Privacy policy, without the fog.

This page explains what Atwood Systems does with personal information: what we collect, why we collect it, who else sees it, how long we keep it, and how to get it back or have it deleted. It is written to be read, not to be survivable in court.

Who we are

Atwood Systems is the trading name of Colin Wood, a sole trader based in Southend-on-Sea, Essex, United Kingdom. For anything on this page, we are the data controller: the business that decides why your information is held and what happens to it.

You can reach us about anything privacy-related at info@atwoodsystems.co.uk, and we will respond within one month.

What we collect, and why

There are three ways your information reaches us, and each one collects something different.

• Website enquiries: when you fill in the contact form we collect your name, email address, phone number if you give one, company name, industry, your approximate call volume or budget, what you are interested in, and your message. We use it to reply to you and to quote. Nothing else.
• Newsletter: if you subscribe, we hold your email address and send you roughly one email a month. Every email has an unsubscribe link.
• Client service data: if you buy an AI receptionist or another service from us, we hold the details needed to run it: your contact records, the conversations the AI has on your behalf, appointment details, and the knowledge base we build from your business information.

We do not ask for, and do not want, special category information: health details, religious beliefs, trade union membership and the like. If one of your customers volunteers something like that in a conversation, it is stored with the rest of the conversation as part of running the service, and you should tell us if you need it handled differently.

AI, conversations and your calls

This is the part most policies are vague about, so here it is plainly.

• When the AI answers a message or a call, the text of that conversation is sent to the AI model provider so it can generate a reply. That happens on every single message: it is the only way the service works.
• We do not record call audio. The platform stores transcripts and call metadata, not recordings.
• We do not train AI models on your conversations, and neither do we allow our providers to. Model calls are inference only: a question in, an answer out.
• Where the platform can, it strips sensitive fields before writing anything to its own logs.

Who else processes your data

We use a small number of suppliers, called sub-processors, to run the service. They can only handle your information to provide their part of it. This is the complete list: there is no second tier we disclose on request.

• Supabase: managed database. Stores conversations, contacts, leads, calls and knowledge base content.
• Twilio: telephony. Carries voice calls and text messages, and hosts any voicemail media.
• AI model providers: Anthropic, OpenAI and Google. They receive the text of conversations in order to generate replies. Which one is used depends on the setup.
• Vercel: hosting for this website and for the platform.
• Resend: sends transactional notification emails, such as telling you that a call came in.
• Firecrawl: reads a client's website once, during setup, to build the AI's knowledge base.
• Google Calendar: only if you connect it, and only to check whether you are free. It reads availability, not the titles or attendees of your events.

We also use ordinary business tools for our own admin: email, cloud storage, DNS and analytics. Those do not hold your customers' records.

Where your data goes

Some of the suppliers above are based in the United States, so personal data does leave the UK. That is a real transfer and we will not pretend otherwise: it happens because the AI models and the telephony network are provided from there.

Where data leaves the UK, we rely on each provider's standard data processing terms, which incorporate the European Commission's Standard Contractual Clauses and the UK Addendum to them. Those terms apply as a condition of using the service, rather than as a separate document we have negotiated.

How long we keep things

• Client conversations and AI logs: kept for 730 days by default, and the window is configurable per client between 30 days and 10 years. When it expires, it is deleted automatically.
• Notifications: deleted after 90 days.
• Website enquiries and newsletter subscriptions: kept until you ask us to delete them, and then deleted. You can ask at any time and we will not argue.

If you ask us to erase a client contact, we redact the message content, remove the identifying details and delete the associated AI logs. Some records may be kept longer where the law requires it, for example for tax.

Cookies and storage on your device

This website does not set advertising or tracking cookies. The only thing stored on your device is a draft of the contact form, saved in your browser's local storage under the key atwood:contact-draft:v1, so that a refresh or a misclick does not cost you a written-out message. It stays in your browser and we cannot read it.

We use Vercel Analytics to count visits and see which pages are read. It reports aggregate numbers without cookies and without following you across other sites.

Your rights

Under UK data protection law you can ask us to do any of the following, and we will not charge you for it:

• Tell you what we hold about you, and give you a copy.
• Correct anything that is wrong.
• Delete it, where there is no good reason for us to keep it.
• Stop using it for a particular purpose, or stop altogether.
• Give it to you in a portable format so you can take it elsewhere.
• Withdraw consent you previously gave, such as agreeing to the newsletter.

Email info@atwoodsystems.co.uk and we will respond within one month. If you are unhappy with how we have handled it, you have the right to complain to the Information Commissioner's Office at ico.org.uk.

How we keep it secure

Access to client data is limited to the systems that need it, credentials are kept in a managed store rather than in code, and connections are encrypted in transit. Sensitive fields are stripped before anything is written to our logs. No system is perfect, and we will tell you directly if a breach ever affects your information.

Changes to this policy

If this policy changes in a way that affects you, we will update the date at the top of this page and, where the change is significant, tell clients by email. We will not quietly make it worse.