Privacy Policy

This Privacy Policy explains how Caelus Global Ltd collects, uses, shares and protects personal data in connection with the Mocean AI voice-agent service, the website at caelusglobal.co.uk, the Mocean integration with e-commerce platforms including Shopify, and the calendar connections a client may authorise with Google Calendar or Microsoft 365.

1. Who we are

Caelus Global Ltd ("Caelus", "Mocean", "we", "us") — company no. 17201074, registered office 124-128 City Road, London, England, EC1V 2NX. We operate the Mocean AI voice-agent service.

For questions about this policy or to exercise your rights, contact dan@caelusglobal.co.uk.

2. Our two roles

The capacity in which we process personal data depends on whose data it is:

• As a controller — for our own website visitors, for prospective business clients, and for our direct business relationships. We decide why and how that data is processed, and this policy applies directly.
• As a processor — when one of our business customers (a "merchant" or "client") uses Mocean to handle enquiries from their customers, or connects their store to Mocean, we process that personal data on the client's behalf and on their instructions. In that case the client is the controller, our Data Processing Agreement governs the processing, and the client's own privacy policy is the primary notice to those individuals.

3. The personal data we process

3.1 Website visitors

When you visit caelusglobal.co.uk we process minimal technical data (such as IP address, browser/device type, and pages viewed) for security and to operate the site. We store a small preference in your browser's local storage to remember your light/dark theme. We do not use advertising or cross-site tracking cookies.

3.2 Callers and enquirers handled by the Mocean voice agent

When you contact a business that uses Mocean — by telephone, or where enabled by a web form — the agent processes:

• Identity and contact data: name, telephone number, email (if provided)
• Location data: town / postcode / approximate address you provide during the conversation
• Enquiry data: the details of your enquiry, product or appointment preferences
• Call data: an audio recording and/or transcript of the call, and call metadata (time, duration)

We do not intentionally collect special category data (such as health, racial or religious data). If you volunteer such information it is processed only incidentally as part of the call record.

3.3 Data from connected stores (Shopify and other e-commerce platforms)

When a merchant connects their store to Mocean, we access — strictly to provide the service the merchant has enabled — the store data necessary to do so, which may include: the merchant's product catalogue and inventory levels; the merchant's customers' names, email addresses, phone numbers and order history; draft and abandoned checkouts; and order fulfilment / tracking status. This lets Mocean answer enquiries accurately (for example confirming whether an item is in stock), recognise a returning caller, follow up on an abandoned basket, and create a warm-lead record for the merchant. We act as the merchant's processor for this data and do not use it for our own purposes.

3.4 Data from connected calendars (Google Calendar and Microsoft 365)

A client may choose to connect their business calendar so that the agent can offer appointment times that are genuinely free and place a confirmed booking in their diary. Connecting a calendar is optional, is initiated by the client, and requires the client to authorise access through Google's or Microsoft's own consent screen. From the calendars the client explicitly selects, Mocean accesses:

• Free/busy availability — the start and end times of existing commitments, used solely to work out which appointment slots to offer. This is read at the moment of the call and used to compute available times; we do not store the contents of calendar entries — not titles, descriptions, locations, attendees, or any other event detail.
• The list of calendars in the connected account — names and identifiers only — so the client can choose which calendars count towards availability and which one bookings should be written into.
• Writing a booking — when an appointment is agreed on a call, Mocean creates a single calendar event containing the appointment time, the enquiry details and, where the caller provided one, the caller's name and email address as an invitee.

A client can disconnect their calendar at any time from their Mocean dashboard, or revoke access directly in their Google or Microsoft account settings, after which Mocean immediately stops accessing it.

4. How we use personal data, and our lawful bases

5. Sharing and sub-processors

We do not sell personal data, and we do not use call content or store data to train third-party AI models beyond what is necessary to deliver the service. We share personal data only with the service providers needed to run Mocean, each bound by data-protection terms:

6. International transfers

Some providers process personal data outside the UK, including in the United States. Where that happens, the transfer is made under an appropriate safeguard — the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or a UK adequacy regulation, as applicable.

7. Retention

Call recordings and transcripts we hold are retained for 90 days and then deleted, save for the structured enquiry record passed to the client's CRM or store, which thereafter sits within the client's own controlled environment. Website technical logs are kept only as long as needed for security and operation. Where we act as a processor, we delete or return personal data on the client's instruction or on termination of their agreement, unless retention is required by law.

8. Your rights

Under UK data protection law you have the right to access, rectify, erase, restrict or object to the processing of your personal data, and to data portability, in each case subject to the legal conditions that apply.

• If we are the controller, contact us at dan@caelusglobal.co.uk and we will respond within the statutory timeframe.
• If your data was handled because you contacted, or are a customer of, a business that uses Mocean, that business is the controller — please direct your request to them; we will assist them in responding, and we will forward any request you send us directly to the relevant client.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk. We would ask that you give us the chance to address your concern first.

9. Shopify customer data — additional notes

For merchants who connect a Shopify store: Mocean accesses store and customer data via Shopify's official, merchant-authorised API connection, only after the merchant installs and authorises the app, and only within the permissions the merchant grants. The merchant can disconnect the app at any time from their Shopify admin, after which we stop accessing the store and delete or return the associated data in line with section 7. We honour Shopify's customer-data-request, customer-redact and shop-redact requests. If you are a customer of a Shopify store that uses Mocean, that store is the controller of your data; please also refer to that store's own privacy policy.

10. Google and Microsoft calendar data — limited use

Mocean's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms, and applying the same standard to calendar data we receive from Microsoft:

• We use calendar data only to provide the user-facing features described in section 3.4 — offering appointment times that are actually free, and placing a booking the caller has agreed.
• We do not sell calendar data, and we do not use it for advertising, profiling, or credit-scoring purposes.
• We do not use calendar data to train generalised artificial-intelligence or machine-learning models.
• We do not transfer calendar data to third parties except as necessary to provide the feature, to comply with applicable law, or as part of a merger or acquisition following notice to the client.
• We do not allow humans to read calendar data, except where the client has given explicit consent for a specific issue, where it is necessary for security purposes or to comply with applicable law, or where the data has been aggregated and anonymised.
• We retain the minimum necessary: free/busy times are read transiently at the point of a call to compute availability and are not stored. We retain only the identifiers of the calendars a client selected and, where a booking was made, a reference to the event we created.

Clients may revoke Mocean's access at any time via their Mocean dashboard, or directly at myaccount.google.com/permissions for Google or the equivalent Microsoft account settings.

11. Changes to this policy

We may update this policy from time to time. The version identifier at the top of the page changes when we do. Material changes will be reflected here before they take effect.

This Privacy Policy is provided by Caelus Global Ltd in plain English. It sits alongside our Data Processing Agreement and Master Services Agreement, which govern our contractual relationship with business clients. Last updated 5 August 2026.