Security & GDPR

We build practical automations and websites with clear data handling. This page explains how we handle credentials, logs and personal data, who else sees it, and how long we keep it.

Technophobia Ltd is a data processor when we run websites, booking systems and AI assistants for a client, and a data controller for our own business records.

Data minimisation. Process only what the workflow needs.

Least-privilege access. Separate roles, revoked when the work is finished.

Transparency. You own your workflows, your data and your credentials.

Reproducibility. A walkthrough, a diagram and a checklist for every build.

Credentials live in an encrypted keystore, never in code, config files or our coordination database. Every time a credential is used it is logged by name, machine and requester.

Access to your site is granted by a per-site key that can be revoked on its own rather than a shared master login. We use separate test and production accounts wherever the platform allows, and credentials are shared through secure channels, never by email.

We keep the run logs needed to debug a problem, and mask or omit personal data such as email addresses and phone numbers from alerts. Daily summaries report totals, not raw records.

Every site we host is checked automatically each day for unexpected file changes, and backed up nightly to encrypted off-site storage.

Where one of our AI phone assistants records a call, the first thing the caller hears is that the call is recorded, before any other conversation takes place.

What is recorded is the conversation with the assistant - both sides of it. If the assistant puts the caller through to a person, the recording stops at that point: we do not record the conversation that follows.

Most of our assistants do not record at all. Where a live service does record, the recording belongs to the client whose line it is, and we hold it only as their processor.

Call recordings and their transcripts - 7 days, then they are deleted automatically every night. What is left afterwards is the bare record of the call: when it came in, how long it lasted and what it cost. Chatbot conversations - 6 months.

Enquiry form submissions - 12 months. Booking and order records - 7 years, because they are accounting records. Server and access logs - 30 days.

Council minutes, agendas and similar documents are published permanently by design, because they are public records the council is required to publish.

Test data is deleted at handover. If you need a different period for your project, tell us and we will set it.

20i (UK) - hosting and mailboxes for most client sites. Hostinger (EU) - VPS hosting for chatbots and automations.

Vapi (US) - the AI voice platform; it handles call audio and transcripts. Twilio (US) - phone numbers and call routing. OpenAI (US) - the language model behind our assistants.

Microsoft 365 - our own email and calendar. Calendly - scope-call booking. n8n, self-hosted on our own server - workflow automation. Vercel - hosting for some front-ends.

Mailchimp and SocialBu - email and social marketing. GitHub - source code, no personal data. Google reCAPTCHA - form spam protection.

Some of these are outside the UK. We will tell you which ones apply to your project, and we will give you notice before we add a new one.

Contract - to deliver the services you ask for.

Legitimate interests - to keep systems reliable and secure.

Consent - where it is required, for example SMS marketing.

We issue our own Data Processing Agreement covering everything on this page. You do not need to produce one - just ask us for ours.

Questions about any of this, or a request to see, correct or delete data we hold: email hello@technophobia.uk or call 01229 774591.