This policy explains what LineHQ collects, why we need it, and how we protect it. It covers account holders, business customers, callers and people who contact us for support.
1. Who we are
LineHQ ("we", "us") provides UK virtual phone numbers and inbound call handling to businesses. That includes call forwarding, voicemail, optional recording, schedules and virtual receptionist features. You can reach us through our contact form.
2. Controller and processor
For account, billing and support data, LineHQ is the data controller. For caller data that we process for a business customer, such as call metadata, voicemails and recordings, that customer is usually the data controller and LineHQ acts as their processor.
3. What we collect
- Account data - your name, business name, email address and login details.
- Billing data - your package, calling credit balance, top-ups and Stripe payment references. We do not store card numbers.
- Number and routing data - the phone numbers you hold and how you route calls.
- Call data - caller and called numbers, timestamps, duration, call status, voicemail and, if enabled, recordings.
- Technical data - IP address, device, browser and log data needed to keep the service secure.
- Campaign measurement data - the campaign or website that brought you to us, if you allow Analytics. If you allow Ad measurement, also an opaque advertising click reference and whether your visit led to an account or a first paid package.
Connected-service data may include contacts, text messages, job requests, notification preferences and the identifiers needed to link your account to a CRM or Telegram chat. Identity-verification records include the outcome and supporting report summary needed for account checks.
4. How we use it
- To provide the service, including number provisioning, routing, recording, voicemail and billing.
- To prevent fraud and misuse, including spend limits, destination allowlists and account suspension where needed.
- To meet legal and regulatory obligations, including telecoms and accounting requirements.
- To support you and notify you about your account.
- To understand how visitors find and use our websites, including which visits lead to a signup or a payment, if you allow Analytics.
- To measure whether advertising leads to account creation and a first paid package, if you allow Ad measurement. We do this with a privacy-minimised server event and do not include contact details, phone numbers, call recordings, messages or call content.
5. Call recordings
Where a customer enables recording, callers hear an announcement before recording starts. Recordings are stored on private infrastructure, kept for the retention window set by the package, and deleted when that period ends. See our Call Recording Policy for more detail.
6. Transcription & AI processing
Optional call and voicemail transcription, and the AI summaries generated from those transcripts, are processed in-house on our own UK-based infrastructure. Your call audio, transcripts and summaries are not sent to any third-party AI provider and are not used to train anyone else's models. Transcripts and summaries follow the same retention and access controls as the underlying recording.
7. Sharing & sub-processors
We share data only with the providers needed to run the service, including:
- Wholesale carrier partners - number supply, call termination and porting.
- Stripe - payment processing for calling credit top-ups and subscriptions. Where identity verification is required, Stripe Identity collects the identity document and selfie through its hosted flow. LineHQ receives the verification status and report summary, not copies of the document images.
- Google - Google Analytics, if you allow Analytics, to measure how visitors find and use our websites. Google Ads, if you allow Ad measurement and arrived from one of our Google adverts: when you buy a first paid package, we send Google Ads that advert's click reference, the time and the amount paid.
- Microsoft - Microsoft Clarity, if you allow Analytics, to see how visitors use our public website. See "Cookies and website measurement" below.
- OpenAI (ChatGPT Ads) - if you allow Ad measurement, OpenAI's ChatGPT Ads pixel runs on our website. If you arrived from one of our ChatGPT adverts, we also send OpenAI an opaque click reference plus a signup or first-paid-package event to measure the campaign. We do not send account contact details, phone numbers or call content for this purpose.
- Connected AI assistants (optional) - if you connect an AI assistant such as Claude (Anthropic) or ChatGPT (OpenAI) to your account, the data you ask that assistant for is sent to that assistant's provider and handled under its own terms and privacy policy. See "Connected AI assistants" below for what can be shared and the controls you have.
- Optional connected services - if you connect Telegram, notification content is sent to the selected chat and its members. If you connect a supported CRM, the selected contact and call-activity data, which may include AI summaries and links back to LineHQ, is shared with that service. Recordings and transcript text are not sent to it. Those services handle their copies under their own terms and privacy policies.
- Hosting, email-delivery and error-monitoring providers under contract.
Transcription and AI summarisation are not in this list: we run those on our own infrastructure rather than through an external AI service.
Your notification and content choices
Privacy Mode can switch off call recording and transcription for a number. It can also disable unanswered-forward voicemail fallback, but does not erase existing content or the basic call records needed for billing, security and service operation. Review message-taking routes separately.
You can choose call emails with no call content, keeping summaries and transcripts in the dashboard. Connecting Telegram or a CRM is optional; disconnecting stops future delivery but does not delete copies already sent to that service. These delivery choices are separate from our in-house UK transcription and AI processing.
Connected AI assistants
You can choose to connect an AI assistant (for example Claude or ChatGPT) to your LineHQ account so it can read your setup and make changes you ask it for. This is optional, each person on an account connects their own assistant by signing in and approving it, and you can disconnect it at any time from the AI assistants page.
What it can see. An assistant only receives what a tool returns in answer to a request. Depending on what it asks for and what you have allowed, that can include each of the following, and nothing else:
- Your account. The account (business) name, your role, the plan, the credit balance as an amount, whether identity verification is done, whether the account is active, which features the account can use (with the reason when it cannot), the number of open support requests, and when you raise a support request or feedback through it, its reference, subject and the email address replies go to.
- Your phone numbers. Each number, its label, its status, whether you bought it from us or brought it from another provider, and a plain-English description of what happens when someone rings it, including anything stopping calls getting through.
- Call routing. The routing mode, schedules and their times, temporary changes with their start and end, recording, transcription and privacy switches, voicemail and whisper settings, the phone numbers calls are forwarded to and any staff name you gave them, how long each rings, menu (IVR) options, which number a forwarded call shows, and the devices, greetings, receptionists and business profiles a route can use, by name.
- Greetings and receptionists. Greeting names and tags, which greeting each number plays and why, the wording of any voiced greeting you requested and its progress, and each receptionist's departments, digits, the phone numbers or devices they ring, staff names you gave them, and their settings. An assistant is never given a link to greeting audio.
- Devices. Each device's name, whether it is the LineHQ app or a desk phone, whether it is connected, which numbers ring it, and the caller ID it shows. SIP passwords and extension numbers are never shared.
- Business profiles and AI receptionist knowledge. Business names, sector, summary, website, opening hours, closures and bank holidays, services and price notes, FAQs, locations with their addresses and phone numbers, triage questions, urgent signs, how the AI receptionist books and quotes, its greeting, and when the knowledge was last changed. To account owners on accounts with the AI receptionist, also the people it may pass callers to: their name, role, phone number or device, and when to use them; and the name, link, booking link, opening hours and sync status of a connected RatingsPlus listing.
- Blocked callers. Each blocked phone number, the label you gave it, what happens to its calls and which numbers the block covers; and for a report to the caller community, the caller's number, the statement that would be shared, its date and the report's status.
- Team and recipients. The email address and role of a person you invite, the email address of a voicemail recipient you add with its confirmation status, and the names of team members shown as having completed a to-do or job request. Team members are otherwise counted, not listed.
- Call data (only if you allow it). For each call: its direction, the caller's phone number (or the number dialled, for outbound calls), which of your numbers it came in on, the number it was forwarded to, when it started, was answered and ended, how long you spoke, the outcome (for example answered, missed, voicemail, or the reason it did not connect), whether there is a recording, and, if you allow transcripts, the AI summary with its detected intent, sentiment and urgency, the action items, and the first few lines of the transcript. A plain-English explanation of the latest call that went wrong is included in the account overview.
- Call analytics (only if you allow it). Call counts by day, hour and number, answer rate, average call length and the sentiment mix.
- To-dos, appointments and job requests (only if you allow them). To-dos with their text, status, the caller's and call-back phone numbers, sentiment and urgency; appointments with their time, text, status, caller name and call-back number; your free slots and opening times; and job requests with the caller's name and contact number, the job type, description, address and postcode, the preferred time, and their status.
- Reference codes and timestamps. The reference codes and internal identifiers the assistant needs to point at a record in its next request (for example a call, number, greeting, device or receptionist), and the date and time records were created, changed or completed.
What it is never given. Recording audio or links to it, full transcripts, greeting audio, passwords, two-factor codes, payment card details, LineHQ prices or rates, API keys, Zapier hook addresses, internal diagnostic or debug data, or anything belonging to another LineHQ account.
Your controls. Choosing "set up only" keeps call history, transcripts, analytics, to-dos and job requests out entirely, and under "set up + call data" you can switch call history, transcripts and summaries, analytics, to-dos and job requests off individually at any time; each change applies to the assistant's next request. AI receptionist knowledge has its own switch. An account owner can also stop team members from connecting assistants at all.
Who receives it. Whatever your assistant reads on your behalf is sent to the assistant's provider (Anthropic for Claude, OpenAI for ChatGPT) and handled under that provider's terms, including any retention or model-training choices in your own account with them. LineHQ does not send any data to these providers except in response to a request made through an assistant you connected.
What it can do. An assistant can change routing, build and change receptionist menus, greetings, blocked callers, voicemail recipients and team invitations, tick off to-dos and update job requests, maintain the AI receptionist's business knowledge on accounts that have it, raise support requests, and, with your explicit confirmation, share a report about a caller with the caller community. It cannot spend money, buy or release numbers, send text messages, change your plan or add-ons, or delete your account. Your team role applies to it exactly as it applies to you.
Records we keep. To keep an audit trail you can rely on, we record each action an assistant takes on your account: which assistant, which person it acted for, the action, the details supplied to LineHQ tools, the time and whether it succeeded. We also email you when an assistant is connected. These records are kept while your account is open and are available to you on request; they are used for security, support and dispute handling and for nothing else.
Cookies and website measurement
Our websites use some cookies and browser storage they need to work, such as keeping you signed in. Anything else is optional and stays off until you choose. You answer two questions separately:
- Analytics - how visitors find and use our websites. We use Matomo, which we run on our own server, so what it records is not shared with another company. We also use Google Analytics, run by Google, and Microsoft Clarity.
- Ad measurement - telling an advertising platform that its advert led to a signup or a payment. We use OpenAI's ChatGPT Ads pixel and Google Ads. We never use it to target or personalise adverts.
Microsoft Clarity records how you use our public website: clicks, scrolling and the pages you view, with all text hidden. It never runs in your LineHQ account. Microsoft runs Clarity as an independent controller and stores the data in Microsoft Azure. Recordings are kept for 30 days. A random sample, and any we save as favourites, are kept for up to 9 months. Clarity cannot delete one visitor's data on request, only a whole project.
To change your choice, use Cookie settings at the bottom of any page, or in the menu and on the Profile page of your LineHQ account. Our Cookies page lists every cookie, who sets it, what it is for and how long it lasts.
8. International transfers
Some suppliers may process data outside the UK. Google, Microsoft and OpenAI, which we use for website measurement if you allow it, are based in the United States and may process that data there. Where that happens, we rely on UK adequacy regulations, International Data Transfer Agreements or Standard Contractual Clauses.
9. Retention
We keep account and billing records for as long as the law requires, usually six years for financial records. Call recordings follow the retention window set by the package and are then deleted. An advertising click reference is removed after the first paid-package event or after 31 days, whichever comes first. It is also removed straight away if you withdraw Ad measurement. Records of actions taken by a connected AI assistant are kept while your account is open.
10. Your rights
Under UK GDPR you have rights to access, correct, delete, restrict, transfer or object to the use of your personal data. If your request relates to a business customer's caller data, we may need to pass it to that business as the controller. To exercise your rights, use our contact form. You can also complain to the Information Commissioner's Office (ICO).
11. Security
Access is restricted and authenticated. Recordings are stored privately. Secrets are kept outside the codebase, and carrier traffic is limited to known carrier systems.
12. Changes
We will post any changes to this policy on this page and update the date above.