Privacy Notice

Deeplathe is a brand and division of SIA Enliven, a company registered in Latvia. Deeplathe is not a separate legal entity. SIA Enliven is the organisation responsible for the personal data described in this notice.

Registered address: Auguliena, Belavas Parish, Gulbene, LV-4410, Latvia. Registration number: 40203447620. VAT number: LV40203447620. We have not appointed a Data Protection Officer, because we are not required to. Data questions go to the contact in section 14.

This matters, because it changes who is responsible for what.

As a controller. When you visit this website, send us an enquiry, chat to our assistant, or become a client, we decide why and how your data is used. That is our responsibility and it is what most of this notice covers.

As a processor. When we run a website or an AI phone receptionist for a client, we handle personal data belonging to their customers: callers, enquiries, contact details, call recordings. In that situation our client decides why and how it is used, and we act on their instructions. If you are a customer of one of our clients and want your data removed, contact that business first. You can also contact us and we will pass it on and support them.

If you just browse the site. Our hosting provider records standard server and security logs, including IP address, browser type and the pages requested. We do not run Google Analytics or any third party advertising or tracking product. There is no advertising pixel on this site.

If you send us an enquiry. We collect your name, email address, phone number, business name, website address and whatever you tell us in the message. We use it to reply, to prepare a proposal, and to build a preview if you ask for one.

If you chat with our assistant. The website has an AI assistant. What you type is sent to our AI provider to generate a reply, and we keep the conversation so we can follow up and improve the answers. Please do not put sensitive personal information into that chat. It is a sales assistant, not a secure channel.

If you become a client. We hold your contact and business details, the content of your project, billing records and correspondence. Card details are handled by Stripe and never reach our servers.

If you apply to our affiliate programme. We collect the details needed to approve you and to pay you, including payout details handled by Stripe.

Under the UK and EU GDPR we must have a lawful basis for using your data. Ours are:

• Contract. To deliver what you have asked us to deliver, and to bill for it.
• Legitimate interests. To reply to enquiries, keep the service secure, prevent fraud and abuse, and keep records of what was agreed. We have considered whether this overrides your rights and we think it does not, because the data is limited and you would reasonably expect it.
• Legal obligation. Tax and accounting records.
• Consent. Where we ask for it explicitly. You can withdraw consent at any time and it will not affect anything done before you withdrew it.

We use a small number of strictly necessary cookies, and nothing else. They keep you signed in to an account area or a private preview. We do not use analytics cookies, advertising cookies or cross site trackers, which is why you are not being asked to accept a cookie banner.

We do not sell personal data. We never have and we do not intend to. We share it only with the suppliers who make the service work:

• Vercel, website hosting and storage
• Amazon Web Services, database storage
• Stripe, payments and payouts
• Resend, sending transactional email
• Anthropic, powering the website assistant
• ElevenLabs, running the AI phone receptionist, where a client buys one

We may also share data where the law requires it, or to establish or defend a legal claim. If the business is ever sold or restructured, data may transfer with it, and you would be told.

A current list of sub-processors, with locations, is available on request and forms part of the data processing agreement we sign with clients.

We are based in Latvia, inside the European Economic Area. Some of the suppliers above are based in the United States, which means your data may be transferred outside the EEA and the UK.

Where that happens we rely on the European Commission's Standard Contractual Clauses, the UK Addendum where the UK GDPR applies, or an adequacy decision where one exists. You can ask us for details of the safeguards that apply to a specific transfer.

We keep data for as long as we need it, and no longer:

• Enquiries that do not become clients: up to 24 months, then deleted.
• Client records and project files: for the life of the relationship and 6 years afterwards, which is how long we may need them for tax and legal reasons.
• Billing and accounting records: as required by Latvian law.
• Website assistant conversations: up to 12 months.
• Call recordings and transcripts, where we run a receptionist: as agreed with the client in their data processing agreement, and deleted when that agreement ends.
• Server and security logs: a short rolling window kept by our hosting provider.

Where a client buys the AI phone receptionist, calls to that client's business are answered by an automated system and are recorded. Callers are told at the start of the call that they are speaking to an AI assistant and that the call is recorded.

In that arrangement the client is the controller of those recordings and we are their processor. The client is responsible for having a lawful basis, for their own privacy notice, and for meeting any professional or sector rules that apply to them. We are responsible for handling the recordings securely and only as instructed.

If you called a business and want the recording of your call deleted, contact that business. If you cannot reach them, contact us and we will help.

If the UK or EU GDPR applies to you, you have the right to:

• ask what we hold about you and get a copy
• have inaccurate data corrected
• have data deleted, where we have no continuing reason to keep it
• restrict or object to how we use it, including any use based on legitimate interests
• receive data you gave us in a portable, machine readable format
• withdraw consent at any time, where consent is what we relied on

Email us at the address in section 14 and we will respond within one month. There is no charge. We may ask you to confirm who you are before we release anything, which protects you as much as us.

If you are in California or another US state with similar rules, you have comparable rights to know, delete and opt out of sale. We do not sell personal data, so there is nothing to opt out of, and we will honour access and deletion requests on the same terms as above.

If you think we have handled your data badly, tell us first and we will try to put it right. You also have the right to complain to a regulator.

• Latvia and the EU: Datu valsts inspekcija, the Latvian State Data Inspectorate, at dvi.gov.lv.
• United Kingdom: the Information Commissioner's Office at ico.org.uk.
• Australia: the Office of the Australian Information Commissioner at oaic.gov.au.

Our services are sold to businesses and are not directed at children. We do not knowingly collect data about anyone under 16. If you believe we have, tell us and we will delete it.

If we change this notice we will update the effective date at the top. If a change materially affects how we use data we already hold about you, we will tell you directly rather than relying on you noticing.

Email privacy@deeplathe.com for anything in this notice, including access and deletion requests.

Postal address: SIA Enliven, Auguliena, Belavas Parish, Gulbene, LV-4410, Latvia. Telephone: +371 25749643.