Privacy policy

This policy explains what personal data ZII Ltd handles for Oscar, why, and the choices people have. There are three groups of people: the businesses that use Oscar and their teams, the people who call those businesses, and visitors to this website. We are the controller for data about businesses, their teams and website visitors, and a processor for call data, which we handle on behalf of the business that was called.

Callers to a business that uses Oscar

When you call a business that uses Oscar, that business decides what happens to your information. We handle it for them as their processor. Oscar collects what you tell him on the call, such as your name, number, address and the reason you called, plus the recording and transcript, and he may text you about your call. The business uses it to call you back, book a visit or deal with your request. To ask about your data, or to have it deleted, contact the business you called. If they ask us to delete it, we do. Reply STOP to any text to stop further texts.

Oscar is an AI. Your voice is processed by AI providers to understand you and reply, but we don’t use recordings to identify people by their voice, and we don’t create voiceprints.

Businesses and their teams

• What we collect: names, email addresses, phone numbers and roles of the people on the account; billing details (card details are held by Stripe, not by us); the business’s setup, including what we draft from its website; and how the dashboard is used.
• Why: to provide Oscar under our contract with the business, to send the alerts each person has chosen, to bill the account, to support you, and to keep the service secure. Our legal basis is performing the contract and our legitimate interest in running and improving the service.
• Marketing: we only send product news if you’ve agreed, and every email has a way to stop.
• Mobile numbers: used only for the texts you’ve chosen. We never sell or share mobile numbers or text consent with third parties or affiliates for their marketing.

Website visitors

We use Plausible, privacy-friendly analytics that don’t set cookies or track you across sites, to count visits and see which pages help. The site uses cookies that are needed to keep you logged in and secure, and our support chat may set its own cookies when you use it. If you paste a website into the homepage, we read that site’s public pages to show a preview of Oscar and, if you sign up, to start your setup. Calls you make to try the demo are recorded, as Oscar says at the start. We keep the recording and transcript for 90 days to check how Oscar did and improve him, then delete them.

Where data is kept, and who helps us

Call data, recordings and our database are kept on servers we rent from Hetzner in Ashburn, Virginia, in the United States. We use these sub-processors:

We use AI providers through their business APIs, and choose settings that keep call content out of model training wherever a provider offers that choice. Their own retention terms apply, typically a short period for abuse monitoring. Transfers from the UK rely on the UK International Data Transfer Addendum or the UK–US data bridge, as appropriate. We’ll update this list before adding a new sub-processor.

How long we keep it

• Recordings and transcripts: the retention period the business chooses (90 days unless they change it), then deleted.
• Call summaries, messages, bookings and contact details: for as long as the business keeps its account, unless the business deletes them sooner. When the account closes they are deleted within 60 days.
• Account and billing records: for as long as the account is open, and then as long as tax and accounting law requires.
• Backups roll off within 14 days.
• We may keep aggregated or de-identified information, such as call counts and outcomes, that no longer identifies anyone.

Your rights

Depending on where you live, you can ask to see, correct, delete or move your data, or object to how it’s used. Callers should contact the business they called. Anyone else can email [email protected]. We don’t sell personal data or share it for cross-context advertising. You can complain to the UK Information Commissioner’s Office (ico.org.uk) or your local regulator.

Security

Data is encrypted in transit, and the keys that connect Oscar to other services are encrypted where we store them. Our servers are in access-controlled data centres. Access is limited to the staff who need it to run and support the service. If a breach affects your data, we’ll tell the business concerned without undue delay.

Our group and business changes

We may share data with companies in our group, and transfer it to one of them or to a business that takes over Oscar through a merger, acquisition, reorganisation or sale of assets. If that happens, that company will handle your data under this policy, and may become the controller or processor in our place. We’ll update this policy and tell account owners.

Children

Oscar and this website are for businesses. We don’t knowingly collect data from children through the website or business accounts.

Changes to this policy

We may update this policy. The date at the top shows when it last changed, and we’ll tell account owners about significant changes by email.

Who we are

Oscar is provided by ZII Ltd, a company registered in England and Wales (company number 05989125). Our registered office is Orchard Dene, Heath Road, Boughton Monchelsea, Maidstone, Kent, ME17 4JN. Questions about these terms or your data: [email protected]. Anything else: contact us.