Privacy Policy

Last updated: 11 May 2026

This Privacy Policy explains how Liris Technologies Ltd(“Liris”, “we”, “us”) collects, uses, and shares personal data in connection with Alys, our AI receptionist service for real estate professionals. Liris is registered in England and Wales (company number 15882599) with registered office at Tec Marina, Terra Nova Way, CF64 1SA, United Kingdom, and is the data controller of the personal data described below.

1. Information we collect

We collect the following categories of personal data:

• Account data: your name, business email address, brokerage name, the markets you serve, and a hashed authentication credential managed by Clerk.
• Phone configuration: the business phone number you forward to Alys, the dedicated Alys number we provision for you, and carrier metadata.
• Call data: recordings, transcripts, caller phone numbers, durations, AI-generated summaries, lead qualifications, sentiment indicators, and any structured fields (such as a caller-supplied name or property of interest) extracted from the conversation.
• Calendar data: if you connect Google Calendar, free/busy windows and the events Alys creates on your behalf. We do not read the content of events we did not create.
• Listing data: the public Zillow profile URL you provide and the listing metadata fetched from it (address, price, status, photos).
• Payment data: handled by Stripe; we store only the customer and subscription identifiers and the billing status mirror, never raw card details.
• Usage data: IP address, device and browser information, and application logs (timestamps, request paths, error traces) used to operate and secure the service.

2. How we use your data

We process personal data for the following purposes and on the following bases:

• To provide the service (performance of contract): answering calls, generating transcripts and summaries, booking appointments, sending notification emails, and showing your data in the Alys dashboard.
• To operate and improve the service (legitimate interests): monitoring quality, debugging, securing the platform, and aggregate, non- identifying analytics.
• To process payments (performance of contract): managing subscriptions and invoices via Stripe.
• To communicate with you (legitimate interests and, where required, consent): transactional emails, service updates, and responses to support enquiries.
• To comply with legal obligations: tax, accounting, and regulatory record-keeping.

We do not use your call data, transcripts, or other Content to train our own or third-party AI models. Models we use are accessed via APIs in inference-only mode.

3. Sub-processors and third parties

We share personal data with a limited set of vetted sub-processors that perform services on our behalf, under contractual data-protection commitments:

• Clerk — authentication and identity management.
• Stripe — payment processing and subscription billing.
• Twilio — telephone number provisioning and carrier-grade voice connectivity.
• Vapi — real-time voice AI infrastructure.
• Google (Gemini API) — large language model used to transcribe and analyse call content.
• Google Calendar — optional calendar integration, only if you connect your account.
• MongoDB Atlas — primary data storage.
• Resend — transactional email delivery.
• Render — application and API hosting.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

4. International transfers

Liris is based in the United Kingdom, and several of our sub-processors are based in the United States. Where personal data is transferred outside the UK or EEA, we rely on Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable) or other lawful transfer mechanisms.

5. Retention

• Account data: kept for the life of the account and for 12 months after deletion to handle disputes and legal obligations.
• Call recordings and transcripts: kept for 12 months by default; you can delete individual calls from the dashboard at any time.
• Payment records: 7 years (statutory accounting requirement in England & Wales).
• Application logs: 30 days for routine logs; security-relevant events up to 12 months.

6. Your rights

Under the UK GDPR and other applicable laws you have the right to access, rectify, erase, restrict, and port your personal data, to object to processing, and to withdraw any consent you have given. You can exercise most of these rights directly in your account, or by contacting [email protected]. You may also lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk) or the data protection regulator in your country of residence.

7. Security

We protect personal data with industry-standard safeguards including TLS in transit, encryption at rest for sensitive credentials (including AES-256-GCM for stored OAuth refresh tokens), strict access controls, and routine logging and monitoring. No system is perfectly secure, however, and we encourage you to use a strong unique password and to keep your devices up to date.

8. Cookies

The marketing site at heyalys.com uses a small number of essential cookies for functionality. The authenticated dashboard uses cookies and similar storage to keep you signed in via Clerk. We do not use third-party advertising or cross-site tracking cookies.

9. Children

Alys is a business product not intended for use by anyone under 18. We do not knowingly collect personal data from children.

10. Changes to this Policy

We may update this Policy from time to time. Material changes will be notified by email or in-product notice. The “Last updated” date above always reflects the current version.

11. Contact

Privacy questions, rights requests, and complaints can be sent to [email protected] or by post to Liris Technologies Ltd, Tec Marina, Terra Nova Way, CF64 1SA, United Kingdom.