Privacy Policy
Last updated 28 September 2026
On this page
1. Who we are
Redplumm International Limited ("we", "us") is a software company registered in England and Wales, company number 12641418. We build custom business software, and we run two products: Redplumm Build, a self-serve app builder, and a managed AI Receptionist service.
For anything about this policy, or to exercise any of the rights described below:
Email: privacy@redplumm.com
Phone: 020 4652 7504
Post: Redplumm International Limited, [REGISTERED ADDRESS]
2. Two different roles
This distinction matters, because it changes what we are responsible for.
We are the controller of information about you as our customer: your name, email address, company, sign-in details, billing records and any support correspondence. We decide why and how that information is used, and this policy covers it.
We are a processor of the information you put into our systems — the records your staff submit, the photographs and signatures they capture, and, if you use the AI Receptionist, the calls your customers make to you. You decide what goes in and why. We act only on your instructions. That relationship is governed by our Data Processing Agreement rather than by this policy, and we will provide one on request.
3. What we collect, and why
When you have an account with us
| What | Why | Lawful basis |
|---|---|---|
| Name, email address, company | To create and run your account | Contract |
| Password, stored hashed | To sign you in | Contract |
| Two-factor secret and backup codes | To protect your account | Legitimate interests — security |
| IP address, sign-in times, failed attempts | To detect misuse and lock out attackers | Legitimate interests — security |
| Subscription status, PayPal subscription reference | To bill you and manage your plan | Contract |
| Support emails and call notes | To answer you and keep a record | Contract |
We never see or store your card details. Payment is handled entirely by PayPal. We hold only a subscription reference and whether it is active.
When someone fills in one of your forms
Whatever fields you chose, and optionally a photograph, a signature, a GPS location and a timestamp. You decide what to ask for. We store it on your behalf and have no independent use for it.
When someone calls your AI Receptionist
The call is answered by an automated agent. Audio is processed to understand speech and generate replies, and a transcript and summary are kept in your dashboard.
If you use the AI Receptionist, telling your callers is your responsibility. It is your phone line and your relationship with them. We provide the tools; the disclosure obligation sits with you as the controller of those calls.
When you visit this website
Our web server keeps standard access logs — IP address, page requested, time, browser — for security and troubleshooting. If you book a call through this site we keep the name, email, telephone number and message you gave us, so we can hold the meeting and follow it up.
4. Who else is involved
We keep this list deliberately short. Each of these has access to some data in order to make the service work.
| Who | What they handle | Where |
|---|---|---|
| PayPal (Europe) S.à r.l. | Payments and subscriptions | EU / US |
| SMTP2GO | Sending email | EU / US |
| Twilio Inc. | Telephony — AI Receptionist only | EU / US |
| ElevenLabs Inc. | Speech recognition and synthesis — AI Receptionist only | US |
| OpenAI | Language model — AI Receptionist only | US |
| [HOSTING PROVIDER] | Servers and databases | [LOCATION] |
Customers who use only Redplumm Build are not affected by the telephony and speech providers.
We do not sell data, and we do not share it for advertising.
5. Sending data outside the UK
Some of the providers above are outside the UK. Where personal data leaves the UK we rely on a UK adequacy decision where one exists, and otherwise on Standard Contractual Clauses together with the UK International Data Transfer Addendum. We will tell you which applies to a specific provider if you ask.
6. How long we keep things
| What | Kept for |
|---|---|
| Account details | While your account is open, then 30 days |
| Your records, photographs and signatures | While your account is open. Exportable as CSV at any time, including after cancelling |
| Call recordings and transcripts | 90 days, then deleted |
| Security and sign-in logs | 12 months |
| Website access logs | 90 days |
| Billing records | 6 years, as UK tax law requires |
On written request we will delete your account and its contents within 30 days, except where we are legally required to keep billing records.
7. How we protect it
Not a generic list — this is what is actually in place:
- Passwords are hashed with PBKDF2-SHA256 at 120,000 iterations. We cannot read them, and neither could anyone who stole the database.
- Two-factor authentication is available on every account and we recommend it. Backup codes are stored hashed and each works once.
- Accounts lock for fifteen minutes after eight failed sign-in attempts.
- Rate limits on sign-in, password reset and public form submission.
- Password reset links are stored hashed, expire within an hour, work once, and sign out every other device when used.
- All traffic is encrypted in transit using TLS.
- Tenant isolation is enforced on every database query and tested — one customer's account cannot reach another's data.
- Access logging records sign-ins, failures and account changes, and account owners can review it themselves.
- Backups are taken nightly and verified.
No system is perfectly secure, and anyone who tells you otherwise is selling something. If we suffer a breach affecting your personal data we will tell you without undue delay, and notify the Information Commissioner's Office within 72 hours where the law requires it.
8. Your rights
Under UK GDPR you have the right to ask us to give you a copy of your personal data, correct it if it is wrong, delete it, restrict or object to how we use it, or provide it in a portable format. Where we relied on your consent, you can withdraw it at any time.
Ask at privacy@redplumm.com. We will respond within one month, and we will not charge you for it.
If you are unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first, so we have a chance to put it right.
9. Cookies
This website uses no cookies at all. Our customer consoles use a small amount of browser storage to keep you signed in and remember preferences such as whether you have dismissed a message. That is strictly necessary for the service to work, so it does not require consent.
We do not use advertising or tracking cookies, and we do not run analytics that identify you.
10. Changes to this policy
If we change this materially we will email account holders rather than quietly updating the page. The date at the top always reflects the current version.