Last updated: July 2026. This document is a template drafted for the Warmenna marketing site and must be reviewed by a qualified solicitor before launch.
1. Who we are
Warmenna is a service provided by Huup Ltd ("Warmenna", "we", "us"), a company registered in England and Wales, and registered with the UK Information Commissioner's Office under registration number ZC165061. This Privacy Policy explains how we collect, use and protect personal data when you use the Warmenna website and service (together, the "Services"). Questions can be sent to [email protected].
Warmenna is an AI receptionist that, on behalf of small businesses, receives and answers customer messages and takes bookings and orders across WhatsApp, Instagram, Telegram, email and a website chat and booking widget.
2. Our role: controller and processor
Our role under the UK GDPR depends on whose data is involved:
- We are the data controller for the account and billing data of the businesses that subscribe to Warmenna, and for data about our website visitors and prospects.
- We are a data processor for the messages, contact details and booking or order information of your end-customers that flow through Warmenna. In that case the business is the controller and decides why and how that data is used; we process it only on the business's documented instructions under a Data Processing Agreement.
3. Data we process
3.1 Business account data (we are controller)
- Identity and contact details — name, business name, email address and phone number.
- Authentication data — hashed password, multi-factor authentication secrets and session tokens.
- Billing data — plan, billing email and payment method tokens (we do not store full card numbers; see Stripe below).
- Usage data — sign-ins, features used, device and IP information, and error logs.
3.2 End-customer data (we are processor for the business)
- Message content exchanged between your customers and the AI receptionist across WhatsApp, Instagram, Telegram, email and the website widget.
- Contact details your customers provide, such as name, phone number, email or social handle.
- Booking and order data — appointment times, services or items requested, deposits and any notes.
We only process end-customer data to deliver the receptionist, booking and messaging features a business has configured.
4. Lawful bases
For data where we are the controller, we rely on: performance of a contract to provide and bill for the Services; legitimate interests to secure, support and improve the Services and run our business; consent for marketing emails and non-essential cookies; and legal obligation for tax and accounting records. Where we act as processor, the business is responsible for establishing a lawful basis for messaging its customers and for obtaining any consent required.
5. Sub-processors
We use a small set of vetted sub-processors, each bound by a data processing agreement. We never sell personal data. Current sub-processors include:
- Amazon Web Services (AWS) — hosting, storage and managed databases in the eu-west-2 (London) region.
- Meta Platforms (WhatsApp Business Platform and Instagram) — delivery and receipt of messages on those channels.
- Stripe — payment, deposit and subscription processing.
- An AI / large language model provider (such as Anthropic or OpenAI) — to generate the receptionist's automated replies. Message content is sent to the provider to produce a response and, under our agreement, is not used to train the provider's models.
- Email delivery (Amazon SES) — for transactional and email-channel messages.
A current list is available on request from [email protected].
6. International transfers
Customer data is stored in the UK/EU by default. Where a sub-processor necessarily processes data outside the UK/EEA — for example a large language model or messaging provider — we rely on appropriate safeguards including the UK International Data Transfer Agreement, EU Standard Contractual Clauses (2021) and encryption in transit and at rest.
7. Data retention
We keep personal data only as long as necessary. Account data is retained for the life of the account and for up to 90 days after closure; billing and tax records for a minimum of six years to meet HMRC requirements; and application and security logs for up to 12 months. End-customer data processed on a business's behalf is retained in accordance with that business's instructions and is deleted or returned on termination.
8. Your rights
If you are in the UK or EEA you have the right to access, rectification, erasure, restriction, portability and objection, and to withdraw consent at any time. To exercise a right over data we control, email [email protected]; we respond within one month. If your data was processed by Warmenna on behalf of a business, please contact that business as the controller — we will support them as processor to fulfil your request.
9. Contact and complaints
Data protection queries should be sent to Huup Ltd at [email protected]. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk), under whose registration ZC165061 we are registered.