Privacy Policy (External)
Company: Expand Group AI Limited
Address: Unit 1 & 2 (Yo House), Melbourne Street, Southampton, United Kingdom, SO14 5FB
Contact Email: info@expandgroup.ai
Products Covered by This Privacy Policy:
Linx, Dentsy, Vetsy, Talenta, Alto Connect: AI-powered call transcription, sentiment analysis, and reporting tools. These Products analyse call recordings and generate insights but do not actively interact with call participants.
Hey Ocean: an AI Voice Agent that can actively interact with callers, answer questions, and provide automated responses. This Product processes real-time conversation data in addition to recording calls and is capable of interacting with customers and CRM data
Additional Communication Channels: Some Products may integrate with third-party communication platforms, including the WhatsApp Business Platform, to enable messaging, automation and customer communications. These integrations are optional and depend upon the services selected by our customers.
In this policy, the terms “Products” or “our Products” refer collectively to the products listed above.
This Privacy Policy applies to all users, customers, and participants interacting with any of our products listed above.
1. Introduction
Expand Group AI Limited (“we” “us” personal data collected through our Products. “our”) respects your privacy and is committed to protecting
This Privacy Policy explains:
What personal data we collect
How we use it
Who we share it with
Your rights regarding your data
How we comply with GDPR and other applicable data protection laws
Our Role
Expand Group AI Limited acts in different capacities depending on the service provided.
When customers use Linx, Dentsy, Vetsy, Talenta, Alto Connect, Hey Ocean or WhatsApp Business services, Expand Group AI Limited generally acts as a Data Processor, processing personal data on behalf of our customers, who are the Data Controllers.
Expand Group AI Limited acts as a Data Controller for personal data relating to:
customer accounts
billing
contracts
support enquiries
platform administration
security logs
user accounts
website enquiries
2. Personal Data We Collect and Process
Expand Group AI Limited processes personal data through its Products in order to provide AI-powered communication, transcription, analytics, automation and messaging services.
The personal data processed varies depending on the Product being used and the features enabled by the customer.
Analytics Products (Linx, Dentsy, Vetsy, Alto Connect and Talenta) Linx, Alto Connect, Dentsy, Vetsy and Talenta analyse business communications after or during a call to provide AI-powered transcription, sentiment analysis, summaries, reporting and business insights.
These Products may process:
Call recordings
Call transcripts
Call metadata (such as date, time, duration and caller information)
AI-generated summaries and insights
Sentiment analysis and quality scoring
User-generated notes and tags (where applicable)
Where CRM integration has been configured, these Products may securely transmit transcripts, summaries, sentiment scores or other analytics to the customer’s CRM via API.
Expand Group AI Limited does not access, browse or manage customer CRM records. The CRM integration is used solely to transfer data generated by our Products into the customer’s chosen system.
Hey Ocean – AI Voice Agent
Hey Ocean is an AI-powered Voice Agent that communicates directly with callers in real time.
Unlike our analytics Products, Hey Ocean actively participates in conversations by understanding spoken requests, generating responses and carrying out actions configured by the customer.
Depending on the customer’s configuration, Hey Ocean may process:
Live voice conversations
Call recordings
Real-time speech-to-text transcription
AI-generated responses
Call summaries
Conversation history
Call metadata
AI interaction logs
Sentiment analysis (where enabled)
Where CRM integration has been enabled, Hey Ocean may retrieve limited information from customer CRM systems via secure API connections to provide more accurate and personalised responses.Examples include:
Customer names
Appointment details
Existing tickets or cases
Contact history
Other information that the customer has chosen to make available to the AI Voice Agent
This access is:
Fully automated
Controlled entirely by the customer’s configuration
Limited to the information required to fulfil the requested interaction
Not routinely accessible by Expand Group AI Limited personnel
Expand Group AI Limited employees do not routinely access customer CRM records. Any temporary access required for technical support or fault resolution is subject to appropriate authorisation, security controls and audit logging.
WhatsApp Business Communications
Customers may also choose to use our Products with the WhatsApp Business Platform to manage customer communications, automation and AI-powered messaging.
Where enabled, we may process:
WhatsApp phone numbers
WhatsApp profile names and identifiers
Messages and message content
Images, documents, voice notes and other media
Message templates
Message delivery and read status
Consent and opt-in records
Authentication tokens and API credentials
Connected CRM or business system identifiers
AI-generated responses and conversation summaries (where AI functionality is enabled)
System logs and audit records relating to WhatsApp communications
Where integrated with customer CRM or business systems, Expand Group AI Limited processes only the information necessary to provide the requested messaging service.
WhatsApp conversation data is processed solely to provide the services requested by the customer and is not used to train or improve general-purpose or shared AI models.
WhatsApp Business communications are provided using the WhatsApp Business Platform operated by Meta. Messages sent or received through the WhatsApp Business Platform are also subject to Meta’s own Privacy Policy and Terms of Service. Customers and end users should review Meta’s privacy information to understand how Meta processes personal data as part of the delivery of the WhatsApp Business Platform.
Customer Account and Service Data
In addition to data processed through our Products, Expand Group AI Limited also processes personal data required to administer customer accounts and provide our services.This may include:
Customer names
Business names
Email addresses
Telephone numbers
Billing information
User account details
Authentication and security information
Support enquiries
System usage logs
This information is processed by Expand Group AI Limited as the Data Controller for the purposes of managing customer relationships, providing support, maintaining platform security and complying with legal and contractual obligations.
Business/Account Information such as customer names, billing addresses, invoices, support emails, user accounts, passwords, MFA, IP addresses, browser information.
Website Usage and Business Identification Data
When you visit our website, we may collect technical and usage information about your visit.
Depending on your privacy choices and the technologies enabled, this may include:
IP address; browser and device information;pages viewed and interactions with our website; referral and source information; date and time of visits; cookie or similar technology identifiers; and related network information.
Where you consent to website tracking, we may use your IP address and related network information to identify the organisation associated with your visit. We use this information to understand business interest in our Products and services, analyse use of our website and support relevant B2B sales and marketing activities.
Where an organisation can be identified, we may supplement its record with publicly available company information, such as its company name, registered office address, website and general business contact details.
Our purpose is to identify organisations that may have an interest in our Products and services, rather than to identify individual visitors or their home addresses.
We do not attempt to identify individuals behind residential IP addresses. Some publicly available business addresses may also be residential addresses, particularly where a sole trader operates from home or a company is registered at a director’s home address. We do not use such addresses for the purpose of identifying or targeting individuals at their homes.
You can withdraw your consent to non-essential website tracking at any time through our website privacy or cookie settings. Withdrawing consent will not affect the lawfulness of processing carried out before consent was withdrawn.
3. How We Use Your Data
We use personal data for the following purposes:
Providing Our Products
Linx/Alto Connect/Dentsy/Vetsy/Talenta: Transcription, analytics, reporting
Hey Ocean: Operating AI Voice Agent, automated call responses
Customer Support and Communication
Responding to inquiries, troubleshooting, billing support
Security and Compliance
Preventing fraud or abuse
Ensuring regulatory compliance
We do not use customer call data to train AI models without explicit consent.
Product Improvement and Service Development
We may analyse aggregated and anonymised operational information to improve the performance, reliability and security of our Products.
Expand Group AI Limited does not use identifiable customer conversations, call recordings, transcripts or WhatsApp conversations to train or improve general-purpose or shared AI models without the customer’s explicit consent.
WhatsApp Business Services
Where customers use WhatsApp Business with our Products, personal data may be processed for:
Sending and receiving WhatsApp messages
Customer communications
Inbox management
AI-powered conversation handling (where enabled)
Automation workflows
Appointment reminders and notifications
Customer support
CRM synchronisation
Delivery reporting
Security monitoring
Fraud prevention
System diagnostics
AI Processing
Where AI functionality is enabled, WhatsApp conversations are processed solely to provide the AI features requested by the customer.
WhatsApp Business data is never used by Expand Group AI Limited to train, improve or develop general-purpose or shared AI models.
Where customers use WhatsApp Business, personal data is processed only to provide the messaging, automation, AI and integration features requested by the customer and is not processed for any unrelated purpose.
Website Analytics and Business Identification
Where permitted by your privacy choices, we may use website usage and technical information to:
understand how visitors interact with our website;
measure website performance and engagement;
identify organisations showing an interest in our Products and services;
understand which Products or services may be relevant to those organisations;
supplement identified organisation records with publicly available business information; and
support relevant B2B sales and marketing activities.
We do not use this functionality for the purpose of identifying individuals behind residential IP addresses or targeting individuals at their home addresses.
4. Legal Basis for Processing
We process personal data under the following lawful bases (GDPR):
Contractual necessity: To provide the Products as per our agreements
Legitimate interests: Maintaining system security, improving services, generating analytics
Consent (where applicable): For AI features requiring explicit permission
Customers using our Products are responsible for obtaining all necessary consents from call participants before using our Products to record calls or capture audio. This is especially important for Hey Ocean, our AI Voice Agent, which actively interacts with callers in real time.
Where customers use the WhatsApp Business Platform, customers remain responsible for ensuring they have obtained any required permissions, consents or other lawful basis before communicating with individuals using WhatsApp.
Call participants must be informed that the call is being recorded or processed by an AI system and must have the opportunity to provide or withhold consent as required by applicable laws, including GDPR and local call recording regulations.Expand Group AI Limited does not provide legal advice and is not responsible for obtaining such consent. Customers remain fully responsible for ensuring that their use of our Products complies with applicable laws.
Website Tracking and Business Identification
Where consent is required for cookies or similar website tracking technologies, we rely on your consent before using those technologies.
Where personal data obtained through permitted website tracking is subsequently processed to understand business interest in our Products and services, identify organisations associated with website visits, maintain relevant business records or support proportionate B2B sales and marketing activities, we may rely on our legitimate interests where appropriate. Those interests include understanding demand for our Products, developing our business and communicating with organisations that may have a relevant business interest in our services.
Where we rely on legitimate interests, we consider the nature of the information, the reasonable expectations of individuals and the potential impact on their privacy.
You can withdraw consent to non-essential website tracking at any time through our website privacy or cookie settings.
5. Data Sharing and Third Parties
We may share personal data only where necessary to provide our Products.
This includes but is not limited to:
Meta Platforms Ireland Limited: Where customers use the WhatsApp Business Platform, personal data is processed through Meta in order to send and receive WhatsApp messages.
Meta acts as the provider of the WhatsApp Business Platform and processes personal data in accordance with its own Privacy Policy and Terms of Service. Expand Group AI Limited encourages customers and end users to review Meta’s privacy documentation to understand how Meta processes personal data when using WhatsApp Business.
Cloud Hosting Providers: Including AWS and other infrastructure providers used to securely host our services.
AI Service Providers : Where AI functionality has been enabled by the customer, approved AI providers (such as OpenAI API) process conversation data solely to provide requested AI features.
Customer CRM or Business Systems: Where configured by the customer, data may be transmitted securely via API to CRM, PMS or other connected systems.
Email Providers: Where notifications or communications are sent by email.
Monitoring and Security Providers: To monitor system health, prevent fraud and maintain security.
Professional Advisers: Lawyers, auditors and IT security consultants.
Regulatory Authorities: Where required by law.
A full list of current sub-processors is available on our websiteAll sub-processors are contractually required to comply with applicable data protection legislation.
6. Data Retention
Expand Group AI Limited retains personal data processed through our Products only for as long as necessary to provide services, comply with legal obligations, or meet operational needs.
Detailed retention periods, including call recordings, transcripts, AI outputs, and CRM API access logs (for Hey Ocean), are defined in our Data Retention Policy.
Temporary AI data, such as Hey Ocean AI outputs and CRM access logs, are included in the retention schedules and are securely deleted or anonymized after the applicable period.
Where WhatsApp Business is used, retention periods for:
WhatsApp messages
media
message templates
authentication tokens
consent records
audit logs
backups
are defined within our Data Retention Policy.
Where customers request deletion of WhatsApp Business data, this will be handled in accordance with our Data Retention Policy and applicable legal obligations.
Backup and archival copies are managed in line with the retention schedules.
7. Data Subject Rights
Under GDPR, individuals whose data we process may have the following rights:
Access: Request a copy of personal data we hold about you
Correction: Request correction of any inaccuracies
Deletion: Request erasure of personal data
Restriction: Request limitation of processing
Objection: Object to processing based on legitimate interests
Data portability: Receive personal data in a structured, machine-readable format
For any personal data contained within a customer CRM, where Expand Group AI Limited acts solely as a Data Processor, requests relating to customer CRM data should normally be directed to the relevant customer, who acts as the Data Controller.
WhatsApp Communications
Customers are responsible for obtaining any permissions or opt-ins required before sending WhatsApp communications using our Products.
Recipients may withdraw consent or opt out of future communications at any time using the methods provided by the customer.
Where Expand Group AI Limited acts as a processor, requests relating to WhatsApp communications will be handled in accordance with customer instructions and applicable law.Individuals also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if they believe their personal data has been processed unlawfully.
Important: Expand Group AI Limited acts as a data processor and only processes personal data on behalf of our customers. Where Expand Group AI Limited processes personal data solely on behalf of a customer as a data processor, individuals should normally exercise their rights through the relevant customer (the data controller). Expand Group AI Limited will assist the customer in fulfilling those requests where required by applicable law or our contractual obligations.If an end-user requests their data from a customer, it is the customer’s responsibility to respond.
How to make a request
To exercise your rights, please contact us at: info@expandgroup.ai
We will respond within 30 days of receiving your request, in line with GDPR and ICO guidance.
We may require you to verify your identity or provide additional information to process your request securely.
In complex cases, we may extend the response period by up to 2 additional months and will notify you if this is necessary.
8. Security
We implement technical and organisational measures to protect personal data:
Encryption at rest and in transit
Role-based access control
Monitoring and testing systems for vulnerabilities
Multi-factor authentication
Regular penetration testing and vulnerability assessment
Where WhatsApp Business is used, authentication tokens, API credentials and connected system integrations are protected using appropriate technical and organisational security measures, including encryption, access controls and monitoring.
9. International Data Transfers
Expand Group AI Limited stores all personal data collected through our Products on servers located in the United Kingdom.
From time to time, certain staff members who work outside the UK may need access to limited data to provide technical support or perform maintenance. For example:
Our development team, based in Dubai, may access business contact information (such as company name and contact number) as part of support operations.
In rare cases, they may need temporary access to additional data (e.g., call transcripts or AI outputs) strictly for troubleshooting or resolving technical issues.
To ensure GDPR compliance and protect personal data:
All remote access is conducted over secure VPN connections to the UK office.
Staff accessing data are bound by contractual confidentiality obligations and GDPR compliance requirements.
Data is never transferred outside the UK for processing purposes beyond what is necessary for support or maintenance.
Safeguards:
We rely on UK-based storage and data processing.
Any international access is limited, logged, and monitored.
This ensures that even if data is temporarily accessed internationally, it is secure, controlled, and compliant with GDPR principles.
Where WhatsApp Business Platform services are used, certain data may also be processed by Meta Platforms in accordance with Meta’s own privacy documentation and international transfer mechanisms.
Where appropriate, international access is supported by contractual safeguards, confidentiality obligations and technical controls designed to protect personal data.
This policy applies to all Products, including Hey Ocean. While the AI servers and call processing remain in the UK, support staff may need temporary access under the safeguards described above.
10. Children’s Privacy
Our Products are not intended for use by children under 16, and we do not knowingly collect data from children.
11. Changes to This Privacy Policy
Expand Group AI Limited may update this Privacy Policy from time to time to reflect changes in our Products, data processing practices, legal requirements, or other factors.
We reserve the right to make updates to this Privacy Policy at any time.
Each version of the Privacy Policy will be published on our website with the “Last Updated” date and a version number (e.g., Version 1.0, Version 1.1).
Significant changes may be communicated to customers via email or product notifications.
This Privacy Policy is reviewed at least once every 12 months to ensure it remains accurate and compliant.
Customers are encouraged to review this Privacy Policy periodically to stay informed about how Expand Group AI Limited collects, uses, and protects personal data.
12. Contact Us
Expand Group AI Limited
Email: info@expandgroup.ai
Address: Unit 1 & 2 (Yo House), Melbourne Street, Southampton, United Kingdom, SO14 5FBAutomated Decision Making and AI
Our Products use artificial intelligence to:
generate transcripts
analyse conversations
produce sentiment analysis
generate summaries
assist with automated customer interactions
These AI features are designed to assist our customers and are not intended to make decisions that produce solely automated legal or similarly significant effects on individuals as defined under Article 22 UK GDPR.
Where customers use AI-generated information to support business decisions, they remain responsible for ensuring appropriate human oversight.