 21/09/2026
Last Updated: 21/09/2026

Leighton AI Limited ("Leighton AI", "we", "us" or "our") respects your privacy and is committed to protecting personal data.

This Privacy Policy explains how we collect, use, store and protect personal information when you use our website, contact us, purchase or trial our services, or interact with AI-powered services provided by us.

For the purposes of applicable UK data protection legislation, including the UK GDPR and Data Protection Act 2018, Leighton AI Limited may act as a data controller in relation to certain personal information and as a data processor when processing personal information on behalf of our business customers.

1. Who We Are

Leighton AI Limited

Company Number: 16910767

Registered Office: 3 Twyver Close, Upton St Leonards

Email: Dan@leighton-ai.com

Where Leighton AI acts as a data controller, we are responsible for deciding how and why personal information is processed.

Where Leighton AI acts as a data processor on behalf of one of our customers, that customer will generally remain the data controller and will determine why and how the relevant personal information is processed.

2. Personal Information We May Collect

Depending on how you interact with us or our customers, we may collect and process information including:

Name;
Business name;
Job title or role;
Email address;
Telephone number;
Business address;
Billing and payment information;
Information provided when contacting us;
Information relating to your use of our services;
Customer enquiries and communications;
Telephone call recordings;
Call transcripts;
Messages and communications;
Appointment information;
Lead and enquiry information;
Information provided during conversations with an AI Agent;
Technical information such as IP address, browser information and device information;
Login and account information; and
Any other personal information provided to us or processed through the Services.

We do not intentionally request sensitive personal information unless it is necessary for a specific service and appropriate arrangements have been made.

3. How We Collect Personal Information

We may collect personal information:

Directly from you;
When you contact us;
When you purchase or trial our Services;
When you complete a form or submit information through our website;
Through our Stripe payment or checkout process;
When you communicate with an AI Agent;
Through telephone calls, messages or other communications;
From our business customers where we provide Services on their behalf;
Through third-party technology platforms used to provide the Services; and
From publicly available sources where permitted by law.

Where we receive personal information from one of our business customers, that customer is generally responsible for ensuring that it has a lawful basis for providing the information to us.

4. How We Use Personal Information

Where Leighton AI is acting as a data controller, we may use personal information to:

Provide and manage our Services;
Set up and administer customer accounts;
Process payments;
Provide customer support;
Communicate with customers;
Respond to enquiries;
Manage the one-month trial and subsequent subscription arrangements;
Arrange and conduct customer reviews;
Maintain business records;
Manage invoices and accounts;
Improve our Services;
Monitor and maintain the security of our systems;
Detect and prevent fraud, misuse or unlawful activity;
Comply with legal and regulatory obligations; and
Establish, exercise or defend legal claims.

Where Leighton AI acts as a data processor, we process personal information primarily in accordance with the instructions of the relevant customer and the applicable service agreement.

5. AI-Powered Services

Our Services use artificial intelligence technology to provide functions including telephone answering, customer conversations, enquiry handling, lead qualification, appointment booking, messaging and other business automation.

Information provided during interactions with an AI Agent may be processed in order to provide the requested service.

AI-generated responses may occasionally be inaccurate or incomplete. Customers using our Services remain responsible for reviewing and supervising the use of AI within their business.

Where our Services process personal information on behalf of a business customer, that customer is generally responsible for determining the purposes and lawful basis for the processing.

6. Call Recording and Transcription

Where call recording or transcription is enabled, telephone calls may be recorded and/or transcribed.

Recordings and transcripts may be used for purposes including:

Providing the Services;
Customer service;
Appointment management;
Lead and enquiry management;
Quality assurance;
Troubleshooting;
Reporting and analytics;
Service improvement; and
Other purposes agreed with the relevant customer.

Where Leighton AI processes recordings or transcripts on behalf of a business customer, the customer is generally responsible for determining whether recording or transcription is lawful and for providing any notices or obtaining any permissions required by applicable law.

7. Lawful Bases for Processing

Where we act as a data controller, we will rely on one or more lawful bases permitted under applicable data protection legislation.

These may include:

Contract: where processing is necessary to enter into or perform a contract with you.

Legitimate interests: where processing is necessary for our legitimate business interests and those interests are not overridden by your rights and interests.

Legal obligation: where processing is necessary for us to comply with a legal or regulatory requirement.

Consent: where we have asked for and obtained your consent to process your personal information for a particular purpose.

Where we rely on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

8. Sharing Personal Information

We may share personal information with trusted third parties where necessary to provide our Services or operate our business.

These may include:

Artificial intelligence technology providers;
Telecommunications providers;
Hosting and cloud service providers;
Messaging providers;
CRM and business software providers;
Payment providers, including Stripe;
IT and technical support providers;
Professional advisers such as accountants, insurers and solicitors;
Legal, regulatory or governmental authorities where required; and
Other service providers where necessary to provide the Services.

Where we use third-party providers to process personal information on our behalf, we will take reasonable steps to ensure that appropriate contractual and security arrangements are in place.

Our Terms and Conditions and any applicable Data Processing Addendum may provide further information about processors and sub-processors used in providing the Services.

9. International Transfers

Some of the technology providers we use may process personal information outside the United Kingdom.

Where personal information is transferred outside the UK, we will take appropriate steps to ensure that the transfer is carried out in accordance with applicable data protection legislation.

This may include relying on an adequacy decision, appropriate contractual safeguards or another lawful transfer mechanism where required.

10. How Long We Keep Personal Information

We will retain personal information only for as long as reasonably necessary for the purposes for which it was collected, unless a longer period is required or permitted by law.

Retention periods may vary depending on the type of information and the reason it is being processed.

For example:

Customer account and contractual information may be retained for as long as necessary to manage the customer relationship and for an appropriate period afterwards;
Financial and accounting records may be retained for periods required by applicable law;
Call recordings and transcripts may be retained for as long as reasonably necessary to provide the Services or as agreed with the relevant customer;
Information required to establish, exercise or defend legal claims may be retained for as long as reasonably necessary for that purpose.

Specific retention periods may also depend on the third-party technology providers used to provide the Services.

11. Security

We take reasonable technical and organisational measures to protect personal information against:

Unauthorised access;
Accidental loss;
Destruction;
Alteration;
Disclosure; and
Other unlawful or unauthorised processing.

However, no internet-based, cloud-based or electronic service can be guaranteed to be completely secure.

12. Your Data Protection Rights

Depending on the circumstances, you may have rights under applicable data protection legislation, including the right to:

Request access to your personal information;
Request correction of inaccurate or incomplete information;
Request deletion of your personal information;
Request restriction of processing;
Object to certain processing;
Request transfer of certain information to another organisation;
Withdraw consent where processing is based on consent; and
Complain to the Information Commissioner's Office.

Some rights are subject to legal conditions and exceptions.

To exercise your rights, please contact us using the details provided in this Privacy Policy.

13. Marketing Communications

Where we send marketing communications, we will do so in accordance with applicable data protection and electronic communications legislation.

You can ask us to stop sending marketing communications at any time.

If you no longer wish to receive marketing communications, you can contact us or use the unsubscribe mechanism provided in the relevant communication.

14. Cookies and Website Technologies

Our website may use cookies and similar technologies.

Some cookies may be necessary for the website to operate, while others may be used for analytics, functionality or other purposes.

Where required by law, we will request your consent before placing non-essential cookies on your device.

Further information about cookies may be provided in a separate Cookie Policy.

15. Third-Party Websites

Our website or communications may contain links to third-party websites or services.

We are not responsible for the privacy practices, content or security of third-party websites.

You should review the privacy policies of those websites before providing them with personal information.

16. Children's Information

Our Services are intended for businesses and are not directed at children.

We do not knowingly collect children's personal information for our own purposes.

Where our Services are used by a business customer in circumstances involving children, the relevant customer is responsible for ensuring that the processing is lawful and appropriate.

17. Complaints

If you have concerns about how we have handled your personal information, please contact us first so that we can investigate and attempt to resolve your concern.

You also have the right to complain to the UK's supervisory authority for data protection:

Information Commissioner's Office (ICO)

You can find information about making a complaint on the ICO's website.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our Services, technology, legal requirements or how we process personal information.

The latest version will be made available through our website.

We recommend that you review this Privacy Policy periodically.

19. Contact Us

If you have any questions about this Privacy Policy or how we process personal information, please contact:

Leighton AI Limited

Company Number: 16910767

Registered Office: 3 Tyvwer Close, Upton St Leonards

Email: Dan@leighton-ai.com