Privacy Policy
Last updated: 17.09.2026
Xiki Agency ("Xiki", "we", "us") runs xiki-agency.com and provides AI automation services, including database reactivation, speed to lead, out of hours and Google review bots. We work with businesses in the United Kingdom, European Union and United States. This policy explains what personal data we collect, why, and what rights you have.
Who we are
[coming soon], registered in [coming soon], company number [coming soon], address [coming soon]. Contact: [email protected].
1. Who this policy covers
This policy covers website visitors, people who book a call or contact us, our clients, and prospects we reach out to.
It also explains how we handle data when we run services for clients. In that case, our client decides what data is used and why (they are the "controller" or "business") and we process it on their behalf (we are the "processor" or "service provider"). If you got an SMS or message from one of our clients' businesses, contact that business first about your data.
2. What we collect
Data you give us: name, email, phone number, company name, job title, and anything you share on a call, in a form or by email. That includes rough business numbers like database size or average order value.
Booking data: when you book through our calendar (Cal.com), we get your name, email, chosen time, timezone and any answers you give.
Website data: IP address, browser and device type, pages visited, and how you got to the site, collected through cookies and similar tools.
Business contact data: for B2B outreach, we may use work contact details (name, job title, company, work email, LinkedIn profile) from public sources and data providers.
Client lead data: when we deliver a service, clients share their lead or customer data with us, usually names, phone numbers, emails and past enquiry details, plus the replies those leads send.
We don't knowingly collect sensitive data (health, financial account details, government IDs, etc.) and ask clients not to share it with us.
3. How we use it
We use your data to:
respond to enquiries and run booked calls
deliver, manage and bill for our services
send AI-powered SMS, email or messages on our clients' behalf
send B2B outreach about our services
improve our website and services
meet legal, tax and accounting obligations
protect against fraud and misuse
4. Legal basis (UK/EU)
If you're in the UK or EU, we rely on:
Contract: to deliver services you've signed up for
Legitimate interests: to run our business, reply to enquiries and do relevant B2B outreach. You can object at any time
Consent: for non-essential cookies, and anywhere else we ask for it. You can withdraw it at any time
Legal obligation: for tax, accounting and compliance records
5. SMS and text messaging
When we send SMS on a client's behalf, the client is responsible for getting the consent required by law, including under the US Telephone Consumer Protection Act (TCPA), before those leads are contacted.
Message frequency varies. Message and data rates may apply.
Reply STOP at any time to opt out, or HELP for help.
Opt-outs are honoured promptly and passed back to the client.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties, except service providers that help us deliver the messages (such as our messaging platform and carriers).
6. Email
Our marketing and outreach emails follow the US CAN-SPAM Act and UK/EU rules. Every email includes our contact details and a simple way to unsubscribe, and we honour unsubscribe requests within 10 business days.
7. AI tools
Our services use AI to write and send messages, read replies, and qualify and book leads. The data needed for that is processed by AI service providers under contract. We don't allow client lead data to be used to train public AI models where we can control it, and we don't make automated decisions that have legal or similarly significant effects on you.
8. Who we share data with
We never sell your personal data. We share it only with trusted service providers who help us run the business, such as:
scheduling (Cal.com)
CRM and messaging (GoHighLevel / LeadConnector)
email and outreach tools (Instantly, HeyReach)
AI service providers
hosting, email and cloud storage providers
payment providers and banks
accountants, lawyers and advisers
We may also share data if the law requires it, or as part of a business sale or restructure.
9. International transfers
We and our providers operate in several countries, including the UK, EU and US. Where data moves out of the UK or EU, we use appropriate safeguards such as Standard Contractual Clauses, the UK International Data Transfer Addendum, or adequacy decisions (including the EU-US Data Privacy Framework where a provider is certified).
10. How long we keep it
Enquiries and call bookings: up to 2 years after last contact
Client records and invoices: as long as tax law requires, usually 6 to 7 years
Client lead data: for the length of the contract, then deleted or returned within 30 days unless the client asks otherwise
Opt-out and do-not-contact lists: kept as long as needed so we don't contact you again
11. Your rights (UK/EU)
You can ask us to:
give you a copy of your data
correct inaccurate data
delete your data
restrict or object to how we use it
move your data to another provider
stop marketing messages
withdraw consent
You can also complain to your local data protection authority, e.g. the ICO (UK) or AEPD (Spain).
12. US privacy rights
This section applies to residents of US states with consumer privacy laws, including California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others.
What we've collected in the last 12 months:
Identifiers: name, email, phone number, IP address
Professional information: job title, company
Commercial information: services enquired about or bought
Internet activity: website browsing and interaction data
Inferences: whether a lead may be interested in a product or service, based on their replies
We collect these from you, your devices, our clients, public sources and data providers, for the purposes in section 3. We keep them for the periods in section 10.
Sale and sharing: we don't sell personal information, and we don't share it for cross-context behavioural advertising. We don't knowingly sell or share data of anyone under 16.
Sensitive information: we don't collect or use sensitive personal information to infer characteristics about you.
Your rights: depending on your state, you can:
know what personal information we collect, use and disclose
access a copy of it
correct it
delete it
opt out of sale, sharing, targeted advertising or profiling
appeal if we refuse your request
not be discriminated against for using these rights
How to make a request: email [EMAIL] with "Privacy Request" in the subject line. We'll verify your identity before acting and respond within 45 days (extendable by 45 more where the law allows). You can use an authorised agent, but we may ask for proof they're acting for you. If we deny your request, reply to our decision to appeal. If you're still unhappy, you can contact your state Attorney General.
Global Privacy Control: we honour GPC browser signals as an opt-out of sale or sharing where required by law.
Shine the Light (California): we don't share personal information with third parties for their own direct marketing.
13. Cookies
We use essential cookies to make the site work, plus optional analytics cookies to understand how the site is used. You can manage cookies through our cookie banner or your browser settings. Where required, we treat GPC signals as a cookie opt-out.
14. Security
We use reasonable technical and organisational measures to protect your data, including access controls and secure, reputable providers. No system is 100% secure, but we take it seriously. If a data breach affects you, we'll notify you and the relevant authorities as the law requires.
15. Children
Our services are for businesses. We don't knowingly collect data from anyone under 18. If you think a child has given us data, contact us and we'll delete it.
16. Changes
We may update this policy. The latest version will always be on this page with the updated date at the top. For significant changes, we'll give clearer notice.
17. Contact
Questions or requests: [email protected]
[LEGAL COMPANY ], [ADDRESS]