Privacy and Cookies
Last updated 10 November 2026
The short version. If you spoke to Nell when you rang a clinic or a trade business, that business decides what happens to your details and we handle them on its instructions. If we emailed your business, you can tell us to stop and we will. This site sets no tracking cookies. We do not sell personal data.
- 1. Who we are
- 2. Two roles: which one applies to you
- 3. If you spoke to Nell or got a message
- 4. Data we handle for ourselves
- 5. Recordings and transcripts
- 6. How AI is used
- 7. Who we share data with
- 8. Data sent outside the UK
- 9. How long we keep data
- 10. Your rights (UK)
- 11. United States residents
- 12. Security
- 13. Children
- 14. Cookies
- 15. Changes and contact
1. Who we are
On It is a trading name of Atanas Atanasov, a sole trader based in England. We are registered with the Information Commissioner's Office (ICO) as a data controller, registration reference ZC174087. For anything about privacy, email hello@onitassist.com.
2. Two roles: which one applies to you
| You are | Who decides how your data is used | Our role |
|---|---|---|
| Someone who rang a business and Nell answered, or who got a text or email from Nell in a business's name | That business (the "controller") | We act for the business under a written contract (we are its "processor") |
| A visitor to this site, someone who asked for a demo or rang our demo line, a business we emailed, or a contact at one of our clients | On It (we are the "controller") | We decide, and this policy is our notice to you |
3. If you spoke to Nell or got a message
When Nell answers the phone for a business, she handles your details for that business. Typically that is your name, phone number, what you rang about, the appointment you booked, and a recording and transcript of the call. For old-enquiry messages, the business gives us your name, phone number or email and what you enquired about.
We use that information only to do the job for that business: answer the call, make the booking, send the confirmation and the note. We do not use it for our own marketing, we do not combine it with data from other businesses, and we do not sell it.
The business's own privacy notice tells you how it uses your information. To see, correct or delete your details, or to stop messages, contact the business. If you contact us instead, we will pass your request to the business without delay. Replying STOP to a text or using the unsubscribe link in an email always works.
Nell does not ask for medical details. If you mention a health matter while booking, it may appear in the call note that goes to the clinic. Clinics are responsible for handling health information lawfully, and our contract with each clinic requires us to protect it.
4. Data we handle for ourselves
| What | Why | Lawful basis (UK GDPR) |
|---|---|---|
| Demo requests and emails to us. Business name, your name, email, phone, what you tell us. | To reply, arrange a demo and, if you go ahead, set up the service. | Legitimate interests (answering an enquiry); steps before a contract. |
| Calls to our demo line. Your phone number, a recording and transcript, anything you say. | To show how Nell works and to improve her. | Legitimate interests. Nell tells you about recording at the start. |
| Business outreach. Company name and number, registered address, website, a business email address, and sometimes the name and job title of an owner or practice manager. | To tell limited companies and LLPs about a service that may be useful to them. | Legitimate interests. You can object at any time and we will stop. |
| Client contacts and billing. Names, emails, phone numbers of the people we deal with at a client; invoices and payment records. | To provide the service, get paid and keep required records. | Contract; legal obligation (tax records). |
| Website visits. Technical data our hosting provider logs automatically, such as IP address, browser type and the page requested. | To keep the site secure and working. | Legitimate interests. |
Where outreach data comes from
If we emailed your business without you contacting us first, we found it in public sources: the Companies House register and your business's own website or public business listing. We contact corporate bodies only (limited companies and LLPs). Every email names the sender and tells you how to stop. Say stop once and we add you to a do-not-contact list so it does not happen again.
5. Recordings and transcripts
Calls answered by Nell are recorded and transcribed. Nell says so at the start of each call. Recordings exist so the business gets an accurate note and so mistakes can be checked and fixed. Unless a client has asked for a shorter period:
- call audio is deleted after 30 days;
- transcripts and call notes are deleted from our systems after 90 days. The business may keep the note in its own records for longer under its own policy.
If you do not want to be recorded, please end the call and contact the business another way.
6. How AI is used
Nell uses speech recognition to turn what you say into text, an AI language model to work out a reply, and a synthetic voice to speak it. Nell tells callers she is an AI assistant. She does not make decisions that have a legal or similarly significant effect on you: she books appointments and takes messages, and a person at the business can always review or change what she did. We do not use callers' recordings or transcripts to train AI models, and we choose provider settings that prevent it wherever that setting exists.
7. Who we share data with
We use a small number of service providers to run On It. They may handle personal data only on our instructions:
- a voice AI platform that runs the calls, with the speech and language model providers it uses;
- phone and text message carriers;
- email delivery and mailbox providers;
- a workflow automation tool that connects the steps together;
- calendar and booking systems chosen by each client;
- website hosting and domain providers;
- payment and invoicing providers, for client billing only.
Clients receive the current named list of providers with their Data Processing Agreement, and anyone can ask us for it. We also share data when the law requires it, or with a buyer if the business is ever sold, under the same protections. We do not sell personal data and we do not share it for advertising.
8. Data sent outside the UK
Some of our providers are based in the United States. When personal data from the UK goes to them, it is protected by one of the safeguards UK law accepts: the provider's membership of the UK Extension to the EU–US Data Privacy Framework (the "UK–US data bridge"), or the UK International Data Transfer Agreement or Addendum. You can ask us for details.
9. How long we keep data
- Call recordings: 30 days. Transcripts and call notes: 90 days.
- Old-enquiry campaign lists: deleted or returned 30 days after the campaign ends. Opt-outs are kept so the request keeps being respected.
- Demo requests and correspondence: up to 24 months after our last contact.
- Outreach data: up to 12 months after our last email if you never reply. Do-not-contact entries are kept so we do not email you again.
- Client contracts and invoices: 6 years after the contract ends, as tax law requires.
- Website logs: as set by the hosting provider, normally no more than 30 days.
10. Your rights (UK)
Under UK data protection law you can ask us to: confirm what we hold about you and give you a copy; correct it; delete it; restrict how we use it; move it to another provider; and you can object to our use of it, including any use for direct marketing, which we will always stop. There is no charge. Email hello@onitassist.com and we will reply within one month. If we hold your data on behalf of a business (section 3), we will pass your request to that business.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
11. United States residents
In the US we work for trade businesses such as plumbing, roofing and heating and cooling companies. When Nell answers a call for one of them, we act as that business's service provider (processor): we use callers' information only to provide the service to that business.
- We do not sell personal information, and we do not share it for cross-context behavioural advertising.
- We do not knowingly provide the service to US healthcare providers, and Nell is not intended to receive protected health information under HIPAA.
- Calls are recorded. Nell announces that she is an AI assistant and that the call is recorded at the start of every call, in every state.
- If your state's privacy law gives you rights to access, correct or delete your information, or to opt out of certain uses, send your request to the business you called, or to us and we will pass it on. We will not treat you differently for making a request.
On It is a small business and does not currently meet the size thresholds of the US state privacy laws. We follow the practices above regardless.
12. Security
We keep access to client data to the minimum needed, protect accounts with strong passwords and two-step sign-in, use providers that encrypt data in transit and at rest, and delete data on the schedule above. No system is perfectly secure. If a breach affects your data and creates a risk to you, we will tell the business concerned, the ICO where required, and you where the law requires it.
13. Children
On It is a business service and is not aimed at children. A parent may book an appointment for a child through Nell; the business is responsible for that information.
14. Cookies
This website does not use advertising or analytics cookies, and it does not track you across other sites. That is why there is no cookie banner.
- The missed-call sum on the home page runs in your browser. The numbers you enter are not sent to us.
- The demo form opens your own email program. Nothing is sent until you press send in it.
- Our hosting and security providers may set a strictly necessary cookie to protect the site from attacks. It is not used to identify you.
- The site's typeface is loaded from Google Fonts, which means your browser asks Google's servers for the font file and Google sees your IP address when it does. Google says it does not use this to profile you.
If we ever add analytics or anything else that is not strictly necessary, we will ask for your consent first and update this page.
15. Changes and contact
We will update this page when what we do changes. The date at the top shows the latest version. Questions: hello@onitassist.com.