We act as your processor
You decide why and how your customers are contacted. We process their data only on your instructions, to confirm the job you sent.
Careful with your customers, by design.
AnyoneIn talks to your customers on your behalf, so it has to be trustworthy on the doorstep and in the data centre. Here's exactly how it handles their data, how the agent behaves, and what's still on the roadmap.
Last reviewed: · Pending legal review
Only what it takes to confirm a visit.
Your order system sends a job. AnyoneIn contacts the customer through two subprocessors, reads the reply, and sends the outcome back. That's the whole journey.
Controller
Your order system
OMS, WMS or carrier platform
Processor
AnyoneInGoogle Cloud · London (europe-west2)
- API and signed webhooks
- Agent (Gemini)
- Encrypted job store
Subprocessor
Telecoms provider
Texts, WhatsApp and calls
Subprocessor
Google Workspace
Email
Data subject
Your customer
Email, text or phone
What we ask your system for
- Customer name
- Mobile number
- Email address
- Order reference
- Items and quantities
- Date and time window
- Address: line 1, town, postcode
- Slots you can offer instead
- Delivery notes
What we never need
- Card or bank details
- Passwords
- Date of birth
- Health or other special category data
- Browsing or marketing profiles
The agent never asks customers for payment or personal details, on any channel.
A DPA, ready to sign
Our data processing agreement covers the subprocessors, regions, retention and security measures on this page. Request it
Minimal by default
Only the fields needed to confirm a visit. On a call, the agent reads out the first line of the address at most, and only if the customer asks.
Retention you set
Choose how long jobs, messages and call transcripts are kept. Planned default: transcripts deleted after 90 days Assumption
UK hosting
The service runs on Google Cloud in London (europe-west2). EU hosting in Belgium (europe-west1) is available on request.
Encrypted in transit and at rest
TLS on every connection, including the webhooks we send you. Data at rest is encrypted by Google Cloud's storage encryption.
Every subprocessor, named here.
These are the only subprocessors that handle your customers' data. We'll tell you before we add or change one.
| Subprocessor | What for | Data it handles | Region |
|---|---|---|---|
| Google CloudCloud Run, storage, Secret Manager | Hosting the service, the job store and the customer page | Everything in a job, and its conversation | London, UKeurope-west2 |
| Google CloudGemini, speech | Reading replies, running the call conversation, the voice and speech recognition | Message text, call audio as it streams, the job details it needs | Google CloudProcessing region set out in the DPA |
| Telecoms providerMessaging and voice · named in the DPA | Sending texts and WhatsApp messages, placing and receiving calls | Mobile number, message content, call audio in transit | Provider networkTransfers covered by the provider’s DPA |
| Google WorkspaceGmail | Sending confirmation emails and receiving replies | Email address, message content | Google WorkspaceData regions set out in the DPA |
We don't use your customers' data to train AI models. Processing regions and international transfer terms are confirmed in the DPA before a pilot starts.
Five rules the agent never breaks.
They’re written into the agent’s instructions and apply to every message and every turn of every call.
-
01
It says it's automated
The first thing the customer hears is who's calling and that it's an automated assistant. Ask it whether it's a robot and it says yes, then carries on.
-
02
It checks who it's talking to first
No order details until it knows it's speaking to the customer or someone in their household. It never reads out the full address, phone number or email: only the first line, and only if they ask where.
-
03
It ignores instructions hidden in replies
A reply is only ever treated as a reply. If it contains instructions to change the rules, reveal its instructions or act for someone else, the agent ignores them and carries on confirming.
-
04
A person is always one sentence away
Ask for a person, sound unhappy, or raise something it can't handle (damage, refunds, a complaint, a price) and it hands over to your team. It never invents facts, prices or promises, and automated replies are capped so it can't get stuck in a loop.
-
05
Transcripts, with a notice
Calls are transcribed so your team can see exactly what was said, in the console, next to every outcome. The customer is told through your privacy notice. The call audio itself isn't stored.
Before launch A spoken line about the transcript, added to the call opening.
Service messages, sent at sensible hours.
Checking someone will be in for an order they've placed is a service message. Selling to them is marketing. AnyoneIn keeps the two apart.
Service
About an order they've placed
- Confirming the day and time window
- Rebooking into a slot you offer
- Capturing who'll sign for it
- Checking a collection is ready
Sent by email, text and phone call as part of fulfilling the order.
Marketing · upsells coming soon
Anything that sells
- Only with consent, or where the soft opt-in applies
- Never offered on an automated call without prior consent
- Opt-outs always respected
These are the PECR rules. Read the ICO's guidance on direct marketing (opens in a new tab).
Sensible hours only
Texts and calls go out between 9am and 8pm, UK time. Emails between 7am and 9pm. An unanswered call gets one retry, a few hours later, and that's it.
Texts and calls Email
STOP means stop, everywhere
Reply STOP to a text, say "stop calling me" on the phone, or ask by email: the plan ends on every channel and the agent confirms it won't message again.
No silent or abandoned calls
Every call is placed for one specific job and the agent speaks the moment it connects. If a machine answers, it leaves a short voicemail. Customers can ring the number back and reach the same agent. We follow Ofcom's persistent misuse policy (opens in a new tab).
Every request proves where it came from.
Signed in both directions, rate limited, with secrets out of the code and a service account that can only do its job.
Signed webhooks
Every event we send carries an HMAC-SHA256 signature of the body. Verify it with your secret before you trust it.
X-AnyoneIn-Signature: sha256=9f2c…e41a
Signed customer links
Links in emails and texts are signed, so they can't be guessed or altered. Opening one never changes anything, because mail scanners open links on their own.
Telecoms webhooks verified
Every inbound text and call webhook carries the provider’s signature, and it’s verified. Anything that fails is rejected and logged.
Rate limiting
Sliding-window limits per IP address on creating confirmations, verification and the lead forms, so nobody can use the service to flood phones.
Secrets in Secret Manager
API keys, signing keys and provider tokens live in Google Secret Manager, never in code, images or config files.
Least-privilege service account
The service runs as its own service account, with access only to the storage and secrets it uses.
Response headers
strict-transport-security: max-age=31536000;
includeSubDomains
content-security-policy: default-src 'self';
script-src 'self'; frame-ancestors 'none';
object-src 'none'; base-uri 'self'
x-frame-options: DENY
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
permissions-policy: camera=(), microphone=(),
geolocation=()A strict content security policy and security headers on every response. No third-party scripts on this site or the customer page.
What’s still on the roadmap.
We don't hold any security certifications today. When that changes, it'll change here first, with the certificate to back it.
- Roadmap
Single sign-on
SAML and Google sign-in for the ops console.
- Roadmap
Audit log
Who looked at, changed or exported what, and when.
- Roadmap
SOC 2
An independent audit of our security controls. Not certified.
- Roadmap
ISO 27001
A certified information security management system. Not certified.
In the meantime, we'll answer your security questionnaire and walk your IT team through the architecture.
Request our DPA.
The data processing agreement, the subprocessor list and answers to your security questionnaire, before you commit to anything.
Last reviewed: · Pending legal review. This page describes the service today and isn't legal advice.