For the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018), the data controller for Phone 'n' Moan is [YOUR LEGAL NAME OR TRADING NAME], contactable at [YOUR EMAIL].
This policy explains what personal data we collect when you use our services — instant calls, scheduled calls, gifts, and the Public Answering Machine — why we collect it, how it is shared, how long it is kept, and your rights.
We deliberately collect as little personal data as possible. Depending on which parts of the service you use, we may collect:
For instant calls we don’t ask for your name, address, or any personally identifying details. For scheduled calls and gift purchases we only ask for what’s needed to book, remind you of your slot, or send you the gift link; we don’t use those details for anything else.
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Taking payment and providing the call or gift | Performance of a contract (Art. 6(1)(b)) |
| Publishing rants on the Public Answering Machine and in social media adverts | Consent (Art. 6(1)(a)) |
| Retaining unpublished rants briefly for moderation | Legitimate interests (Art. 6(1)(f)) |
| Preventing fraud and abuse | Legitimate interests (Art. 6(1)(f)) |
| Keeping our service secure and operational | Legitimate interests (Art. 6(1)(f)) |
| Complying with our tax and accounting duties | Legal obligation (Art. 6(1)(c)) |
| Responding to enquiries or refund requests | Legitimate interests (Art. 6(1)(f)) |
We use a small number of trusted processors to run the service:
We do not sell your personal data. Apart from answering-machine clips used in our own social media adverts (with your consent), we do not share it for marketing purposes.
Some of our processors (Stripe, Twilio, Cal.com, Netlify, Resend) are based in or transfer data outside the UK, including to the United States. Where they do, they rely on UK-approved safeguards such as the UK International Data Transfer Agreement, Standard Contractual Clauses, or equivalent measures.
Under UK GDPR you have the right to:
To exercise any of these rights, email [YOUR EMAIL]. We will respond within one month.
We do not use analytics or advertising cookies. The site may set strictly necessary cookies via Stripe (to process your payment and prevent fraud) and via the embedded Cal.com booking widget (to operate the booking flow). These are exempt from consent requirements under the Privacy and Electronic Communications Regulations.
Payment data never touches our servers — it goes directly to Stripe. We use HTTPS, restrict access to administrative tools with a secret token, and rely on Netlify and our processors’ standard security controls. No system is completely secure, so we cannot guarantee absolute protection.
The service is for users aged 18 and over. We do not knowingly collect data from anyone under 18, and this applies equally to calls, gift purchases, and recordings on the Public Answering Machine. If you believe a minor has used the service, contact us and we will delete their data (and remove any recording they may have left).
When you leave a recording on the Public Answering Machine (the leave-a-complaint page), we collect:
If you like a published clip, we record a scrambled (hashed) version of your IP address so each person can like a clip only once. We can’t recover your IP address from it.
We do not collect your name, email address, or contact details for a recording, and we do not attach any identifying metadata to a published clip.
If you consented to publication, we may publish a short edited highlight of your recording on the public answering-machine page and use it in our social media adverts. These are publicly accessible and may be indexed by search engines. You can request removal of a published clip at any time by emailing us; we will remove it within a reasonable period (typically 7 days). We will take down clips on our website and stop running adverts that use them, but we can't recall copies that others have already shared or downloaded.
Our lawful basis for publishing is your explicit consent (Art. 6(1)(a) UK GDPR); for retaining unpublished recordings until we review and delete them, it is our legitimate interests in operating and moderating the service (Art. 6(1)(f)). You may withdraw publication consent at any time (see Section 8).
We may update this policy from time to time. The "Last updated" date at the top will reflect the latest revision.
Privacy questions and data requests: [YOUR EMAIL].