Effective date: 16 October 2026
1. Introduction
IMPCT Ltd ("we", "us", "our") provides a cloud-based business phone system that lets organisations send and receive SMS and WhatsApp messages, email, and voice calls using UK phone numbers (the "Service"). This Privacy Policy explains how we collect, use, store, share, and protect personal data when you visit our website at https://useline.io or use the Service.
We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU General Data Protection Regulation (EU GDPR), and the Privacy and Electronic Communications Regulations (PECR).
2. Data Controller
IMPCT Ltd is the data controller for personal data we collect about you as a user of our website and Service. For personal data processed on behalf of our business customers (e.g. their contacts' phone numbers and messages), we act as a data processor on the customer's behalf.
Line is a trading name of IMPCT Ltd. Company number 15922036. Registered address: Dores Lane, Romsey, SO51 0QJ. ICO registration: 00015961662.
Contact us at privacy@useline.io for any data protection enquiries.
3. Personal Data We Collect
3.1 Account and Organisation Data
When you sign up and use the Service, we collect:
- Full name and email address (via your authentication provider)
- Organisation name and business website
- Team membership details (role, invitation status)
- Billing and subscription information (processed by Stripe; we do not store full payment card details)
3.2 Communications Data
When you or your contacts use the Service, we process the following on your behalf:
- Message content — the body text of messages sent and received
- Message metadata — sender and recipient phone numbers, timestamps, delivery status, and message direction
- Voice call metadata — caller and recipient numbers, call duration, timestamps, and call status
- Voicemail recordings and transcriptions — audio files and generated text of voicemail messages
- Demo call recordings and transcriptions — audio and generated text when you use the Try Molly demo. Molly tells you when the recording starts
- Contact information — phone numbers, display names, company names, and notes stored by your organisation
3.3 Technical and Usage Data
- IP address, browser type, device information, and operating system
- Pages visited, features used, and interaction patterns
- Cookies and similar tracking technologies (see Section 10)
3.4 Sensitive Data
Calls and messages can contain health or other sensitive information that a caller chooses to share. Our customer decides how to use that information and instructs us as its processor. We do not sell personal data to third parties.
4. Lawful Basis for Processing
We process personal data under the following lawful bases as defined by Article 6 of the UK GDPR and EU GDPR:
| Purpose | Lawful Basis |
|---|---|
| Providing and operating the Service | Performance of a contract (Art. 6(1)(b)) |
| Processing communications on behalf of customers | The customer decides its lawful basis. We process this data on its instructions. |
| Billing and payment processing | Performance of a contract (Art. 6(1)(b)) |
| Preventing fraud, abuse, and enforcing acceptable use | Legitimate interests (Art. 6(1)(f)) |
| Optional browser analytics and replay | Consent (Art. 6(1)(a)) |
| Service-related communications (e.g. outage notices) | Legitimate interests (Art. 6(1)(f)) |
| Marketing communications | Consent (Art. 6(1)(a)) |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |
5. How We Use Your Data
We use personal data to:
- Provide, maintain, and improve the Service
- Route messages and voice calls between your organisation and your contacts
- Display conversation history and contact records within the Service
- Process payments and manage subscriptions via Stripe
- Send transactional emails (account verification, billing receipts, service alerts)
- Detect and prevent fraud, spam, and abuse
- Enforce our Terms of Service, Acceptable Use Policy, and SMS Policy
- Comply with applicable laws and regulations
6. Data Sharing and Third-Party Processors
We share personal data only where necessary to operate the Service or comply with the law. We do not sell your data.
| Sub-processor | Purpose | Data Shared | Location |
|---|---|---|---|
| Supabase | Database, file storage and authentication | Accounts, contacts and communications | Ireland (eu-west-1) |
| Vercel | Web application hosting | Requests, IP addresses and application data | Ireland (dub1); global network |
| Twilio | Calls, SMS and voicemail | Phone numbers, messages, call data and recordings | Ireland (IE1) for voice; US (US1) for messaging |
| Meta | WhatsApp messaging | WhatsApp identifiers and message content | US and global |
| Stripe | Payments and billing | Account and billing details | US and global |
| PostHog | Consent-based product analytics | Usage events and masked recordings | EU project |
| Sentry | Error monitoring and consent-based browser replay | Error context, user ID and masked replay | EU region |
| Anthropic | AI message and transcript processing | Messages, transcripts and agent instructions | US |
| OpenAI | AI voice and text processing | Live call audio, transcripts and instructions | US |
| ElevenLabs | AI speech generation | Call text and audio | US or EU, depending on service configuration |
| TypeSafe (Jev) | Message classification | Message text | Provider location to be confirmed |
| Resend | Transactional and inbound email | Email addresses and message bodies | US |
| Cloudflare | Email routing, voice transport and abuse protection | IP addresses, email routing data and call audio | Global; voice gateway in Western Europe |
| Connected calendars and search indexing | Calendar events and site indexing data | US and global | |
| Microsoft | Connected calendars | Calendar events | US or EU, depending on tenant configuration |
| Expo | Mobile push notification delivery | Push tokens and notification text | US |
| Companies House | Public company lookups | Company search terms | UK |
| Discord | Internal signup alerts | Signup names and email addresses | US |
| GitHub | Internal error triage | Error summaries | US |
We use these providers to deliver the stated services. Their own retention periods and overseas transfers can differ from ours. See our sub-processor list for current details.
We may also disclose personal data to law enforcement or regulatory authorities when required by law or to protect the rights, safety, or property of IMPCT Ltd, our users, or the public.
7. International Data Transfers
Some of our sub-processors operate outside the UK and European Economic Area. When personal data is transferred internationally, we ensure appropriate safeguards are in place, including:
For a restricted transfer, we use an applicable UK adequacy regulation, including the UK–US Data Bridge for a certified US recipient, or an appropriate safeguard such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. We assess transfers where required.
AI processing
We send messages, transcripts and agent instructions to Anthropic for AI responses. OpenAI processes live call audio and text. ElevenLabs processes text and audio to generate speech. Anthropic and OpenAI state that their commercial API data is not used to train models by default. ElevenLabs may use data to improve models unless the account is on an Enterprise plan or has opted out.
8. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:
| Data Type | Retention Period |
|---|---|
| Account and contacts | While the workspace is open; purge 30 days after closure |
| Messages, calls, transcripts and related files | Life of the open workspace by default, or the Owner's choice of 1, 2 or 6 years; purge 30 days after closure |
| Web Chat continuity bindings | 30 days, or until the conversation closes |
| Web Chat notification delivery records | 30 days after delivery stops |
| Try Molly demo sessions | 30 days |
| Try Molly demo recordings | 90 days |
| Demo rate-limit events | 7 days |
| Webhook payloads | 30 days, after delivery completes |
| Staff access records | 2 years |
| Privacy request records | Unverified requests: 1 day; resolved requests: 2 years |
| Privacy export files | Signed link: 7 days; job record: 30 days |
| Billing invoices | 7 years for UK tax records |
| Sentry error data | Sentry project retention setting (currently 90 days) |
When a customer deletes their account, we delete or anonymise all associated personal data within the retention periods above, unless a longer retention period is required by law.
9. Your Rights
Under UK GDPR and EU GDPR, you have the following rights regarding your personal data:
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — request correction of inaccurate or incomplete data
- Right to erasure — request deletion of your personal data ("right to be forgotten")
- Right to restrict processing — request that we limit how we use your data
- Right to data portability — receive your data in a structured, machine-readable format
- Right to object — object to processing based on legitimate interests or for direct marketing
- Right to withdraw consent — where processing is based on consent, you may withdraw it at any time
- Right to lodge a complaint — you may complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or your local EU supervisory authority
To exercise any of these rights, contact us at privacy@useline.io. We will respond within one month, as required by law.
10. Cookies and Tracking Technologies
We use the following categories of cookies:
- Strictly necessary cookies — required for authentication, security, and core Service functionality. These cannot be disabled.
- Analytics cookies — help us understand how visitors use our website so we can improve it. These are only set with your consent.
We do not use advertising cookies. PostHog collects browser analytics only after you consent. Session recordings mask page text and form values. Sentry Replay buffers masked activity around errors only after consent. You can change your choice with the Cookie preferences link in the website footer. See the Cookie Policy.
11. Data Security
We implement appropriate technical and organisational measures to protect personal data, including:
- Encryption of data in transit (TLS) and at rest
- Access controls and role-based permissions
- Regular security reviews and vulnerability assessments
- Secure authentication via third-party identity providers
- Row-level security policies on database tables to isolate organisation data
While we take all reasonable precautions, no method of transmission or storage is 100% secure. If you become aware of a security vulnerability, please contact us immediately at privacy@useline.io.
12. Data Processing on Behalf of Customers
When our business customers use the Service to communicate with their contacts (end users), IMPCT Ltd acts as a data processor. The customer is the data controller and is responsible for:
- Ensuring they have a lawful basis to send messages and make calls to their contacts
- Providing their own privacy notice to their contacts
- Responding to data subject requests from their contacts (we will assist as required)
- Complying with opt-out and consent requirements
We process such data only on the customer's documented instructions and in accordance with our Data Processing Agreement.
13. Children's Privacy
The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.
14. Third-Party Platform Requirements
Where the Service integrates with third-party platforms (such as Meta Business Messaging), we adhere to the data use and privacy requirements of those platforms. This includes:
- Using platform data only to provide and improve the Service, not for independent advertising or data monetisation
- Deleting platform data upon request from the platform or the end user
- Implementing the technical and organisational security measures required by the platform
- Not transferring platform data to third parties except as necessary to provide the Service and as permitted by the platform's terms
15. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service at least 30 days before they take effect. The "Effective date" at the top of this page indicates when the policy was last revised.
16. Contact Us
If you have any questions about this Privacy Policy, your personal data, or wish to exercise your data protection rights, please contact us:
- Email: privacy@useline.io
- Website: https://useline.io
You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or with your local data protection authority if you are in the EU.