Privacy Policy

Version privacy-v1-2026-06-29

This Privacy Policy explains how Caelus Global Ltd collects, uses, shares and protects personal data in connection with the Mocean AI voice-agent service, the website at caelusglobal.co.uk, and the Mocean integration with e-commerce platforms including Shopify.

1. Who we are

Caelus Global Ltd ("Caelus", "Mocean", "we", "us") — company no. 17201074, registered office 124-128 City Road, London, England, EC1V 2NX. We operate the Mocean AI voice-agent service.

For questions about this policy or to exercise your rights, contact dan@caelusglobal.co.uk.

2. Our two roles

The capacity in which we process personal data depends on whose data it is:

As a controller — for our own website visitors, for prospective business clients, and for our direct business relationships. We decide why and how that data is processed, and this policy applies directly.
As a processor — when one of our business customers (a "merchant" or "client") uses Mocean to handle enquiries from their customers, or connects their store to Mocean, we process that personal data on the client's behalf and on their instructions. In that case the client is the controller, our Data Processing Agreement governs the processing, and the client's own privacy policy is the primary notice to those individuals.

3. The personal data we process

3.1 Website visitors

When you visit caelusglobal.co.uk we process minimal technical data (such as IP address, browser/device type, and pages viewed) for security and to operate the site. We store a small preference in your browser's local storage to remember your light/dark theme. We do not use advertising or cross-site tracking cookies.

3.2 Callers and enquirers handled by the Mocean voice agent

When you contact a business that uses Mocean — by telephone, or where enabled by a web form — the agent processes:

Identity and contact data: name, telephone number, email (if provided)
Location data: town / postcode / approximate address you provide during the conversation
Enquiry data: the details of your enquiry, product or appointment preferences
Call data: an audio recording and/or transcript of the call, and call metadata (time, duration)

We do not intentionally collect special category data (such as health, racial or religious data). If you volunteer such information it is processed only incidentally as part of the call record.

3.3 Data from connected stores (Shopify and other e-commerce platforms)

When a merchant connects their store to Mocean, we access — strictly to provide the service the merchant has enabled — the store data necessary to do so, which may include: the merchant's product catalogue and inventory levels; the merchant's customers' names, email addresses, phone numbers and order history; draft and abandoned checkouts; and order fulfilment / tracking status. This lets Mocean answer enquiries accurately (for example confirming whether an item is in stock), recognise a returning caller, follow up on an abandoned basket, and create a warm-lead record for the merchant. We act as the merchant's processor for this data and do not use it for our own purposes.

4. How we use personal data, and our lawful bases

Purpose	Lawful basis (UK GDPR)
Operating, securing and improving the website	Legitimate interests (running a safe, functional website)
Responding to a sales enquiry you make to us	Legitimate interests / steps prior to entering a contract
Handling inbound enquiries, qualifying them, booking appointments, and passing the record to the client's CRM or store	Performed for our client (controller) under their lawful basis and our Data Processing Agreement
Recording and transcribing calls to handle the enquiry and for quality and accuracy	Legitimate interests of the client; you are notified at the start of the call
Returning a call or text you requested (including web-form callbacks and abandoned-basket follow-ups enabled by the merchant)	Legitimate interests of the merchant in serving an interested customer

5. Sharing and sub-processors

We do not sell personal data, and we do not use call content or store data to train third-party AI models beyond what is necessary to deliver the service. We share personal data only with the service providers needed to run Mocean, each bound by data-protection terms:

Provider	Purpose	Location	Transfer safeguard
Twilio Inc.	Inbound/outbound telephony and SMS	US (global infra)	SCCs + UK Addendum
ElevenLabs Inc.	Voice AI: speech-to-text, conversational AI, text-to-speech	US	SCCs + UK Addendum
Anthropic (via ElevenLabs)	Large language model powering the agent's responses	US	SCCs + UK Addendum (via ElevenLabs)
Vercel Inc.	Application hosting / serverless processing	US/global edge	SCCs + UK Addendum
Supabase	Transient database for call and enquiry records	EU/UK or US per configuration	SCCs + UK Addendum where applicable
Resend	Transactional email (lead/booking notifications)	US	SCCs + UK Addendum
Shopify (and other e-commerce platforms the client connects)	The merchant's own store platform — the source/destination of store data; accessed by Mocean only for connected merchants	Per the merchant's store region	The merchant's own platform relationship
The client's chosen CRM (e.g. GoHighLevel, Pipedrive, etc.)	The client's system of record for the enquiry	Per the client's CRM region	Client-selected

6. International transfers

Some providers process personal data outside the UK, including in the United States. Where that happens, the transfer is made under an appropriate safeguard — the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or a UK adequacy regulation, as applicable.

7. Retention

Call recordings and transcripts we hold are retained for 90 days and then deleted, save for the structured enquiry record passed to the client's CRM or store, which thereafter sits within the client's own controlled environment. Website technical logs are kept only as long as needed for security and operation. Where we act as a processor, we delete or return personal data on the client's instruction or on termination of their agreement, unless retention is required by law.

8. Your rights

Under UK data protection law you have the right to access, rectify, erase, restrict or object to the processing of your personal data, and to data portability, in each case subject to the legal conditions that apply.

If we are the controller, contact us at dan@caelusglobal.co.uk and we will respond within the statutory timeframe.
If your data was handled because you contacted, or are a customer of, a business that uses Mocean, that business is the controller — please direct your request to them; we will assist them in responding, and we will forward any request you send us directly to the relevant client.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk. We would ask that you give us the chance to address your concern first.

9. Shopify customer data — additional notes

For merchants who connect a Shopify store: Mocean accesses store and customer data via Shopify's official, merchant-authorised API connection, only after the merchant installs and authorises the app, and only within the permissions the merchant grants. The merchant can disconnect the app at any time from their Shopify admin, after which we stop accessing the store and delete or return the associated data in line with section 7. We honour Shopify's customer-data-request, customer-redact and shop-redact requests. If you are a customer of a Shopify store that uses Mocean, that store is the controller of your data; please also refer to that store's own privacy policy.

10. Changes to this policy

We may update this policy from time to time. The version identifier at the top of the page changes when we do. Material changes will be reflected here before they take effect.