STAK.GROUP
Data sheet · Draft

Information for SRA-regulated firms.

What your COLP and DPO need to know before Stak AI Receptionist answers your phones: where call data goes, who can see it, and the points to cover under the SRA Code of Conduct for Firms.

Version 0.1 (draft)Last updated 13 October 2026

01At a glance

Roles

Your firm is the controller of callers’ data. Stak Group is your processor, under our Article 28 DPA.

Location

Data may be processed outside the UK (US and EU) under UK GDPR transfer safeguards. We do not offer UK-only hosting.

Retention

Logs, summaries and transcripts 90 days; audio 30 days or none. Deleted within 30 days of contract end. [TO CONFIRM]

Training

Stak does not use your callers’ data to train AI models. Provider policies are listed in the DPA. [TO CONFIRM]

02Where call data goes

  1. Twilio (telephony, US) receives the call on your number and carries the audio.
  2. ElevenLabs (voice AI, US-based with EU/UK transfer safeguards) runs the AI assistant: it hears the caller, replies, and produces the transcript. ElevenLabs may use third-party language model providers under its terms.
  3. The assistant records the caller’s number, name, contact details, matter type and urgency, and writes a summary. Audio is kept only if you turn recording on.
  4. Netlify (hosting and functions, US) stores the call log in Netlify Blobs, encrypted at rest by the provider.
  5. Google (Gmail / Workspace, US/EU) emails the summary to the people at your firm you choose. Infobip (EU) sends an SMS if email fails.

The transfer safeguard for each provider (UK–US data bridge, IDTA or UK Addendum) is in Schedule 2 of the DPA [TO CONFIRM].

03Confidentiality

Paragraph 6.3 of the Code of Conduct for Firms requires you to keep the affairs of current and former clients confidential unless disclosure is required or permitted by law or the client consents. Callers are often prospective or existing clients, so we treat every call as confidential:

  • call content is handled only on your instructions and is never used for Stak’s own purposes or for model training;
  • everyone at Stak with access is bound by confidentiality, and access is limited and logged;
  • summaries go only to the people at your firm you choose;
  • our DPA treats call content, including anything that may be privileged, as your confidential information.

04No legal advice

The assistant takes details and passes them to you. It never gives legal advice, and it never quotes fees unless you have told it what to say. Your team decides what happens next with each enquiry.

05Outsourcing considerations

Using an answering service is a form of outsourcing. The SRA’s position is that you remain accountable for work carried out through others. Points your firm may want to record:

  • Governance and controls (para 2.1). You need effective systems and controls so that those you contract with do not cause or substantially contribute to a breach of the SRA’s regulatory arrangements (2.1(c)). Paragraph 2.3 confirms you remain accountable where work is carried out through others.
  • Risk (para 2.5). Add the service to your risk register and consider business continuity if it is unavailable.
  • SRA access (para 3.3(b)). Our DPA lets us make information available to your regulators, including the SRA, on request.
  • The SRA’s outsourcing guidance. The confidentiality guidance says firms that outsource services need to consider their arrangements, that this includes storing data with a third party in the cloud, and that terms of engagement may set the arrangements out. The SRA’s Lawtech Q&A also suggests considering whether client consent is needed before using a legal tech tool.
  • Data protection. Sign our DPA, update your privacy notice (we provide wording), and consider a data protection impact assessment. Callers may volunteer health or criminal-offence details.
  • Breaches. We will tell you within 48 hours of becoming aware of a breach, so you can meet your 72-hour duty to report to the Information Commission.

06Call recording

Recording is your choice and can be turned on or off at any time. If it is on, audio is kept for 30 days [TO CONFIRM]; if off, no audio is stored, though the call is still transcribed and summarised. Either way, callers should hear a short notice at the start of the call. Business call recording in the UK is also governed by the Investigatory Powers (Interception by Businesses etc.) Regulations 2018. We provide recommended wording.

07AI disclosure

The assistant always says it is an AI assistant if asked. We recommend saying so in the greeting as well, and we provide a greeting line for this. Our voice provider’s terms require callers to be told at the start that they are speaking to AI and that the conversation is recorded [TO CONFIRM: make the up-front greeting the default].

“Thank you for calling [Firm name]. I’m the firm’s AI assistant. This call is recorded and transcribed so the team can follow up. How can I help?”

08Contact

Questions from your COLP or DPO: privacy@stakgroup.co.uk [TO CONFIRM]. Stak Group data protection registration number: [PENDING].