Privacy Policy — QuietStaff Ltd
1. Who we are
QuietStaff Ltd ("QuietStaff", "we", "us", "our") is a UK-incorporated company developing Quiet Staff One, an Agent-as-a-Service product for small businesses, and incubating specialist AI model ideas through Quiet Staff Labs. We also offer scoped AI advice, workflow implementation, integration and support services.
- Registered office: 66 Paul Street, London, EC2A 4NE, United Kingdom
- Company registration number: 17171308
- ICO registration number: ZC130484
- Data protection contact: privacy@quietstaff.com
QuietStaff has voluntarily designated a Data Protection Officer under UK GDPR Article 37(4), even though designation is not statutorily required for our processing activities. The current DPO is the CEO of QuietStaff Ltd, designated under Director's Resolution dated 29 April 2026, reachable at privacy@quietstaff.com.
This Privacy Policy describes how we collect, use, share, and protect personal data when you visit our website at quietstaff.co.uk, contact us, request information, or discuss our developing products or research direction, or engage QuietStaff for AI advice, workflow implementation, integration and support services. It is written to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Privacy and Electronic Communications Regulations 2003 (PECR).
2. The personal data we collect
We collect different categories of personal data depending on how you interact with us.
Whether providing personal data is required: You are not statutorily obliged to provide personal data to use our website. Providing personal data when you contact us or request information is voluntary — without it, we cannot respond to your enquiry or onboard you as a Customer. Providing personal data under a signed engagement is a contractual requirement under that engagement — failure to provide such data may prevent us from delivering the Services.
2.1 When you visit our website
Our hosting provider (GitHub Pages, operated by GitHub Inc.) logs standard request data for security, abuse prevention, and basic operational diagnostics:
- IP address (used briefly by the host for abuse prevention; not retained by QuietStaff in our own systems)
- User-agent string (browser type, device type, operating system)
- Referring URL
- Request URL (which page on the site you requested)
We do not currently use website analytics, marketing tools, or any third-party tracking on this site. If we add such tools in the future, we will update this section and obtain consent before setting any non-essential cookies or similar technologies (see §9).
Client-side storage: the site uses your browser's localStorage to remember your dark/light theme preference. See §9 for details.
2.2 When you contact us or request information
- Identifiers: name, email address, phone number (if provided)
- Business context: company name, role, industry, size band
- Communication content: the substance of your enquiry, attachments you send
- Marketing preferences: whether you have consented to receive further communications
2.3 When you engage QuietStaff for services
In addition to the above:
- Commercial information: signed agreements, invoices, payment confirmations
- Project information: stakeholder names, system access credentials you authorise, business process descriptions
- Customer Personal Data that you (as Data Controller) instruct us (as Data Processor) to process on your behalf as part of the Services. This is governed by our Data Processing Agreement.
2.4 When we contact you as a business prospect
We sometimes contact businesses we think could benefit from our services before they have contacted us. We do this by email or by phone, only with companies and limited liability partnerships, and only at business contact details. Before we phone a number, we check it against the Telephone Preference Service and the Corporate Telephone Preference Service. We never call a number on either register, or anyone who has asked us not to call.
- Where the data comes from: publicly available sources — Companies House (company name and number, registered office, and the names and roles of its officers) and the business's own website or public business listings, such as its Google Business Profile (business email address, business phone number, role).
- What we hold: your name and role, business email and phone, company details, and a short note on why we think we can help (for example, a public job advert, a public review, or how your website handles enquiries). We do not collect special-category data or personal social-media content.
- Why, and our legal basis: to offer our services to your business, under Article 6(1)(f) — legitimate interests. We contact you at business details, about business services, with an immediate opt-out, and we consider this does not override your interests.
- Who else sees it: our email and document providers (see §4.2), our hosting provider Cloudflare, which stores the business records and call notes our calling team works from, our phone provider, a screening service that checks business phone numbers against the TPS and Corporate TPS registers, and, where we use them, services that help us find and check publicly listed business contact details (web-data extraction and email-validation tools). Our calling team works for QuietStaff from India and sees only the company details and business phone number needed to make the call. We never sell it or share it for anyone else's marketing.
- How long we keep it: up to 12 months from our last contact if we do not start working together (see §6).
- Your right to object: reply "no thanks" to any of our emails, tell the person who calls you that you would rather we did not call again, or email privacy@quietstaff.com, and we stop straight away. We keep only a minimal do-not-contact entry (your email address, phone number or company domain) so that we never contact you again.
Our first email to you links to this section. When we phone you, we tell you where we found your number and where to find this notice before the call ends. Either way, you have this information from the start (UK GDPR Article 14).
We do not knowingly collect personal data of children under 16.
3. How we use your personal data and our legal basis
| Purpose | Legal basis (UK GDPR Article 6) |
|---|---|
| Responding to your enquiry or request | Article 6(1)(b) — performance of pre-contractual measures at your request |
| Delivering Services under a signed engagement | Article 6(1)(b) — performance of contract |
| Sending direct marketing about similar services to existing or prospective customers (B2B) | Article 6(1)(f) — legitimate interests, balanced against your interests, with a clear opt-out |
| Contacting businesses we have identified from public sources (see §2.4) | Article 6(1)(f) — legitimate interests in offering our services to businesses, with an immediate opt-out |
| Complying with legal, accounting, and regulatory obligations | Article 6(1)(c) — legal obligation |
| Maintaining and improving our website and services | Article 6(1)(f) — legitimate interests in operating our business |
| Protecting our legal rights, including in connection with disputes | Article 6(1)(f) — legitimate interests in defence of legal claims |
We do not use personal data for automated decision-making that produces legal or similarly significant effects. We do not process special-category personal data unless you provide it voluntarily and we have obtained your explicit consent.
4. Who we share personal data with
We share personal data only with the following categories of recipients, and only to the extent necessary:
4.1 Sub-processors
When delivering Services under a signed engagement, we use Sub-processors listed at quietstaff.co.uk/sub-processors. Each Sub-processor is bound by a written Data Processing Agreement.
4.2 Operational service providers
To run our business, we share limited personal data with:
- Cloud infrastructure and AI model providers (Amazon Web Services EMEA SARL, UK / EU regions, for our consulting engagements; for QuietDesk, Anthropic, Resend, Stripe and Cloudflare, as set out in the QuietDesk sub-processors part of this policy)
- Email and document infrastructure (Google Workspace — EU/global)
- Banking and payment providers (Tide, Wise — for invoicing and payment processing of QuietStaff's own data, not Customer Personal Data)
- Card payments (Stripe — processes card payments for Quiet Build purchases: your name, email, company name and card details. We never see or store your full card number. Stripe handles this data under its own privacy policy.)
- Call booking (Cal.com — scheduling for intro calls: your name, email and the answers you give on the booking form)
- Professional advisers (accountants, legal advisers, insurers) — when relevant to a specific matter, on a confidential basis
- Website enquiry handling (Cloudflare, Inc. — Workers and Email Routing, for contact-form delivery)
4.3 Legal disclosures
We may disclose personal data when required by law, court order, or regulator (including the Information Commissioner's Office), or when necessary to protect our legal rights or the rights of others.
5. International transfers
Some of our service providers process personal data outside the UK. Where this involves a Restricted Transfer under UK GDPR, we rely on:
- EU Standard Contractual Clauses + UK International Data Transfer Addendum for transfers to Google (multi-region) under Google's standard DPA
- UK adequacy for transfers within the UK and to EEA countries
QuietDesk, our enquiry-handling service, sends personal data to Anthropic (whose API it calls directly), Resend, Stripe and Cloudflare, which are US-headquartered. The transfer mechanism for each of them is not yet confirmed. See the QuietDesk sub-processors part of this policy and our Sub-processor List.
All transfers are subject to safeguards required by UK GDPR Articles 44–49. You may request a copy of the relevant transfer mechanism by emailing privacy@quietstaff.com.
6. Data retention
We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention is required by law.
| Category | Retention period |
|---|---|
| Server request logs | Controlled by GitHub Pages (our host) under GitHub's own policy; QuietStaff does not retain server logs in its own systems |
| Marketing enquiries (no engagement) | Up to 24 months from last contact, then deleted |
| Business prospect records sourced from public sources (no engagement) | Up to 12 months from last contact, then deleted |
| Do-not-contact entries | Kept while we carry out prospecting, holding only the email address, phone number or company domain needed to make sure we never contact you again |
| Engaged Customer records (contracts, invoices, project files) | 7 years from end of engagement (UK accounting and tax requirements) |
| Customer Personal Data processed on Customer's behalf | For QuietDesk, as set out in the QuietDesk retention part of this policy and in section 12 of our Data Processing Agreement. For other engagements, as the signed Data Processing Agreement for that engagement provides. Kept longer only where the law requires it. |
| Email correspondence not associated with a specific engagement | Up to 24 months, then deleted or archived in accordance with internal retention policy |
7. Your rights
Under UK GDPR you have the following rights, free of charge in most cases:
- Right of access (Article 15) — receive a copy of personal data we hold about you
- Right to rectification (Article 16) — correct inaccurate or incomplete data
- Right to erasure (Article 17, "right to be forgotten") — delete personal data in defined circumstances
- Right to restrict processing (Article 18) — limit how we use your data
- Right to data portability (Article 20) — receive your data in a structured, machine-readable format
- Right to object (Article 21) — including the right to object to direct marketing at any time
- Right not to be subject to solely-automated decisions (Article 22) — though we do not currently rely on such decisions
- Right to withdraw consent at any time, where processing is based on consent
To exercise any right, email privacy@quietstaff.com. We respond within one calendar month under UK GDPR Article 12(3) (extendable to three months for complex requests, with notification).
If you are unhappy with how QuietStaff has handled a privacy request or complaint, please first contact us at privacy@quietstaff.com so we can attempt to resolve the matter. We aim to respond to internal complaints within 14 days.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by phone on 0303 123 1113.
8. Security
We implement appropriate technical and organisational measures (TOMs) to protect personal data against unauthorised access, loss, alteration, or disclosure. These include:
- Multi-factor authentication on administrator accounts
- Full-disk encryption on company devices
- Centrally-managed credential vault with no plaintext sharing
- Access on a least-privilege basis, with quarterly access reviews
- A data minimisation principle — we prefer anonymised, redacted, synthetic, or representative-sample data where practical
Data hosting and regions. Customer Personal Data processed by QuietStaff is hosted in UK/EU regions only (AWS EMEA SARL, eu-west-2 London). Operational data handled via Google Workspace is processed under Google's standard regional commitments — see the Sub-processor List for details. All data hosting providers apply encryption at rest and in transit under their published security standards.
The full QuietStaff Information Security Policy is available on request from privacy@quietstaff.com.
9. Cookies and similar technologies
This website does not use analytics, marketing, or third-party tracking cookies.
What we use today
We use only strictly necessary cookies and similar technologies (specifically: browser localStorage) under PECR Regulation 6(4):
- Theme preference (browser
localStorage) — stores your dark/light mode choice so the site renders consistently across visits. No personal data. Not shared with any third party. Can be cleared at any time via your browser settings.
What our host logs
Our hosting provider (GitHub Pages, operated by GitHub Inc.) may log standard request data (IP address, user-agent, request URL) for security, abuse prevention, and operational diagnostics. This is described in §2.1 above and is governed by GitHub's own privacy policy at docs.github.com/en/site-policy/privacy-policies/github-privacy-statement.
GitHub Inc. is a US-based entity. The international transfer mechanism for any personal data inferred from server-side logs is described in §5 (International transfers).
What we don't use
- No analytics cookies (Google Analytics, Plausible, Fathom, etc.)
- No marketing or advertising cookies
- No third-party tracking pixels
- No session-replay tools
- No cross-site tracking
If we add non-essential cookies in the future
If we introduce analytics, marketing, or any non-essential client-side tracking in the future, we will:
- Update this Privacy Policy to disclose the new categories, lawful basis, and retention,
- Implement a consent banner under PECR Regulation 6,
- Not set any non-essential cookie or similar technology before obtaining your prior consent.
10. Direct marketing
We may send marketing communications about our services to existing or prospective business contacts where you have provided your business email address in a business context. You can opt out at any time by clicking "unsubscribe" in any email, or by emailing privacy@quietstaff.com. We rely on the "soft opt-in" under PECR Regulation 22 for existing customers, and on legitimate interests for B2B prospects, in each case with an immediate opt-out.
11. Children
Our services are aimed at businesses, not children. We do not knowingly collect personal data from anyone under 16. If we become aware we hold such data, we will delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. The "Effective date" at the top reflects the latest material update. Material changes will be notified to existing customers by email and posted on this page for at least 60 days before taking effect.
13. Contact us
For any privacy or data protection question, request, or complaint:
Email: privacy@quietstaff.com
Post: Data Protection Contact, QuietStaff Ltd, 66 Paul Street, London, EC2A 4NE, United Kingdom
ICO: You may also complain to the Information Commissioner's Office at ico.org.uk
14. QuietDesk
When we are the processor
When a heating or plumbing firm uses QuietDesk, QuietStaff Ltd handles the personal data of that firm's customers and enquirers on the firm's instructions. For that data the firm is the controller and we are its processor. The terms are in our Data Processing Agreement.
What we process
- the text of chat messages, web form enquiries and forwarded emails;
- contact details, such as a name, an email address, a phone number and how the person prefers to be contacted;
- a postcode; and
- details of the job the person describes.
Why we process it. We process it only to provide QuietDesk to the firm: to answer enquiries, offer visit slots the firm confirms, draft quotes the firm approves, chase enquiries on day 2, 5 and 10, and send alerts, customer emails and lead summaries to and for the firm.
Who else is involved. We use other providers to do this. The Sub-processors part of this policy names them.
If you are a customer of one of these firms. That firm is the controller of your data. Please contact the firm first. If you write to us, we will pass your request to the firm.
How long we keep this data is explained in the Retention part of this policy.
When we are the controller
QuietStaff Ltd is the controller of some personal data connected with QuietDesk. That data is not the data of a firm's customers; it belongs to the firm's owner or to people who try our product page.
| Who and what | What we hold and why | Lawful basis |
|---|---|---|
| The firm owner: sign-in and account details | The email address and phone number on the firm's account. To sign in, the owner receives a 6-digit code at that email address. We store only hashes of the code and the email for sign-in. We use these details to run the account and to send the owner alerts about it. | Performing our contract with the firm, and our legitimate interests in keeping sign-in secure. |
| The firm owner: billing | When the firm signs up, Stripe Checkout collects a business name and an email address, and Stripe collects the card. We keep the Stripe customer id and the state of the paid plan so that we can bill and manage the plan. | Performing our contract with the firm, and complying with our legal obligations to keep financial records. |
| People who use the product page | What a visitor types into the demo chat, and the browser check that runs at the start of a chat. See Demo visitors and Cookies and browser storage on the QuietDesk page. | Our legitimate interests in running the demo that the visitor chooses to try and in protecting it from automated abuse. |
To ask about this data, write to privacy@quietstaff.com.
Demo visitors
The product page has a demo chat. The demo firm is a made-up heating firm that we run. If you try the demo, please do not enter real personal details. Use made-up details.
- What is stored. What you type in the demo chat, and any enquiry details you type, are stored in the same way as a real firm's enquiries, under the demo firm.
- Who is the controller. For what you type into the demo, QuietStaff Ltd is the controller. The reason we use it is to let you try the demo, as set out in When we are the controller.
- Who else receives it. What you type is sent to Anthropic's API to write the demo's replies.
- Browser check. At the start of a new demo chat, Cloudflare Turnstile checks your browser. See Cookies and browser storage on the QuietDesk page.
- How long. Personal data should be kept no longer than it is needed. We have not yet fixed a period for deleting demo conversations; the Retention part of this policy says what is known.
To ask about what you typed in the demo, write to privacy@quietstaff.com.
Contact consent and how to withdraw it
When someone makes an enquiry in the chat on a firm's website, a tick box asks whether they agree that the firm may email them about the enquiry, including a quote and reminders. The enquiry form has the same tick box. It is optional and starts unticked. If the box is ticked, QuietDesk records the time of the tick and the version of the wording shown. The first tick is the one recorded.
The tick is not needed to make an enquiry. Without it, the enquiry is still recorded and still reaches the firm, but QuietDesk does not send that person a quote, a visit confirmation, a message that a visit has been moved, declined or released, or a chasing email. Some emails are still sent without the tick, because they answer what the person has just asked or done: replies to the enquiry form or to a forwarded email, emergency and holding replies, a message that a visit slot is being held, and confirmation that a quote was accepted or rejected or that a cancellation was received.
Enquiries that reach QuietDesk as forwarded email cannot carry a tick. QuietDesk sends them no automated quote, visit confirmation or chasing email. The firm follows them up itself.
How to withdraw your consent
Unticking the box in the chat does not withdraw consent you have already given. To withdraw it, use the unsubscribe link at the end of the reminder and follow-up emails the firm sends you through QuietDesk, or contact the firm directly. The unsubscribe link stops further emails from that firm to your email address, cancels emails waiting to be sent, and tells the firm. After you unsubscribe you will still receive confirmation of a quote you have already accepted or cancelled, messages about a visit that is already booked, and safety advice.
There is no separate way to opt out of phone calls through QuietDesk. To stop calls, tell the firm.
Withdrawing does not delete the record of your tick. It stays with the enquiry and is removed or kept as the Retention part of this policy explains.
Retention
QuietDesk keeps the records of an enquiry for 12 months from the last activity on it. The last activity is the most recent change to the enquiry, its messages, its quote or its visit bookings. Recording contact consent does not count as activity. When an enquiry has had no activity for 12 months, a scheduled job deletes its messages, the contact details and message given with it, its visit bookings, any quote that was not accepted, and the emails and alerts sent about it. This applies to enquiries made to firms that use QuietDesk and to enquiries made in the demo chat.
Some data is removed sooner. Stored extracts of email text are removed after 30 days: the message text of an enquiry that arrived by email, and the extract of the customer's message in alerts and owner emails that have been sent or have failed. A working copy of each lead is deleted 30 days after it is created. Chat session data is deleted within an hour, and records used to limit abuse within two days.
What is kept for longer than 12 months
- Enquiries with an accepted quote. If a quote has been accepted, the enquiry and its records are not deleted at 12 months. No end date has been set for them yet.
- The audit trail. QuietDesk keeps an audit trail of what happens on each enquiry. It cannot be changed or deleted, and it is not deleted at 12 months. Where it refers to an enquiry that has reached 12 months, that enquiry is not deleted but cleared: the job details, postcode and area, urgency, preferred times, contact name and contact details are removed from it. Some audit entries still hold a customer's name with the time of a visit slot that was held, and text QuietDesk suggested for the enquiry, such as the job or the postcode. No end date has been set for the audit trail.
- Records of incoming messages. For each incoming message, QuietDesk keeps a hashed form of the sender's identity, the message reference and what happened to the message. These records are not linked to an enquiry and are not deleted at 12 months. No end date has been set for them.
- Customer messages passed to a firm's owner. When QuietDesk emails a customer's message to the firm's owner, the record of that email may not be linked to an enquiry. Once the email has been sent or has failed, the text of the message is removed after 30 days, but the customer's name and email address stay in the record after 12 months. No end date has been set for them.
- Unsubscribe list. If someone unsubscribes from a firm's emails, their email address is kept on that firm's unsubscribe list with no end date, so that the opt-out keeps working.
To ask for an enquiry to be deleted sooner, contact the firm you made it to. The firm decides, and we act on its instructions. For the demo chat, write to privacy@quietstaff.com.
Cookies and browser storage on the QuietDesk page
Sub-processors
To run QuietDesk we use the sub-processors below. Our sub-processor list shows the same four in its QuietDesk section, with what is confirmed about region and transfer mechanism.
- Anthropic (Claude API, called directly by QuietDesk): writes the replies in the chat and to enquiry emails. The text of chat and email messages and the firm's knowledge text are sent to it.
- Resend: sends QuietDesk's emails, including emails to a firm's customers, alerts to the firm and lead summaries. Recipient email addresses and the message text are sent to it.
- Stripe: runs billing and Checkout for firms that subscribe. Stripe collects a business name, an email address and card details, and holds the card. We keep only the Stripe customer reference and the state of the subscription.
- Cloudflare: hosts QuietDesk (Workers), stores enquiry data (D1) and short-lived session data and lead copies (KV), receives forwarded enquiry email (Email Routing), and runs the Turnstile browser check.
Browser check. When a new chat starts, and when the enquiry form is sent, Cloudflare Turnstile checks the browser. The browser loads the check from Cloudflare, and QuietDesk then sends the result and the visitor's IP address to Cloudflare to verify it.
Where the data goes. Anthropic, Resend, Stripe and Cloudflare are US-headquartered. We have not yet confirmed the processing region or the transfer mechanism for each of them.
QuietDesk uses no other sub-processor. Before we add one, we will update the sub-processor list.