SONIQ LabsSign in

Privacy Policy

Last updated: 24 October 2026

We Are One 1 Limited, trading as SONIQ Labs, is a company registered in England and Wales (company number 15052885). Registered office: 124 City Road, London, EC1V 2NX, United Kingdom. Registered with the Information Commissioner's Office as a data controller, registration number ZB976321.

1. Who we are

We Are One 1 Limited, trading as SONIQ Labs ("SONIQ", "we", "us"), provides the SONIQ platform: cloud phone systems, desk phones and apps, call recording and transcription, AI call summaries, contact centre, AI receptionist agents, messaging and related integrations. We supply businesses directly and through channel partners.

We Are One 1 Limited, trading as SONIQ Labs
124 City Road
London
EC1V 2NX
United Kingdom
Company number 15052885, registered in England and Wales
ICO registration ZB976321

Data protection contact: [email protected]

2. When we are processor and when we are controller

  • Customer data: we are processor. A business that uses SONIQ (or the partner that supplies it) controls the personal data on its account: its staff, its callers and contacts, call records, recordings, voicemails, transcripts, messages and AI outputs. We process that data only on its instructions, under our Data Processing Addendum. If you called or messaged a business that uses SONIQ, that business is responsible for your data and is the right place for your questions.
  • Our own data: we are controller. This covers our records of customers, partners and prospects, billing, website enquiries, support correspondence and platform security logs.

3. Data we process

3.1 On behalf of customers

  • User accounts: name, work email, phone number, extension, role, devices and sign-ins
  • Call records: calling and called numbers, times, durations, routing and outcome
  • Recordings, voicemails and transcripts, where the customer switches these on
  • AI outputs: call summaries, caller intent, follow-up tasks and AI receptionist conversations
  • Contacts and caller ID details
  • SMS, WhatsApp and email messages sent or received through the platform
  • Data from systems the customer connects, such as Microsoft 365 or a practice-management system

Calls can contain special category data, for example health information on a call to a clinic. The customer decides whether calls are recorded, transcribed or summarised and can switch each feature off. Card numbers spoken on calls are masked in transcripts, and recording pauses while a payment is taken.

3.2 For our own purposes

  • Business contact details of customers, partners and prospects
  • Contract, billing and payment records
  • Support tickets and correspondence
  • Security and service logs: IP address, device, sign-in events and errors
  • Website enquiries and cookies (section 10)

4. Why we use data, and our lawful basis

For data we control:

  • To provide the service, onboard and support customers: performance of a contract.
  • To keep the platform secure, prevent fraud and abuse, and keep it reliable: legitimate interests.
  • To keep billing, tax and telecoms records and meet Ofcom and other legal duties: legal obligation.
  • To tell business contacts about our services: legitimate interests, with an opt-out in every message, or consent where the law requires it.

For customer data, the customer as controller decides the lawful basis.

5. AI features

Transcription, summaries, intent detection and the AI receptionist run mostly on Cloudflare and Soniox, in the UK and EU. Voicemail transcription runs on Soniox in the EU. Some features use US providers: the in-app assistant (Google Gemini), generated voices (ElevenLabs) and selected recruitment and agent-setup tools (OpenAI). None of these providers may use customer data to train their models, and we do not use customer call content to train or fine-tune any model.

AI suggests; people decide. The AI receptionist checks every caller for emergencies and risk and hands those callers to a person. It does not give medical, legal or financial advice. We do not make solely automated decisions that have legal or similarly significant effects on anyone.

6. Who we share data with

  • Sub-processors that run parts of the platform for us. The full list, with what each does, where it processes data and the safeguard used, is on our sub-processors page. We give customers 30 days' notice of changes.
  • The partner that supplies the service, where a customer buys through a partner.
  • Telecoms carriers, to connect calls and port numbers.
  • Regulators, emergency services and law enforcement, where the law requires it. We tell the customer unless the law forbids it.
  • A buyer of our business, under equivalent protections and with notice to customers.

We do not sell personal data, and we do not use customer data for advertising.

7. International transfers

Our database is in London, our voice servers are in the UK and live transcription runs in the EU. Some sub-processors, listed on the sub-processors page, process data in the United States or elsewhere. For those transfers we use the UK-US Data Bridge where the provider is certified, and otherwise the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

8. Security

  • Encryption in transit (TLS 1.2 or higher, SRTP for app calls) and at rest
  • Strict separation between customer accounts, enforced in the database and the API
  • Multi-factor authentication and least-privilege access for our staff
  • Key-only server access, firewalls and automatic blocking of known attackers
  • Encrypted backups, kept immutable so they cannot be deleted with a stolen key
  • Staff access to a customer account only for a support request, and logged

Our core providers hold ISO 27001 and SOC 2 Type II certification. If a personal data breach affects customer data, we tell the customer in writing within 48 hours of becoming aware of it.

9. How long we keep data

  • Recordings, voicemails and transcripts: the period the customer sets, from 30 days up to 7 years or longer where regulation requires
  • Customer data after a contract ends: available for export for 90 days, then deleted; backups expire within a further 30 days
  • Billing, contract and tax records: 7 years
  • Support correspondence: 3 years
  • Security and sign-in logs: 12 months

10. Cookies

We use cookies that are strictly necessary to sign you in and keep the portal secure. We only set analytics or marketing cookies with your consent, which you can withdraw at any time.

11. Your rights

You can ask for access to your data, correction, erasure, restriction, a portable copy, or object to processing, and withdraw consent where we rely on it. For data we control, email [email protected] and we will reply within one month. For data a business holds about you on SONIQ, contact that business; if you contact us instead, we will pass your request to them promptly.

12. Children

SONIQ is a service for businesses and is not intended for children.

13. Complaints

Please contact us first so we can put things right. You can also complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk, 0303 123 1113.

14. Changes to this policy

We post updates on this page and tell customers about material changes before they take effect.