Privacy policy

Olatti is a business phone and communications service operated by We UC Ltd. This policy explains, in plain terms, what personal information we handle, why, who we share it with, how long we keep it and the rights you have. It covers our website, our waitlist and sales process, and the Olatti product itself. Because we are a communications provider, it also explains the difference between the data we control and the call data we merely process on behalf of our business customers.

1. Who we are

We UC Ltd ("We UC", "Olatti", "we", "us" or "our") is the company behind Olatti. We are a company registered in England and Wales under company number 15200847, with our registered office at Ariadne House, Town Quay, Southampton, SO14 2AQ, United Kingdom. Our VAT registration number is 479947117 (GB479947117).

We are registered with the Information Commissioner's Office (ICO) under registration number ZB747507. For any privacy question, or to exercise your rights, contact our privacy team at privacy@olatti.com, or write to us at the registered office above marked for the attention of the Data Protection lead.

2. Our two roles: controller and processor

Data protection law distinguishes between a "controller" (who decides why and how personal information is processed) and a "processor" (who processes it on the controller's instructions). Olatti acts in both roles, depending on the data:

2.1 Where we are the controller

We are the controller for the personal information we decide the use of. This includes information about website visitors, waitlist subscribers, prospects and enquirers, the individuals who administer a customer account, billing contacts, and people who contact our support or sales teams. This policy governs that processing.

2.2 Where we are the processor

When a business customer uses Olatti to make, receive, record, transcribe or store communications, that customer is the controller of the resulting communications data, and we process it on their behalf and on their instructions. That includes call records, recordings, transcripts, summaries, voicemail, messages, contacts and call-flow configuration belonging to the customer and the people they communicate with. Our processing of that data is governed by our Data Processing Addendum (DPA) with the customer, not by this policy. If you are an employee, customer or caller of a business that uses Olatti and you have a question about your communications data, please contact that business first, as the controller.

3. Information we collect

3.1 Information you give us

• Identity and contact details such as your name, work email address, telephone number, job title and company name.
• Account and onboarding details needed to set up and configure your service, including your registered service address for number provision and emergency calling.
• Billing information, including billing contact, billing address and the payment details needed to take payment, which are processed by our payment provider and not stored in full by us.
• The content of forms, waitlist sign-ups, demo requests, support tickets and any correspondence you send us.

3.2 Communications data (processed on behalf of our customers)

Where you use the communications features of the Service, we process communications data on the controlling customer's instructions, which may include call detail records (the numbers involved, time, duration and routing of a call), recordings, transcripts, summaries, voicemail, messages and contact lists. See section 2.2 for how this is governed.

3.3 Information from your use of the Service and website

• Usage and device data such as log data, IP address, device and browser type, operating system, and the actions you take in the product and on the website.
• Diagnostic and performance data, including error reports and quality-of-service metrics needed to keep calls reliable.
• Cookies and similar technologies, including browser local storage, as described in section 14.

3.4 Information from other sources

• Telecoms carriers, number-range holders and porting partners, in connection with allocating a number to you or porting a number in or out.
• Our payment provider, which confirms the status of payments and may carry out fraud and risk checks.
• Publicly available sources and business-information providers, used in a limited way to verify business details and prevent fraud.

4. How we use your information, and our legal bases

We only use personal information where we have a lawful basis to do so under UK data protection law. The bases we rely on are: performance of a contract; our legitimate interests (balanced against your rights); compliance with a legal obligation; and your consent, where required. We use personal information to:

• Set up, provide, maintain and configure the Service, including provisioning numbers and routing your calls and messages (contract).
• Take payment, manage subscriptions, and recover sums owed (contract; legal obligation for tax and accounting records).
• Provide customer support and respond to your enquiries, waitlist sign-ups and demo requests (contract; legitimate interests in helping prospects).
• Keep the Service and our network secure, prevent and detect fraud, misuse and unlawful use of the network, and protect our rights (legitimate interests; legal obligation).
• Monitor, troubleshoot and improve the quality, reliability and features of the Service (legitimate interests).
• Understand how our website and product are used through analytics (consent for non-essential analytics; see section 14).
• Send you service and administrative messages, such as outage notices, billing and security alerts (contract; legitimate interests).
• Send you marketing about Olatti where you have asked for it or where the law allows, and always with a way to opt out (consent; legitimate interests, subject to section 5).
• Comply with our legal and regulatory obligations, including those of a UK communications provider, and respond to lawful requests from authorities (legal obligation).

5. Marketing and your choices

We will only send you electronic marketing in line with the Privacy and Electronic Communications Regulations (PECR) and UK data protection law: that is, where you have given consent, or where you are an existing customer and we are telling you about similar products and you have not opted out. You can opt out of marketing at any time using the unsubscribe link in any marketing email, or by emailing privacy@olatti.com. Opting out of marketing will not stop necessary service messages about your account.

6. Call recording, transcription and monitoring

Olatti gives our customers the ability to record, transcribe and summarise calls. Where a customer chooses to use those features, the customer is the controller of those recordings and transcripts, and is responsible for using them lawfully, including for telling the people on the call that it is being recorded and for having a proper basis to do so. We process that data on the customer's behalf under our Data Processing Addendum. We may also record limited interactions with our own sales and support teams for training and quality, and will tell you when we do.

7. Connecting Olatti to AI assistants (MCP server)

Olatti offers a Model Context Protocol (MCP) server at mcp.olatti.com. It lets you connect your Olatti account to a third-party AI assistant, currently Claude (by Anthropic) and ChatGPT (by OpenAI), so you can ask the assistant to work with your Olatti calls, contacts and chats. Connecting is optional, and nothing is shared with an assistant until you set up the connection yourself.

7.1 How the connection is authorised

To connect an assistant, you sign in to Olatti and approve the connection on a consent screen. Only assistants we have approved can connect. Your Olatti password is never shared with the assistant. Instead, it receives an access token that only works with the MCP server, is limited to your own Olatti user account and expires after one hour, plus a refresh token that lasts up to seven days and is replaced each time it is used. If you change your password or your account is closed, the assistant can no longer renew its access.

7.2 What the assistant can access and do

When you ask it to, the assistant can use the following tools. They only reach data your own Olatti account can already see:

• Devices: the names and types of the phones and apps on your account.
• Contacts: names, companies and phone numbers from your contacts, and a short list of the people you have spoken with most recently, with a call count for each.
• Call records: for your recorded calls, the names and numbers of the people on the call, and the date, time, duration, direction and tags.
• Call summaries and transcripts: the summary of a recorded call and, only if requested, its full transcript.
• Chats: your direct and group chats, their participants, and the messages in them, including content, sender and date.
• Placing calls: starting a phone call from one of your devices to an extension or a UK landline, mobile or freephone number. The assistant is instructed to do this only when you explicitly ask it to. These calls may be charged in the same way as any other call from your account.

Apart from placing calls, every tool is read-only: the MCP server cannot change or delete your data. Each tool can only call a fixed set of Olatti endpoints, and only returns the fields it needs.

7.3 What we store

The MCP server does not keep a copy of the data it passes to an assistant. We keep standard operational logs of requests to it, such as IP address, time, request path and response status, for security and troubleshooting, as described in section 3.3. Our authorisation service stores sign-in requests for up to ten minutes, and each refresh token for up to seven days along with the user and assistant it belongs to.

7.4 Data received by the AI provider

Once your Olatti data reaches an assistant, the AI provider handles it under its own terms and privacy policy, including how long it is kept and whether it is used to improve their models. We do not control that processing, so please review the provider's policy and your settings with them: Anthropic's privacy policy is at anthropic.com/legal/privacy and OpenAI's is at openai.com/policies/privacy-policy. We do not sell data accessed through the MCP server, or use it for advertising or to train AI models.

7.5 Your business's communications data

Call records, recordings, transcripts, messages and contacts are still communications data that we process on behalf of the business customer, as set out in section 2.2. Connecting an assistant is the individual user's choice, so businesses should make sure it fits their own policies. Business customers with questions about this feature can contact privacy@olatti.com.

7.6 Disconnecting

You can disconnect at any time by removing the Olatti connector in your AI assistant's settings. Changing your Olatti password also stops any further access from being granted, and any access token already issued expires within one hour. To ask about data we hold in connection with the MCP server, or to exercise your rights over it, email privacy@olatti.com.

8. Sharing your information

We do not sell your personal information. We share it only where necessary, and under appropriate contracts and safeguards, with:

• AI assistants you choose to connect through our MCP server, such as Claude and ChatGPT, which receive only the data you ask them to access (see section 7).
• Service providers and sub-processors who process data on our behalf, such as hosting, infrastructure, payment, email and analytics providers. For website and product analytics we use Mixpanel, with data hosted in the EU.
• Telecoms carriers, interconnect, number-range and porting partners needed to allocate numbers and to connect and route your calls and messages.
• Professional advisers, such as our accountants, auditors, insurers and lawyers, where reasonably needed.
• Law enforcement, regulators, courts and other authorities, where we are required to disclose by law, including lawful interception and communications-data requests under the Investigatory Powers Act 2016 and related legislation.
• A buyer or successor, and their advisers, in connection with an actual or proposed sale, merger, reorganisation or insolvency of our business.

A current list of the main sub-processors we use is available on request from privacy@olatti.com.

9. Where we store and process your information

Voice, transcription and summarisation run on our own infrastructure in our own data centres in the United Kingdom. Some of our service providers may process personal information outside the UK. Where they do, we make sure an appropriate safeguard is in place, such as the UK adequacy regulations, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, so your information remains protected to UK standards.

10. How long we keep it

We keep personal information only for as long as we need it. In general, we keep account and contact data for as long as you have an account and for a reasonable period afterwards; billing and transaction records for at least six years to meet tax and accounting obligations; and certain communications and traffic data for the periods required or permitted by law. Communications data that we process on behalf of a customer is retained and deleted in line with that customer's instructions and our Data Processing Addendum. When we no longer need information, we delete it or irreversibly anonymise it.

11. Security

We use technical and organisational measures designed to protect personal information, including encryption in transit, access controls on a need-to-know basis, network and infrastructure hardening, logging and monitoring, and regular review of our practices. No system can be guaranteed completely secure, but we work to keep your information safe and, where we are required to, we will notify the ICO and affected individuals of a personal data breach within the timescales the law sets.

12. Your rights

Subject to UK data protection law, you have the right to: be informed about how we use your data; access a copy of your personal information; have inaccurate data corrected; have your data erased in certain circumstances; restrict or object to certain processing, including direct marketing; data portability; and, where we rely on consent, to withdraw it at any time without affecting earlier processing. You will not normally have to pay to exercise these rights.

To exercise any of these rights, email privacy@olatti.com. If your request concerns communications data held on behalf of a business that uses Olatti, we will direct you to, or work with, that business as the controller. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113, though we would welcome the chance to resolve your concern first.

13. Children

The Service is intended for business use and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, please contact us so we can remove it.

14. Cookies and similar technologies

We use cookies and similar technologies, including browser local storage, to keep you signed in, remember your preferences and understand how our website and the Service are used. Some of these are strictly necessary for the Service to work and cannot be turned off.

For analytics we use Mixpanel to understand how visitors use our website, with data hosted in the EU and configured not to collect your full IP address. Non-essential analytics only run if you accept them on our cookie banner: we rely on your consent, and nothing analytics-related loads until you choose. You can change or withdraw your choice at any time using the "Cookie settings" link in the footer, or through your browser controls.

Separately, and whatever you choose on the banner, our server keeps an anonymous count of visits to our short campaign links (such as olatti.com/ai-summit) and of clicks on our sign-up button. These counts use no cookies or device storage and no IP address. They record only which link or button, the campaign tags in the link and the referring website. If you have accepted analytics, the sign-up link also passes your analytics ID to our app so we can see whether the visit led to an account.

15. Other websites

Our website and emails may link to third-party sites and services that we do not control. This policy does not apply to those sites, and we encourage you to read their own privacy notices.

16. Changes to this policy

We may update this policy from time to time. We will post the new version on this page and update the effective date below. Where changes are material, we will take reasonable steps to let you know, for example by email or a notice in the product.

17. How to contact us

For any question about this policy or how we handle your information, contact our privacy team at privacy@olatti.com.

We UC Ltd, Ariadne House, Town Quay, Southampton, SO14 2AQ, United Kingdom. Registered in England and Wales, company number 15200847. VAT number 479947117 (GB479947117). ICO registration ZB747507.