Privacy Policy.

1 · Roles + scope

Adam Vaughan trading as CallMeIE is the Controller of personal data collected for CallMeIE's own website enquiries, customer administration and demo service. Contact: hello@callmeie.ie.

Postal contact: 40 Gouldavoher Estate, Limerick, V94 HWH7, Ireland. Telephone: +353 85 786 3564.

Examples of processing roles for agreed services:

• AI Receptionist: we are the Processor; you are the Controller of your callers' personal data.
• Document Ops: we are the Processor; you are the Controller of any personal data contained in the documents you submit.
• AI-First Websites: we process agreed visitor information and form submissions on your instructions; actual roles follow the website configuration.
• Software, AI, automation, integrations and consultancy: where we process personal data on a customer's documented instructions, the agreed DPA records the actual Controller/Processor relationship. The category alone does not authorise processing or determine every provider's role.

For customer callers and other personal data processed on a business customer's instructions, that business is the Controller and CallMeIE is its Processor. The customer's privacy notice and lawful basis apply; its contract with CallMeIE does not automatically provide a lawful basis for every caller. The Data Processing Agreement governs processing on the customer's instructions.

2 · Information and purposes

CallMeIE's own enquiries and customers

When you contact us or use a contact or discovery form, we receive the information you provide, such as name, contact details, business information and your request. We use it to answer you and manage the enquiry. Where you are entering a contract as an individual, necessary pre-contract steps or performance can rely on Article 6(1)(b). For business-contact administration we rely on legitimate interests in responding and operating the service. Billing and tax records are also processed to meet legal obligations.

Providing enquiry details is voluntary, but we need enough information to answer or supply the requested service. Necessary network/security information is processed for service operation and abuse prevention. Optional website analytics uses your consent as described in §7; withdrawing it does not affect earlier lawful processing.

Information processed for business customers

• AI Receptionist: incoming number, caller-provided details, audio/transcript where configured, routing and call outcomes, and agreed booking/message records.
• Document Ops: uploaded documents, extracted fields, review corrections and access identifiers.
• Websites: form contents, service/security logs and enabled analytics or payment information.
• Other agreed software/AI/automation services: approved source data, integration or account identifiers, inputs/outputs, workflow events, support records and necessary service/security logs as specifically identified in the Order Form and DPA Schedule. No unrestricted collection, model training or autonomous decision-making is enabled by this description.

These operations are limited by the customer's instructions and service configuration. The business customer determines its lawful basis; it is not automatically contract just because it purchases our service. Recording, sensitive information and optional integrations require specific arrangements. Retention criteria are in §4.

3 · Hosting and processing locations

The receptionist backend uses Hetzner hosting in Germany. Voice, telephony, messaging and other configured providers can process data in other countries. The location of our database or archive does not establish the location of the entire processing chain.

Provider roles are described in §5. Customer-specific providers and processing locations are recorded with the DPA before processing. We do not describe the full service as EU-only.

4 · Retention

For CallMeIE's own enquiries, we keep the information needed to answer the enquiry and manage any resulting customer relationship. We review continued need when an enquiry closes or the relationship ends. Billing and tax records are kept for the applicable statutory period; security records are kept where needed to investigate incidents or abuse.

For customer-controlled information, retention follows the customer's documented instructions and agreed service settings, subject to applicable legal requirements. Audio, transcripts, call metadata and backups can have different periods. Customer settings are not inferred from the demo/admin archive.

A storage lifecycle rule does not establish deletion of every provider copy, log or backup. Requests to delete or return data are handled under §6 and the DPA; this notice does not promise a blanket twenty-four-hour or seventy-two-hour complete erasure.

5 · Providers and recipients

Providers depend on the service and enabled features. The customer-specific DPA Schedule identifies the actual sub-processors before processing. A payment provider or a provider acting for its own legal obligations is not automatically a sub-processor for every activity.

Providers may process information outside the EEA; see §8. For customer processing, sub-processor authorisation, equivalent contractual duties and objection rights follow the DPA. No fixed thirty-day notice or provider certification is implied unless agreed and supported.

6 · Your rights

Contact hello@callmeie.ie to request access, correction, erasure, restriction or portability, or to object, where the relevant GDPR conditions apply. You can withdraw consent without affecting earlier lawful processing. We may need information to verify your identity, but will not request unnecessary information.

We respond without undue delay and normally within one month of receipt. Where Article 12 permits an extension for complexity or number of requests, we inform you within that first month, with the reasons. Legal retention requirements and the rights of others can affect what can be provided or erased.

If we act as Processor for a business customer, we pass the request to that Controller and assist it as required by the DPA. We do not use a thirty-day soft-delete period as a supposed Article 19 grace period.

You can complain to the Irish Data Protection Commission. If a service involves decisions within Article 22, applicable safeguards must be addressed; this notice does not authorise significant automated decisions about you.

7 · Cookies + tracking

On callmeie.ie (this hub):

• Optional analytics: accepting Allow page counts loads self-hosted Umami from analytics.owlzone.trade to count visits and selected interactions. Declining prevents this analytics script from loading. The browser stores your choice as cmt-consent. This notice does not certify anonymity of all network or hosting logs.
• Cloudflare may set a strictly-necessary cookie for DDoS protection (__cf_bm, ~30 minutes).
• Google Fonts loaded from fonts.googleapis.com + fonts.gstatic.com — no cookies set, but Google receives the visitor IP per request.

Withdraw analytics permission This stops the optional analytics script on reload. You can change a stored choice by clearing this site's browser storage and choosing again.

On portal.callmeie.ie (Document Ops customer portal):

• Strictly-necessary session cookie for magic-link auth (HttpOnly, Secure, SameSite=Lax).
• Any enabled payment processor can set cookies during its own checkout flow; the actual processor and its notices must be identified before use.

On AI-First Websites we host for you: configurable per site. Default = self-hosted Umami (no cookies, IP-anonymised). If your site adds a payment checkout or third-party widgets, their cookie and processing behaviour must be assessed and disclosed in your own site's privacy notice.

8 · International transfers

Some service providers process information outside the EEA. Where GDPR requires a transfer safeguard, the applicable arrangement must be established for the actual recipient and processing. This can involve an applicable adequacy decision or appropriate contractual safeguards; we do not claim that all providers hold a certification or that SCCs apply automatically.

Contact hello@callmeie.ie for information about the applicable transfer arrangement and how to obtain a copy of relevant safeguards.

9 · Security

We use technical and organisational measures appropriate to the information and processing risks. Customer-specific access, storage, logging and recovery controls are recorded in the signed DPA Schedule. No online service is free of security risk.

10 · Disputes + DPO contact

The data-protection contact is Adam Vaughan, at hello@callmeie.ie. This contact is not presented as an appointed Data Protection Officer.

Supervisory authority: Irish Data Protection Commission. Its website provides current contact and complaint details.

12 · Demo calls and business customer calls

The CallMeIE demo line is +353 61 788 120. It uses an AI assistant. Depending on the configured call settings, the service processes the incoming number, audio, transcript and call metadata through the voice and telephony providers. A recording notice is separate from AI disclosure.

For our demo service, CallMeIE is Controller. We use call information for the demonstration, follow-up where appropriate, service-quality checks and abuse prevention, relying on legitimate interests where applicable. We do not authorise general-purpose model training with customer call data through this notice.

You can object or request access or erasure at hello@callmeie.ie. Include the date and time so that we can locate the call; do not send unnecessary sensitive information. This notice does not promise that a spoken opt-out instantly stops recording or that every provider copy is deleted within a fixed number of hours.

For a business customer's callers, that business is Controller. Its privacy notice, recording decision and lawful basis govern the processing; CallMeIE acts on its instructions. The customer's service contract with CallMeIE is not itself a blanket lawful basis for recording callers.

11 · Changes to this policy

We keep this notice up to date and provide information about material processing changes as required. Updating a notice or continuing to use a service does not itself establish consent to processing that requires consent. Any contractual notice commitments remain governed by the agreed contract.

Version history:

• v1.3 · 2026-10-14 - aligns sole-trader identity and permits specifically agreed broader service scopes, with actual processing and payment providers recorded per engagement.
• v1.2 · 2026-10-07 — corrects operating identity, Controller/Processor roles and unsupported retention, transfer and response-time claims. Earlier descriptions below are historical, not current processing promises.
• v1.1 · 2026-05-11 — added §12 explicitly covering call recording on the +353 61 788 120 demo line (disclosure, lawful basis Art 6(1)(f), 90-day retention via Hetzner Object Storage archive, opt-out path).
• v1.0 · 2026-05-04 — first multi-product version (covers all three products: AI Receptionist + Document Ops + AI-First Websites). Replaces the previous Receptionist-only version at /receptionist/privacy.html.