Privacy Policy

This policy explains how Pegasus Reply ("we," "us") collects and uses personal data. It applies both to business owners who hold an account with us, and to the callers/customers of those businesses whose missed calls we help follow up on.

An important distinction

For your own account details (name, email, business information, billing), we are the data controller — we decide how and why that data is used, as described below.

For your customers' data (their phone numbers and the content of their text conversations with your AI assistant), you, the business, are the data controller, and we act as your data processor— we handle that data only to provide the Service to you, on your instructions. If you use Pegasus Reply, you're responsible for having a lawful basis to text your own customers and for handling their data rights requests, though we'll assist where we reasonably can.

What we collect

From business owners (account holders):

• Name and email address (for login and account management)
• Business details you provide: business name, hours, services, FAQ, phone numbers
• Billing information — payment card details are handled entirely by Stripe; we never see or store your full card number

From your customers (callers/texters):

• Their phone number
• Call metadata (time, duration, whether it was answered)
• The content of SMS conversations with your AI assistant

How we use it

• To operate the Service — detecting missed calls, sending texts, and running the AI conversation
• To generate AI replies based on your business's information and the conversation so far
• To notify you (by SMS/email) when a conversation is escalated and needs your attention
• To process subscription payments and manage your account
• To debug and improve the reliability of the Service

Who we share data with

We use the following subprocessors to run the Service. Each only receives the data necessary for its specific role:

• Twilio — sends/receives calls and SMS messages
• Anthropic (Claude API) — processes conversation text to generate AI replies
• Stripe — processes subscription payments
• Supabase — hosts our database and handles account authentication
• Resend — sends transactional emails (e.g. escalation notifications)
• Vercel — hosts the application

Some of these providers are based outside the UK/EEA (including the US). Where data is transferred internationally, we rely on the safeguards those providers offer (such as Standard Contractual Clauses) to keep it protected to UK standards.

How long we keep data

We retain conversation and call data for as long as your account is active, plus a reasonable period afterward in case you reactivate or need historical records, after which it's deleted. You can request earlier deletion at any time (see below).

Your rights

Under UK data protection law, you have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. To exercise any of these rights — whether you're a business owner or someone whose call/text was handled by a business using Pegasus Reply — email maxhendricks70@gmail.com. If your request relates to a specific business's customer data, we may need to involve that business, since they are the data controller for that information.

Cookies

We only use strictly necessary cookies required for you to stay signed in to your account. We don't use tracking, analytics, or marketing cookies at this time.

Security

We use industry-standard measures (encryption in transit, access controls, and row-level database security) to protect the data we hold. No system is completely immune to risk, but we take reasonable steps to keep your data safe.

Changes to this policy

We may update this policy from time to time. We'll make reasonable efforts to notify active account holders of material changes.

Contact

Questions about this policy or how your data is handled? Email maxhendricks70@gmail.com.