Privacy Notice

AutoThink Group Ltd trading as Call Bullet, company number 13994278, is the controller for account, website, sales, support, security and billing information. For communications content and end-customer records placed in a customer workspace, the customer is normally the controller and Call Bullet acts as processor on its documented instructions.

We process account, service and billing information to perform our contract; verification and financial records to meet legal obligations; security, fraud prevention, service reliability and product improvement for our legitimate interests; and marketing or optional tracking where consent is the appropriate basis. A customer decides the lawful basis for caller, recipient and visitor information it controls.

Customers decide which numbers to use, whether to record, whom to message and how to configure agents. We process that information to route communications, show histories, provide delivery evidence and create requested transcripts, summaries or analysis. AI output should be reviewed by a person where it matters.

The attribution script uses a first-party session identifier and source information to connect a website visit with a later call. Website owners must provide their own notice and obtain consent where required. They can withhold a Call Bullet consent signal so source details are not sent.

The Android app uses the microphone when a signed-in user makes or answers an in-app call. With permission, it receives incoming-call and service notifications, including while closed. Notification payloads are limited to what is needed to alert and route the user and do not contain recordings or transcripts.

Fingerprint or face unlock is handled by the device. Call Bullet does not receive or store biometric templates. Users can change microphone, notification and biometric permissions in device or app settings.

We share information only as needed with contracted infrastructure, communications-network, payment, email, notification, analytics and AI-processing providers; with an agency or workspace members authorised by the customer; with professional advisers; or where law requires it. We do not sell personal data. Our Subprocessor List describes the service categories involved.

A supplier may process information outside the United Kingdom. Where UK data-protection law requires a safeguard, we use an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful mechanism.

Workspace owners can control or request deletion of operational records subject to product settings, contractual needs and legal holds. Account data is held while the account is active and then deleted or anonymised when no longer needed. Financial records, verification evidence and communications records may be retained where tax, company, fraud-prevention, dispute or communications law requires it. See the Retention and Deletion Policy for categories and controls.

Deleting an individual sign-in removes that person's profile, credentials, device registrations and preferences. It does not automatically erase business records controlled by their organisation. The account deletion page explains the process.

We use access controls, workspace separation, encryption in transit and at rest, credential hashing where appropriate, audit records and restricted administrative access. No internet service can guarantee absolute security. Contact us promptly if you suspect an account or API key has been compromised.

Subject to UK data-protection law, you may ask for access, correction, deletion, restriction, portability or objection, and may withdraw consent without affecting earlier processing. Email info@callbullet.com. We may need to verify identity. If your information belongs to a customer's workspace, contact that customer first; we will assist them as processor.

You may complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the opportunity to address the concern first.

The service is for organisations and is not directed to children. We may update this notice when our services or legal duties change. Material changes will be highlighted on the site, in the service or by email where appropriate.