PRIVACY
Privacy Policy
We explain how contact, account and enquiry information is handled.
Key principle
Last updated: 14 August 2026
SmartFlows is committed to protecting your privacy and handling personal information responsibly, securely and transparently.
SmartFlows provides and operates this website and related services.
This Privacy Policy explains how we collect, use, store, share and protect personal information when you use SmartFlows websites, client portals, Syms, artificial intelligence services and related products and services.
For the purposes of UK data protection law, SmartFlows may act either as a data controller or a data processor, depending on the circumstances.
1. When SmartFlows is a Controller or Processor
When you deal directly with SmartFlows — for example by visiting our website, creating an account, purchasing a service, contacting us or communicating with our team — SmartFlows will normally be the data controller.
Where one of our clients uses a SmartFlows Sym to process information relating to its own customers, employees, prospects, suppliers or other individuals, that client will normally be the data controller and SmartFlows will act as its data processor.
This distinction is important because, where we process information on behalf of a client, the client determines why the information is being processed and is normally responsible for responding to requests relating to that information.
2. Information We Collect
Depending on the services being used, we may process:
Contact and Account Information
This may include:
- name;
- business name;
- job title;
- postal address;
- email address;
- telephone number;
- account and login information;
- company and VAT information; and
- communication preferences.
Billing and Transaction Information
This may include:
- billing details;
- subscription information;
- invoices and payment history;
- transaction references; and
- account credit or usage information.
Payment card information may be processed directly by our authorised payment providers rather than stored by SmartFlows.
Website and Technical Information
This may include:
- IP address;
- browser and device information;
- operating system;
- pages visited;
- login activity;
- timestamps;
- referring websites;
- diagnostic information;
- security logs; and
- information collected through cookies and similar technologies.
Information Processed by Syms and AI Services
Depending on the particular Sym and the permissions provided, information may include:
- questions, instructions and prompts;
- AI-generated responses;
- uploaded documents and files;
- customer and prospect information;
- CRM records;
- notes and task information;
- emails and attachments;
- calendar information;
- business records;
- website information;
- knowledge-base information; and
- information generated when a Sym performs an authorised task.
Telephone and Voice Information
Where telephone or voice functionality is used, we may process:
- telephone numbers;
- caller and recipient information;
- call date, time and duration;
- call recordings where enabled;
- call transcripts;
- conversation content;
- call outcomes;
- voicemail information; and
- technical information required to operate the call.
Where appropriate, callers will be informed that calls may be processed, recorded or transcribed.
Information From Connected Services
Where you authorise SmartFlows or a Sym to connect to another service, we may process information from services such as:
- email accounts;
- calendars;
- CRM systems;
- business databases;
- telephone systems;
- social-media platforms;
- cloud storage;
- accounting systems; and
- other authorised business applications.
We only access connected information to the extent required to provide the authorised functionality.
3. Where We Obtain Personal Information
We may obtain information:
- directly from you;
- from a SmartFlows client;
- through a Sym interacting with you;
- from systems you or our clients connect to SmartFlows;
- from authorised service providers;
- from publicly available business websites, directories and other legitimate public sources; and
- from communications or transactions involving SmartFlows.
Where information has been supplied to us by one of our clients, that client is responsible for ensuring that it has an appropriate lawful basis for providing and processing that information.
4. How We Use Personal Information
We may process personal information to:
- provide and operate SmartFlows services and Syms;
- create and manage customer accounts;
- authenticate users and protect accounts;
- provision and operate individual Sym instances;
- allow Syms to carry out authorised business tasks;
- process calls, emails, messages and other communications;
- connect Syms with authorised third-party systems;
- provide customer support;
- process subscriptions, payments and account credits;
- maintain service reliability and security;
- investigate faults, fraud, misuse or security incidents;
- improve our products, user experience and service performance;
- maintain appropriate records;
- analyse service usage;
- communicate important service, security or policy information;
- carry out marketing where permitted;
- establish, exercise or defend legal rights; and
- comply with legal and regulatory obligations.
We will not use personal information for purposes that are incompatible with the reason it was collected unless permitted by applicable law.
5. Our Lawful Bases for Processing
Depending on the circumstances, we may rely upon:
Contract — where processing is necessary to provide a service you have requested or to perform an agreement with you.
Legitimate interests — where processing is necessary for legitimate business purposes, including operating and improving our services, maintaining security, preventing misuse and managing customer relationships, provided those interests are not overridden by your rights.
Consent — where you have specifically agreed to particular processing and consent is the appropriate lawful basis.
Legal obligation — where processing is necessary for us to comply with the law.
Where we process special-category information, we will also ensure that an appropriate additional legal condition applies.
6. AI and Automated Processing
SmartFlows provides artificial intelligence systems capable of analysing information, generating content, making recommendations and carrying out authorised tasks.
A Sym may therefore process information automatically as part of performing the function for which it has been configured.
SmartFlows does not ordinarily use solely automated processing to make decisions about its own customers that have a legal or similarly significant effect upon them.
Where a SmartFlows client configures a service that involves significant automated decision-making, the client is normally responsible for determining the appropriate lawful basis, transparency information and safeguards. SmartFlows will support its clients in implementing appropriate technical controls where required.
Where applicable, individuals may have rights to obtain information about automated processing, request human intervention and challenge significant automated decisions.
7. How We Share Personal Information
We do not sell or rent personal information.
We may share information with carefully selected organisations where this is necessary to provide our services, including providers of:
- secure hosting and infrastructure;
- artificial intelligence technology;
- voice and speech technology;
- telecommunications services;
- email and calendar connectivity;
- cloud storage;
- payment processing;
- analytics;
- cybersecurity;
- software and technical infrastructure; and
- professional, legal and accounting services.
These organisations may act as processors, subprocessors or independent controllers depending on the service they provide.
We may also disclose information:
- where required by law or a court;
- to regulators or competent authorities;
- to prevent or investigate fraud, crime or security incidents;
- to establish or defend legal rights; or
- in connection with a genuine merger, restructuring, acquisition or sale of a business or its assets.
Where we use processors, we require appropriate contractual and data-protection safeguards.
8. International Data Transfers
Some of the technology providers supporting SmartFlows may process information outside the United Kingdom.
Where personal information is transferred internationally, we use appropriate safeguards required by applicable data protection law.
Depending on the destination and circumstances, these may include:
- UK adequacy regulations;
- the UK International Data Transfer Agreement;
- the UK Addendum to approved Standard Contractual Clauses;
- appropriate contractual protections; and
- other legally recognised transfer mechanisms.
Where required, we also assess whether transferred information continues to receive an appropriate level of protection.
9. Data Security
We use appropriate technical and organisational measures designed to protect personal information from:
- unauthorised access;
- accidental loss;
- destruction;
- alteration;
- improper disclosure; and
- misuse.
Measures may include access controls, authentication, encryption, secure communications, system monitoring, logging, backups, infrastructure security and restrictions on staff and supplier access.
Access to personal information is limited to people and systems that require it for legitimate business purposes.
No internet-connected system can be guaranteed to be completely secure, but we continually review our safeguards and respond to identified security risks.
10. Data Retention
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected.
Retention periods vary according to:
- the type of information;
- the SmartFlows service being used;
- client configuration;
- contractual requirements;
- security requirements;
- statutory accounting and tax requirements;
- legal obligations; and
- the need to establish or defend legal claims.
Information processed by a Sym on behalf of a client may be subject to retention periods determined by that client.
When information is no longer required, it will be deleted, anonymised or securely archived where appropriate.
11. Your Data Protection Rights
Depending upon the circumstances and the lawful basis used for processing, you may have the right to:
Access — request confirmation of whether we hold personal information about you and obtain a copy.
Rectification — ask us to correct inaccurate or incomplete information.
Erasure — ask us to delete personal information where there is no lawful reason for us to continue processing it.
Restriction — ask us to restrict how we process your information in certain circumstances.
Data portability — receive certain information in a structured, commonly used and machine-readable format and, where applicable, have it transferred elsewhere.
Object — object to certain processing based upon legitimate interests.
Object to direct marketing — you may ask us to stop using your information for direct marketing at any time.
Withdraw consent — where processing is based upon consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.
Rights relating to automated decision-making — where applicable, you may have rights concerning significant decisions made solely through automated processing.
Some rights are subject to legal conditions and exemptions.
Where SmartFlows processes information solely on behalf of one of our clients, we may refer your request to that client or assist the client in responding to it.
12. Marketing Communications
We may contact customers and prospective business customers about SmartFlows products and services where permitted by applicable data protection and electronic communications law.
Where consent is required, we will obtain it.
You can opt out of marketing communications at any time using the unsubscribe method provided or by contacting us.
Opting out of marketing does not prevent us from sending essential account, security, billing or service communications.
13. Cookies and Similar Technologies
Our websites may use cookies and similar storage or access technologies for purposes including:
- essential website operation;
- login and authentication;
- security;
- remembering preferences;
- measuring website performance;
- statistical analysis; and
- improving functionality.
Certain essential or legally permitted low-risk technologies may be used without consent.
Where consent is required for cookies or similar technologies, we will request it before they are used.
You can manage applicable preferences through our cookie controls and, where appropriate, your browser settings.
Further information is available in our Cookie Policy.
14. Third-Party Websites and Services
SmartFlows websites and Syms may contain links to, or integrate with, services operated by other organisations.
Those organisations may process personal information as independent data controllers and have their own privacy policies.
SmartFlows is not responsible for the privacy practices of third-party services operating independently of us.
15. Children's Information
SmartFlows services are primarily designed for businesses and are not intended as consumer services for children.
We do not knowingly seek to collect personal information directly from children unless this forms part of a lawful service being provided by or on behalf of one of our clients.
Where a client uses SmartFlows technology in circumstances involving children, the client is responsible for ensuring that appropriate legal, transparency and safeguarding requirements are met.
16. Data Protection Complaints
If you are concerned about how SmartFlows has handled your personal information, please contact us so that we can investigate.
We will acknowledge a data-protection complaint within 30 days and will investigate and respond without undue delay.
You also have the right to raise a complaint with the Information Commissioner's Office (ICO), the UK's independent data-protection regulator.
17. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes to:
- our services;
- technology;
- suppliers;
- business operations; or
- applicable law and regulatory guidance.
The latest version will be published on our website and the Last updated date at the top of this policy will be amended accordingly.
Where a material change significantly affects how we use personal information, we will take reasonable steps to bring the change to the attention of affected users where appropriate.
18. Contact Us
For questions, data-rights requests or complaints relating to privacy or personal information, contact:
SmartFlows
Email: info@smfls.com
For data-protection requests, please include “Data Protection” in the subject line where possible.