Privacy Policy
Introduction
We are Puck App Ltd, a company registered in England and Wales (company number 17306844) with our registered office at 20c Stavordale Road, London, England, N5 1NE. We are registered with the UK Information Commissioner's Office under registration number ZC260752. We provide AI-powered sales software.
Please read this privacy policy so that you are fully aware of how and why we collect and use your personal information. This privacy policy supplements our Terms of Service, including their data processing terms, or other notices or privacy policies and is not intended to override them.
Puck App Ltd is the controller of personal information we collect about our account holders, website visitors, and prospective customers, as described in this policy. When our customers use Puck to process personal information about other people, such as their prospects, contacts and call participants, we act as a processor on our customer's behalf. See "Our role as controller and processor" below. If you have any questions about this privacy policy or our privacy practices, please contact us at help@puckapp.ai.
This privacy policy is about the rights of individuals. While we are also committed to protecting the information we receive from and about companies, this policy is not about them. Therefore, when we refer to “you” in this privacy policy, we refer to you in your capacity as a natural person, as opposed to the organisation you act on the instruction or on behalf of.
Our services are not intended for children and we do not knowingly collect data relating to children.
Our role as controller and processor
Where we are the controller. We are responsible for personal information about: people who create or use a Puck account; people who visit our website or contact us; and people we contact about our own products and services.
This privacy policy explains how we handle that information.
Where we are a processor. Our customers use Puck to manage their sales activity. In doing so, they may connect their email, calendar and CRM accounts, record and transcribe calls, and add or enrich records about their own prospects, customers and other contacts. For this information ("Customer Data"), our customer is the controller: they decide what information is processed and why, and we process it only on their instructions, under the data processing terms in our Terms of Service. The service providers we use to process Customer Data are listed on our Processors page.
If you are a contact of one of our customers. If your information is in Puck because one of our customers, for example, emailed you, met with you, recorded a call with you or added you to their CRM, that customer's privacy notice applies to how your information is used. They are responsible for telling you about their use of Puck and, where required, for obtaining your consent. If you want to exercise your data protection rights, please contact that organisation directly. If you contact us instead, we will pass your request to the relevant customer and assist them in responding, as our agreement with them requires.
Personal information we collect about you
Personal information (or personal data) means any information about you from which you can be identified. It does not include information where your identity has been removed (this is anonymous data).
We may collect and use the following personal information about you:
a. Identity Data including your first name, last name, username or similar identifier, job title and function;
b. Contact Data including your email address and telephone numbers, and company details;
c. Business Information including information provided in the course of the contractual or client relationship between you or your organisation and us, or otherwise voluntarily provided by you or your organisation;
d. Technical Data including internet protocol (IP) address, your login data, device type, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our software and services;
e. Profile Data including your username and password, preferences, feedback and survey responses;
f. Usage Data including information about how you use our software and services;
g. Marketing and Communications Data including your preferences in receiving marketing from us, and your communication preferences.
h. Financial and Payment Data including billing name and address, billing contact details, VAT number and payment history. Card payments are processed by our payment provider, Stripe; we do not store full card numbers.
If you provide information to us about any person other than yourself, you must ensure that they understand how their information will be used, and that they have given their permission for you to disclose it to us and for you to allow us, and our outsourced service providers, to use it.
How we collect your personal information
Information you give us. We collect most personal information directly from you – by email, through calls and video meetings with us, and through your use of our software and services. In particular, this may occur in the following circumstances:
a. when you or your organisation seek our products and/or services;
b. when you correspond with us by phone, email or other electronic means, or in writing, or when you provide other information directly to us, including to our staff;
c. when you subscribe to our products or services on behalf of your organisation;
d. when you sign up to receive marketing communications from us; and
e. when you give us feedback or contact us.
Information from other sources. We also collect personal information about you from:
a. Sign-in providers: if you sign up or log in with Google or Microsoft, we receive your name and email address from them;
b. Business data providers and public sources: when you sign up, we use your email domain to look up information about your company, such as its name, size, logo and a description of its products, from business data providers (such as People Data Labs and Logo.dev) and your company's public website. We do this to set up your account and pre-fill your onboarding, on the basis of our legitimate interest in making Puck quick and easy to set up. You can edit or delete this information at any time;
c. Analytics providers: information about how you use our website and software (see "Cookies and analytics"); and
d. Our payment provider: confirmation of payments and limited billing details (see Financial and Payment Data).
Customer Data from other sources. When our customers use Puck, it collects information about people they do business with, such as prospects, customers and meeting participants, from:
a. email and calendar accounts the customer connects;
b. calls the customer records;
c. CRMs and other tools the customer connects or imports data from;
d. business data providers, which Puck uses at the customer's request to add information such as job titles, company details and business contact information to their records; and
e. publicly available websites, such as company websites.
We process this information as a processor on behalf of our customer, who is responsible for having a lawful basis for its use and for telling the people concerned (see "Our role as controller and processor"). Our business data providers are listed on our Processors page.
How we use your personal information
Under data protection law, we can only use your personal information if we have a proper reason for doing so, for example:
a. for the performance of our contract with you or to take steps at your request before entering into a contract;
b. to comply with our legal and regulatory obligations;
c. for our legitimate interests or those of a third party; or
d. where you have given consent.
A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests.
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so. Please note that we may process your personal information without your knowledge or consent, in compliance with the rules set out in this section, where this is required or permitted by law.
We will use your personal information for the following purposes and on the following grounds:
a. On the basis of fulfilling our contract with you or entering into a contract with you on your request, in order to:
i. register you or your organisation as a new customer and update our customer records;
ii. process and deliver your order, including sending you updates and managing payments, fees and charges;
iii. manage your subscriptions and user accounts; and
iv. deal with and respond to requests, enquiries and complaints.
b. On the basis of our legal obligations, we process your personal information when it is necessary:
i. for compliance with tax, accounting and other legal obligations which we are subject to;
ii. for managing your statutory rights;
iii. for notifying you about changes to our terms or privacy policy; and
iv. for ensuring security of your personal data by preventing unauthorised access to it;
c. On the basis of our legitimate interest, we will use your personal information for:
i. allowing effective performance of our business by ensuring necessary internal administrative, commercial, and security processes (including in finance, controlling, business intelligence, legal & compliance, information security);
ii. verifying your identity, and preventing and detecting fraud against you or us;
iii. collecting and recovering money owed to us;
iv. asking you to provide feedback, leave a review or take a survey;
v. inviting you to events or webinars we run, and to take part in surveys or product research;
vi. communicating with you and keeping you up-to-date on the latest developments, announcements, and other information about our services and solutions (including briefings, newsletters and other information), events and initiatives;
vii. promoting (including by delivering advertisements) and making suggestions and recommendations to you about products or services that may be of interest to you;
viii. using statistical data analytics about your use of our software or services to improve them, or our customer relationships and experiences;
ix. preventing unauthorised access and modifications to systems;
x. carrying out and dealing with security-related tasks, such as troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data;
xi. allowing interoperability within our applications;
xii. establishing, exercising and/or defending our legal rights; and
xiii. setting up your account and pre-filling onboarding information using publicly available information and business data providers.
Promotional communications
We may use your personal information to send you updates (by email) about our products and/or services, including exclusive offers, promotions or information about new products and/or services.
We have a legitimate interest in processing your personal information for promotional purposes (see above). This means we do not usually need your consent to send you promotional communications. However, where consent is needed, we will ask for this consent separately and clearly.
We will not sell your personal information to or share it with other organisations for marketing purposes.
You have the right to opt out of receiving promotional communications at any time by:
a. contacting us at help@puckapp.ai
b. using the ‘unsubscribe’ link in emails.
We may ask you to confirm or update your marketing preferences if you instruct us to provide further products and/or services in the future, or if there are changes in the law, regulation, or the structure of our business.
Who we share your personal information with
We may share personal information with service providers whom we use to help deliver products and/or services to you, such as security providers. We only allow our service providers to handle your personal information if we are satisfied they take appropriate measures to protect your personal information. We also impose contractual obligations on service providers to ensure they can only use your personal information to provide services to us and to you.
We may also share personal information with:
a. our professional advisors such as our lawyers or auditors when they need to give us their professional advice;
b. public authorities, agencies and other government bodies. We may disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations;
c. potential corporate buyer. We may also share some personal information in the case of transfer of some or all of our business, during re-structuring or change of ownership of the business. Usually, information will be anonymised but this may not always be possible. The recipient of the information will be bound by confidentiality obligations;
d. our insurers or brokers. Usually, information will be anonymised but this may not always be possible. The recipient of the information will be bound by confidentiality obligations; and
e. our banks. Usually, information will be anonymised but this may not always be possible. The recipient of the information will be bound by confidentiality obligations.
f. our payment provider Stripe, to process payments and manage billing. We do not store full card numbers; these are handled securely by Stripe in accordance with applicable laws and regulations.
Your personal information is stored in the European Economic Area (Ireland) and may be processed by our service providers, some of whom are based in the United States. For more information, including how we protect your personal information when it is transferred outside the UK or the EEA, see "International transfers of your personal information" below.
How long your personal information will be kept
We will keep your personal information while we are providing our products and/or services to you. Thereafter, we will keep your personal information for as long as is necessary to respond to any questions, complaints or claims made by you or on your behalf; to show that we treated you fairly; and to keep records required by law.
We will not retain your personal information for longer than necessary for the purposes set out in this policy. Different retention periods apply for different types of personal information. By law we have to keep basic information about our customers (including Identity, Contact, Financial and Payment Data and Business Information) for six years after they cease being customers.
When it is no longer necessary to retain your personal information we will securely destroy your personal information in accordance with applicable laws and regulations. In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
Call recordings, transcripts and other Customer Data are kept for as long as the customer chooses, as described in "Call recording and transcription".
International transfers of your personal information
We store and process your personal information in the European Economic Area (Ireland). Transfers of personal information from the UK to the EEA are permitted under UK data protection law without additional safeguards.
Some of our service providers are based in the United States, including the providers of the AI models that power Puck and our hosting and infrastructure providers. This means some of your personal information will be processed in, or accessible from, the United States: for example, when content is sent to an AI model to generate a response, or when a provider accesses its systems to deliver support and maintenance.
Where we transfer personal information outside the UK or the EEA, we make sure it receives an equivalent level of protection by relying on one or more of the following safeguards:
a. transferring it to a country that the UK Government (for UK data) or the European Commission (for EEA data) has recognised as providing adequate protection, including transfers to US organisations certified under the UK Extension to the EU-US Data Privacy Framework (the "UK-US Data Bridge") or the EU-US Data Privacy Framework; or
b. where no such recognition applies, entering into contracts with the recipient that require it to protect your information to UK and EU standards: the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses (for UK data), and the European Commission's Standard Contractual Clauses (for EEA data).
Our service providers, where they process data, and the safeguards that apply to each are listed on our Processors page. If you would like more information about how we protect your personal information when it is transferred internationally, please contact us at help@puckapp.ai.
Cookies and analytics
Cookies are small files stored on your device when you visit a website. We use cookies and similar technologies (such as local storage) on our website and in Puck.
Strictly necessary cookies are needed for our website and software to work, for example to keep you signed in, remember your cookie choices and keep your account secure. These are always on.
Analytics cookies help us understand how people use our website and software, such as which pages and features are used and where people get stuck, so we can improve them. We use Mixpanel, a product analytics provider, for this. When you are signed in to Puck, Mixpanel links this usage information to your account. Mixpanel processes this information on our behalf and is listed on our Processors page.
We only use analytics cookies if you consent. We use Cookiebot to ask for and record your consent. A full, up-to-date list of the cookies we use, their purposes and how long they last is in our Cookie Declaration.
You can also block or delete cookies through your browser settings, though some parts of our website and software may not work properly if you block strictly necessary cookies.
Changes to this policy
We may update this privacy policy from time to time. When we do, we will revise the "last updated" date at the top of the policy. We encourage you to review this policy periodically to stay informed about how we are protecting your information.
How we use AI in Puck
What Puck's AI does. Puck uses AI to:
- transcribe and summarise calls;
- draft emails and follow-ups;
- prepare briefings before meetings;
- update CRM records;
- suggest next steps and tasks;
- score or prioritise leads and deals; and
- answer questions about your sales activity.
Puck's agent can also take actions on your behalf, such as updating records, creating tasks, sending emails and scheduling meetings, when you ask it to or through automations you set up.
What data the AI processes. To do this, Puck sends relevant information to AI models. Depending on the feature, this can include:
- call transcripts;
- emails and calendar events from connected accounts;
- CRM records;
- enriched contact and company information;
- the business context you give Puck (such as your product description); and
- your instructions and questions.
This information often includes personal data about you and about the people you do business with. We only send what the feature needs.
Which AI providers we use. We use models from OpenAI, Anthropic and Google, accessed through their business APIs, and open-weight models run by specialist hosting providers. The full, current list is on our Processors page.
Training. Our AI providers are contractually prohibited from using your data to train their models. We do not use your data, or data from connected Google or Microsoft accounts, to train general-purpose AI models. Puck may keep workspace-specific context, such as your preferences, past activity and business details, to personalise its outputs for your workspace; this is not shared with other customers.
Retention by AI providers. Our AI providers do not use your data to train their models. They may keep inputs and outputs for up to 30 days to monitor for misuse, and for longer where content is flagged as violating their usage policies or where the law requires, after which it is deleted.
Accuracy and human oversight. AI outputs can be inaccurate or incomplete. Summaries, drafts, suggestions and scores should be reviewed before you rely on them. Puck does not send emails or make external changes without your approval, unless you have set up an automation to do so.
Automated decisions. Puck may score or prioritise leads to help your team decide where to focus. These are recommendations to the user: Puck does not make decisions about individuals that have legal or similarly significant effects on them.
Call recording and transcription
Customers can choose to enable call recording in Puck. When they do, Puck can join their video calls on Google Meet, Zoom and Microsoft Teams to record audio, create a transcript, and generate AI summaries, notes and follow-up tasks. Puck appears in the call as a participant, so everyone on the call can see it is being recorded.
What is collected: the call audio and video, a transcript of what was said, the names of participants as shown by the meeting platform, the time and duration of the call, and the summaries, notes and tasks Puck generates from it.
Our role: Call recordings and transcripts are Customer Data. The customer who enabled recording is the controller and decides which calls are recorded; we process recordings only to provide the service to that customer. The customer is responsible for informing call participants that the call is being recorded and transcribed and, where the law requires, for obtaining their consent. If you took part in a call recorded with Puck and have questions, please contact the organisation that recorded it.
Retention: Recordings, transcripts and generated content are kept until the customer deletes them in Puck or deletes their account. When a customer deletes a recording or their account, we delete the associated data from our systems within 30 days, and from backups within 90 days.
Who processes it: We use Recall.ai to transcribe audio and our LLM providers to generate summaries. These providers are listed on our Processors page and are not permitted to use recordings or transcripts to train their models.
Speaker identification: Puck labels speakers using the participant names provided by the meeting platform. We do not create voiceprints or use voice characteristics to identify individuals.
Email and calendar integrations
Users can choose to connect their Google or Microsoft email and calendar accounts to Puck. You can disconnect them at any time in Integrations, or through your Google or Microsoft account settings.
What we access:
Email: message content, subject lines, senders and recipients, dates, and thread information.
Calendar: event titles, times, descriptions, attendees and meeting links.
Why we access it: to log your sales conversations against the right contacts, companies and deals; to identify new prospects and follow-ups; to prepare you for upcoming meetings; to let Puck join meetings you've chosen to record; and to draft emails, send emails and create or update calendar events at your request.
Actions on your behalf: Puck only sends emails or creates calendar events when you ask it to, or when you've set up an automation that does so.
What we store: the email and calendar data needed to provide these features, such as message content and metadata for emails linked to your CRM records, and event details.
Retention: When you disconnect an integration, we stop accessing your account immediately and delete the stored email and calendar data within 30 days, unless it is linked to CRM records you have chosen to keep. All of it is deleted when your account is deleted, as described in "How long your personal information will be kept".
Email and calendar data is Customer Data, processed as described in "Our role as controller and processor".
Use of Google user data
Puck's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- we only use Google user data to provide and improve user-facing features in Puck;
- we do not use it for advertising, and we do not sell it;
- we only transfer it to our service providers (listed on our Processors page) as needed to provide those features, to comply with the law, for security purposes, or as part of a merger or acquisition with your prior consent;
- our staff do not read your Google user data unless you have given us permission for specific messages (for example, for support), it is needed for security purposes, it is required by law, or it has been aggregated and anonymised for internal operations; and
- we do not use Google user data, or data derived from it, to develop, improve or train generalised AI or machine learning models.
Use of Microsoft data
We handle data from Microsoft accounts to the same standard as Google user data.
Your rights
Under the applicable data protection laws you have a number of rights, as set out below:
a. Right to access your personal information. You may request confirmation that we hold personal information about you, as well as access to a copy of any such data.
b. Right to rectification. You may ask us to correct any inaccurate information we hold about you.
c. Right to erasure (or Right to be forgotten). You may, in certain circumstances, ask us to delete your personal information.
d. Right to restriction. You may ask us to restrict the processing of your personal information if (i) you want us to establish the accuracy of the information, (ii) where our use of the information is unlawful but you do not want us to erase it, (iii) where you need us to hold the information even if we no longer require it as you need it to establish, exercise or defend legal claims, or (iv) you have objected to our use of your personal information but we need to verify whether we have overriding legitimate grounds to use it.
e. Right to portability. You may request the receipt of the personal information that you have provided to us, in a structured, commonly used and machine-readable form, or its transfer to another organisation.
f. Right to object. You may object to our processing of your personal information (i) at any time when your personal information is being processed for direct marketing, or (ii) where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
g. Right not to be subject to automated individual decision making. You have the right not to be subject to a decision based solely on automated processing (or profiling) that produces legal effects concerning you or similarly significantly affects you.
h. Right to withdraw consent. Where our processing of your personal information is based on your consent, you may withdraw this consent at any time, although this will not affect the lawfulness of any prior processing where we relied on your consent.
i. Right to make a complaint. You may make a complaint about our processing of your personal information by contacting us via the contact details set out in this privacy policy. While we hope that we would be able to address any issues you have in respect of this processing, you may also make a complaint to the UK’s data protection regulator (see below).
For further information on each of these rights, see the Information Commissioner's Office guidance at https://ico.org.uk/for-the-public/.
If you would like to exercise any of these rights, please contact us using our contact details set out below.
You will not have to pay a fee to access your data or to exercise any of the other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
If your request relates to Customer Data we process on behalf of one of our customers, we will refer it to that customer, as explained in "Our role as controller and processor".
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
Confidentiality
We have put in place appropriate security measures to prevent personal information from being accidentally lost, used or accessed unlawfully, altered or disclosed. We limit access to your personal information to those who have a genuine business need to access it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.
We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.
We protect personal information using measures including encryption in transit and at rest, access controls limited to those who need it, and hosting with providers that maintain recognised security certifications. For details of our service providers, see our Processors page.
How to complain
We hope that we can resolve any query or concern you may raise about our use of your personal information.
You can complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/, by phone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. The ICO will usually expect you to have raised your concern with us first.
Contact us
If you have any questions about this privacy policy or want to exercise your rights, contact us at:
Email: help@puckapp.ai
Post: Puck App Ltd, 20c Stavordale Road, London, England, N5 1NE
Last updated: 30 September 2026