Privacy Policy

Last updated: 24 July 2026

Sturdy Ai ("we", "us") is an AI & automation business based in Frome, Somerset, United Kingdom. This policy explains what personal data we collect, why, and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018).

Who is responsible

The data controller is STURDY AI LTD (t/a Sturdy Ai), company no. 17338547, Frome, Somerset, BA11 5HD, United Kingdom. Contact: team@sturdyai.uk.

What we collect and why

• Contact details (name, email, phone) when you enquire — by email, phone, or by talking to Sturdy Ai, our AI agent. Used to respond to you and follow up. Lawful basis: legitimate interest.
• Voice conversations. Calls and web conversations with Sturdy Ai are processed by our voice platform (ElevenLabs) and telephony provider (Twilio) and may be transcribed and summarised so we can act on your enquiry and improve the agent. We tell you you're talking to an AI. Lawful basis: legitimate interest.
• Booking data for storage customers. If you book a storage unit through a client's voice agent, your details are written into that operator's own storage management system (e.g. Stora). For that data the storage operator is the controller and we act as their processor.
• Payments. All payments are processed by Stripe or by the storage platform's own hosted checkout. Card details never touch Sturdy Ai systems — our agents never accept card details by voice; they send a secure checkout link instead.
• Website. We use privacy-friendly, cookie-less analytics. No advertising trackers.

Who we share data with

Only the service providers needed to run the product: ElevenLabs (voice), Twilio (telephony/SMS), Anthropic and Google (language models — Anthropic also hosts the "brain" memory our agents read from, on its Managed Agents platform), Cloudflare (edge hosting), Stripe (payments), and — for storage bookings — the operator's own management platform. We do not sell personal data.

International transfers

Anthropic PBC is based in the United States, so brain memory and conversation summaries processed on its platform are transferred outside the UK. That transfer is covered by Anthropic's Data Processing Agreement, which incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum — a lawful transfer mechanism under UK GDPR. Other providers may also process data outside the UK under equivalent safeguards.

Retention

Enquiry records and conversation transcripts are kept while relevant to an active relationship and then deleted or anonymised. A scheduled deletion routine removes stale AI session data from our providers on a rolling basis. Booking data lives in the storage operator's system under their policy.

Your rights

You can ask for a copy of your data, correction, deletion, or restriction of processing, and you can object to processing based on legitimate interest. Email team@sturdyai.uk. You can also complain to the ICO (ico.org.uk).