This explains what we do with personal information — yours, and your customers' if you become a client. It's written in plain English on purpose. If anything here isn't clear, email us and we'll explain it properly.
Who we are
First.Reply is a trading name of [YOUR FULL LEGAL NAME], a [sole trader / limited company no. XXXXXXX] based in the United Kingdom.
Correspondence address: [ADDRESS FOR SERVICE]
Email: hello@firstreply.co.uk
ICO data protection register entry: [REGISTRATION NUMBER]
For most of what's described below we are the data controller — we decide what's collected and why. There is one important exception, covered under "When you're a client", where we act as a processor on your behalf.
What we collect, and why
If you contact us
Your name, email address, phone number, business name, and whatever you tell us in the message. We use it to reply to you and, if it goes further, to quote and set up the service. Our lawful basis is legitimate interests — you contacted us and expect a reply — and then contract once we're working together.
If we contacted you first
We research service businesses using information those businesses publish themselves: business name, the phone number on their website, their trading area and their website address. We may also record the time we rang and how long it took for the phone to be answered or returned.
Our lawful basis is legitimate interests — offering a relevant service to a business, using contact details that business publishes for the purpose of being contacted. We've weighed that against your interests and kept the impact low: a small number of calls, no marketing to numbers registered with the TPS or CTPS, and an immediate and permanent stop the moment you ask.
You can stop it instantly. Say so on the phone, or email hello@firstreply.co.uk with your number. We add it to a do-not-call list the same day and it never comes up again. We don't need a reason and we won't ask for one.
Where we publish findings from this research — for example how long businesses in a sector took to return a call — we publish aggregate figures only. No business is ever named, and no individual is identified.
If you become a client
We hold your business details, the contact details of the people we deal with, your service configuration, and billing records. Lawful basis is contract, and legal obligation for anything we're required to keep for tax.
Your customers' information is yours, not ours. When the service runs, it handles messages from people who ring your number — their phone number and whatever they say about the job. For that information you are the controller and we are your processor. We only do what you instruct, we don't use it for our own purposes, we never sell it, and we don't use it to train any AI model. The contractual terms governing this are set out in our Terms of Business, which form our agreement under Article 28 of the UK GDPR.
When you visit this website
The site sets no cookies and stores nothing on your device. Our host keeps standard server logs — IP address, time, page requested — for security and to keep the site running. See our cookie statement for the detail.
Who else is involved
We use established suppliers to run the service. They only process information on our instructions, under contract.
| Supplier | What they do | Where |
|---|---|---|
| Twilio | Phone numbers and text messaging | US / EU |
| OpenAI | Generates the reply text in a conversation | US |
| Airtable | Stores enquiry and configuration records | US |
| Make.com | Connects the above together | EU |
| Stripe / GoCardless | Payments | US / UK |
| Netlify, Cloudflare, Google | Website hosting and email | US |
Some of these are outside the UK. Those transfers are covered by the UK International Data Transfer Addendum or Standard Contractual Clauses in each supplier's data processing agreement. We do not send information anywhere else, and we never sell it.
We will disclose information if the law requires it — a court order, or a lawful request from a regulator or the police.
How long we keep it
| What | How long |
|---|---|
| Enquiries that don't become clients | 12 months from last contact, then deleted |
| Research records for businesses we called | 24 months, or immediately on request |
| Do-not-call entries | Kept indefinitely — that's the only way to honour them |
| Client records and conversations | For the length of the contract, then 30 days, then deleted |
| Invoices and accounting records | 6 years, as tax law requires |
Your rights
Under UK data protection law you can ask us to: tell you what we hold about you and give you a copy; correct anything wrong; delete it; restrict what we do with it; provide it in a portable format; or object to us processing it — including objecting to direct marketing, which we will always honour without question.
Email hello@firstreply.co.uk. We'll respond within one month and it costs you nothing.
If you're unhappy with how we've handled it you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We'd rather you came to us first so we can put it right, but you don't have to.
Changes
If we change this notice we'll update the date at the top. If a change materially affects clients, we'll email you about it rather than leave you to notice.