Privacy policy

Last updated: 2 November 2026

This policy explains what personal data Ekko Labs collects, why, what we do with it, and your rights. It covers:

• visitors to ekkolabs.co and people who ask us for a demo;
• people who sign in to the Ekko Labs call compliance platform (the platform);
• the people whose calls and details are in the platform because a firm that uses it (our customer) puts them there.

Who we are

Ekko Labs is the trading name of Callshield Limited, a company registered in England and Wales with company number 15060728. Our registered office is 86-90 Paul Street, London, EC2A 4NE. We are registered with the Information Commissioner’s Office (ICO) under number 00014847587.

To ask about this policy or your data, email hello@ekkolabs.co, or write to us at 86-90 Paul Street, London, EC2A 4NE, United Kingdom.

Our two roles

We are the controller for the personal data we collect for our own purposes. That covers website visitors, demo requests, our contacts at customer firms, and the account and sign-in details of people who use the platform.

We are a processor for the data a customer firm puts into the platform or carries over our phone service. That covers call recordings, transcripts, the analysis we produce from them, and contact records. The firm is the controller of that data. We process it only on the firm’s instructions, under our data processing agreement. If your calls with a firm are in the platform, the firm’s own privacy notice explains how it uses them, and you should contact the firm to use your rights. We will help the firm respond.

Data we collect as controller

When you visit our website

Our website is hosted by Cloudflare. When you visit, Cloudflare processes technical data such as your IP address, browser type and the pages you request, to deliver the site and protect it from attacks. We don’t use analytics, advertising or session-recording tools on the website.

When you ask for a demo

The demo form asks for your name, work email, company, phone number (optional) and the size of your team. We use these to reply to you, arrange the demo, and follow up about Ekko Labs. The legal basis is our legitimate interest in responding to businesses that contact us. The form is sent to our inbox by email through Resend. We keep demo requests only while we need them to deal with your enquiry and follow up, and then delete them, unless you become a customer or the law requires us to keep them.

When you use the platform

When your firm gives you an account on the platform, we process:

• account details: your name, work email, role, the firm you belong to, and your permissions;
• sign-in data: sign-in times and the identity provider used. Sign-in is handled by Auth0 (Okta), or by your firm’s single sign-on service through our own enterprise sign-in service;
• activity in the platform: the actions you take, such as reviews, comments and changes to settings, so the firm has an audit trail;
• technical logs: request and error logs without call content, used to run the service, keep it secure and fix faults. We keep them for about 14 days.

The legal basis is performance of our contract with your firm, and our legitimate interest in running a secure, reliable service. We keep account details while the account is active. When it is closed, we delete them once we no longer need them, unless the law requires us to keep them.

When we deal with customers and suppliers

We keep the names and work contact details of people at our customers, prospects and suppliers, together with our correspondence, contracts and invoices. The legal basis is contract and legitimate interest. For invoices and accounting records, it is our legal obligation to keep them: six years from the end of the financial year they relate to.

Data we process for customer firms

The platform records, transcribes and analyses firms’ phone calls so the firms can check their calls against regulatory requirements, such as the FCA’s rules. For a firm, we process:

• call recordings and call details: phone numbers, times, durations, and the advisers and teams on the call;
• transcripts, and what we produce from them: summaries, sentiment, tags, and compliance check results with the evidence quoted from the call;
• signs that a caller may be vulnerable, which can include information about health or personal circumstances (special category data). The firm decides how such information is used, under its own lawful basis and its regulatory duties;
• contacts and companies the firm keeps in the platform’s CRM, and emails sent from it;
• for firms using our phone service: phone numbers, call routing and the recordings of calls made and received.

Automated analysis. The platform uses AI models to transcribe calls and to flag possible compliance issues. The results are prompts for a person at the firm to review. The platform doesn’t make decisions about callers that have legal or similarly significant effects; the firm’s staff do.

AI models and your data. Transcription and compliance checks run on servers we control in the UK. Some analysis features, such as summaries and sentiment, use models from Anthropic provided through Amazon Web Services’ Bedrock service in the EU. Neither Amazon nor Anthropic uses that data to train their models, and we don’t use firms’ calls or data to train AI models either.

How long we keep this data is set in the firm’s agreement with us. When the agreement ends, we delete it or return it, as the data processing agreement sets out.

Who we share data with

We don’t sell personal data. We share it only with the service providers we use to run Ekko Labs (our sub-processors), with professional advisers such as accountants and lawyers, and where the law requires it.

We also run some of the service, including transcription and compliance checks, on our own servers in the UK.

Our data processing agreement has the current list of sub-processors for customer data, and explains how we tell customers about changes.

International transfers

We store data in the UK. Where a provider processes data outside the UK:

• the EU is covered by the UK’s adequacy regulations;
• for the United States and other countries, we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, or on the ICO’s International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, together with our own checks of the risks.

Ask us for more detail on the safeguards for any transfer.

How we protect data

We encrypt data in transit, restrict access to the people who need it, and keep each firm’s data separate from every other firm’s. Inside a firm, people see only what their role allows. Our data processing agreement describes our security measures in more detail.

Cookies and similar technologies

We don’t use cookies for analytics or advertising, on our website or in the platform.

The platform uses only what it needs to work. Our sign-in provider sets cookies to keep you signed in, and the platform stores your session and a few preferences in your browser, such as the date range you last used. Cloudflare may set a strictly necessary security cookie to tell people from bots. Because these are strictly necessary, we don’t ask for consent to them.

Your rights

You have the right to:

• access the personal data we hold about you;
• have it corrected if it is wrong;
• have it erased, or its use restricted, in some circumstances;
• object to our use of it where we rely on legitimate interests, including for direct marketing, where your objection always wins;
• data portability for data you gave us, where we process it under a contract or with consent;
• withdraw consent at any time, where we rely on consent.

To use any of these, email hello@ekkolabs.co. We’ll reply within one month. If your request is about a firm’s calls in the platform, we’ll pass it to that firm and help it respond.

Complaints

If you’re unhappy with how we’ve used your data, please tell us first, and we’ll try to put it right. You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, or 0303 123 1113.

Changes to this policy

We’ll update this policy when what we do changes, and change the date at the top. If a change is significant, we’ll tell customers and users of the platform before it takes effect.