Privacy Policy
Heron Agents builds AI customer service representatives for service businesses. This policy explains what we collect when you use this website, request a demo, sign up or call one of our numbers, how we use it, who we share it with and the choices you have.
Last updated: October 12, 2026
Calls are recorded
The AI CSR captures what the caller needs and sends you a summary so you can follow up.
Secrets stay hidden
Phone platform keys and admin credentials live in encrypted server storage, never in page code.
You can ask us to delete
Tell us to remove your details or a call record and we will action it.
1Information we collect
We only collect what we need to build your AI CSR, answer your calls and keep your account running. There are three sources.
- Details you give us
- When you request a demo, fill in the free build form or create an account, you send us your name, business name, phone number, email address, industry and (optionally) your website. For the demo we also ask for your mobile number and email so we can call you back. For an account we ask for a password. You may add further details when we configure your AI CSR, such as your services, hours and service area.
- Information from calls
- When someone calls a Heron number, our phone and AI provider processes the call and returns call metadata to us: the caller's phone number, the date, duration, direction, the transcript of the conversation and an AI generated summary. We store those records against the account that owns the number so the owner can review what was asked and follow up.
- Usage and device data
- Our website records standard analytics information such as pages viewed, referring site, approximate location, browser and device type. This is collected through Google Analytics and Google Tag Manager, and through a Meta Pixel that reports a lead event when a form is submitted successfully.
2How we use your information
We use your information to run the service you asked for, and for nothing else.
- Build and operate your AI CSR
- We configure the assistant around your business, assign it a phone number and keep it working for you.
- Contact you about your request
- We call or email you about the demo, evaluation or account you asked for, and we send service messages about your account.
- Show call outcomes to you
- We display recent calls, transcripts and summaries in your dashboard so you can follow up with the caller.
- Improve and measure the service
- We use analytics to understand which pages and offers work, and we review call summaries to correct answers our AI CSR got wrong.
- Keep the service secure
- We log requests and webhook events to detect abuse, rate limit the demo flow and investigate problems.
5Your rights and choices
You control your information. Where the law gives you these rights, we honour them, including under the GDPR, UK GDPR and the California Consumer Privacy Act as amended.
- Access and portability
- Ask us what personal information we hold about you and we will provide a copy in a usable format.
- Correction
- Tell us what is wrong and we will fix it. Account holders can update most details themselves in the dashboard.
- Deletion
- Ask us to delete your personal information and we will, unless we must keep a record for a legitimate business or legal reason such as billing records.
- Stop marketing
- Every follow up message we send carries a way to opt out. Reply to any email or tell us by phone and we will remove you from that list.
- Object, restrict or withdraw consent
- Where we rely on your consent you can withdraw it at any time, and you can ask us to restrict how we process your information.
- No sale or sharing of personal information
- We do not sell or share personal information for cross context behavioural advertising purposes, and we honour opt out signals where they are presented to us.
To exercise any of these rights, contact us using the details at the bottom of this page. We may need to verify your identity before we act on a request. You also have the right to complain to your local data protection authority.
If you are a caller rather than a customer, and you want a copy or deletion of the record your call created, contact us with the date, time and number you called. Account holders control their own call records and can ask us to remove them.
6How long we keep information
We keep records only as long as they are needed for the purpose they were collected for.
- Demo sessions
- A demo session that is never completed expires within an hour of being started. A completed demo record is kept while we follow up with you, then removed.
- Leads and enquiries
- Kept while we are working with you on your request, and for a short period afterwards so we do not lose context.
- Account records
- Kept while your account is open, and afterwards for as long as we need to keep billing and legal records.
- Call records, transcripts and summaries
- Kept as part of your account history so you can review past calls. You can ask us to delete specific calls or your whole history.
- Analytics data
- Retained by our analytics providers according to their own retention settings, typically up to fourteen months.
7How we protect information
We design the service so that private data stays private by default.
- Access is scoped
- Customer accounts are separated by row level security. A signed in customer can only read their own organisation's calls, leads and settings, and the database enforces that rather than the website.
- Secrets stay on the server
- Phone platform keys and admin credentials are stored as encrypted server secrets, never in page code, and are never returned to a browser.
- Sessions are hardened
- Admin and customer sessions use signed, HTTP only cookies with secure transport enforced, so credentials are not readable by page scripts.
- Transport is encrypted
- The site is served over HTTPS, and traffic between our systems and providers uses encrypted connections.
No method of transmission or storage is perfectly secure, so we cannot promise absolute security. If a breach affects your personal information and we are required to notify you, we will do so.
8Notice to callers
If you are calling a business through a Heron number, this notice tells you what happens to your call.
Your call is answered by an AI customer service representative. It asks for your name, phone number and what you need so the business can help you, and it tells the caller what it is. A transcript and summary of the conversation are recorded and shared with the business that owns the number.
Your phone number is captured automatically as part of call reporting. This information is used to arrange the service you asked for and to follow up with you. It is not used for unrelated marketing.
If you do not want your call handled this way, tell the AI CSR or ask to speak to a person, and the business will handle your call directly.
9Children
Our service is for businesses.
We do not direct our website or services to children under 16 and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will remove it.
10Changes to this policy
We may update this policy as the service changes. When we do, we revise the date at the top of the page. If a change materially affects how we use your information and you have an account with us, we will let you know directly.
Contact us
Questions about this policy, or a request to access, correct or delete your information? Email privacy@heronagents.com. Tell us what you would like to happen and we will follow up.
Heron Agents operates this website and the AI CSR service at heronagents.com.