Privacy Policy

How we collect, use, and protect your information

Last Updated: 25 September 2026

1. Who We Are

CabMind Ltd (“CabMind”, “we”, “our”, or “us”) is registered in England & Wales, Company No. 16946896. We provide an AI-powered booking and messaging platform for UK taxi and private hire operators and other local service businesses (for example, a beauty studio), delivering AI agents across WhatsApp, Instagram Direct Messages, Text/SMS and Voice channels. In this policy, “business clients” (or “operators” for taxi firms) means the businesses that use CabMind.

For data protection purposes, CabMind acts as:

  • Data Controller in respect of personal data collected directly through our website and enquiry forms.
  • Data Processor in respect of customer, passenger, booking and message data processed on behalf of our business clients. The business client is the data controller for that data. In that capacity, we act on the business client’s documented instructions and under a Data Processing Agreement (“DPA”).

2. Contact Details

For any privacy or data protection query, please contact us:

Email: info@cabmind.co.uk
Phone: 07880 899259
Company: CabMind Ltd, registered in England & Wales, Company No. 16946896

3. Data We Collect

3.1 Business Enquirers (Website Visitors)

When you submit an enquiry or demo request through our website, we collect:

  • Name and job title
  • Business name
  • Email address and phone number
  • Information you voluntarily provide in your message

3.2 Passenger and Booking Data (Processed on Behalf of Operators)

Through our AI booking channels — WhatsApp, Text/SMS and Voice — we process the following data on behalf of taxi and private hire operators:

  • Name and phone number
  • Pickup and drop-off addresses
  • Booking date, time, and preferences
  • Fare and payment information
  • Conversation logs (chat transcripts and call recordings)

3.3 Instagram Business Accounts and Direct Messages

A business client can connect its Instagram professional account to CabMind using Instagram Login. When it does:

  • Account data: we store the connected account’s Instagram ID, username and an access token. The access token is stored encrypted.
  • Message data: we receive the Direct Messages that customers send to that business, including the sender’s Instagram-scoped ID, the message text and any attachments, and timestamps.

We use this data only to reply to the customer on behalf of that business and to show the conversation to that business’s staff. We never sell it, never use it for advertising, and never message anyone who has not first messaged the business.

For these messages, the business client is the data controller and CabMind acts as its data processor. Messages are kept as set out for booking and conversation records in Section 10.

Disconnecting and deletion: a business client can disconnect Instagram at any time in the CabMind dashboard, or remove CabMind in Instagram under Settings → Apps and websites. Either stops all processing of that account’s data and deletes its access token. Anyone can ask us to delete their Instagram data at dashboard.cabmind.co.uk/data-deletion or by emailing info@cabmind.co.uk.

We access and use Instagram data in accordance with Meta’s Platform Terms and Developer Policies.

3.4 Call Recordings

Calls handled by our AI Voice Agent may be recorded. Recordings are used for booking fulfilment, quality assurance, and dispute resolution. Call recordings are retained for up to 6 months and then securely deleted, unless a longer retention period is required by law or a specific operator DPA.

3.5 Website Usage Data

We collect standard technical data when you visit our website, including IP address, browser type, pages viewed, and referring URL, via cookies and analytics tools.

3.6 Newsletter Subscribers

If you subscribe to our newsletter, we collect and store your email address in order to send you news and updates from CabMind. You can unsubscribe at any time by contacting info@cabmind.co.uk.

4. Lawful Bases for Processing

We process personal data on the following lawful bases under UK GDPR Article 6:

  • Contract: to perform our service agreement with operators and to fulfil passenger booking requests.
  • Legitimate Interests: to improve our platform, prevent fraud, and respond to enquiries. Where we rely on legitimate interests, we have conducted a balancing test confirming these interests are not overridden by your rights.
  • Legal Obligation: where required to comply with applicable law.
  • Consent: for marketing communications. You may withdraw consent at any time by contacting us at info@cabmind.co.uk.

5. Data Sharing

We share personal data only where necessary and with the following categories of recipients:

  • Dispatch and integration platforms: to create and manage bookings in the operator’s dispatch system. No dispatch partner is named in this policy; a current list of platforms is available on request.
  • WhatsApp / Meta Platforms: to deliver messages via the WhatsApp Business API under Meta’s Data Processing Terms.
  • Instagram / Meta Platforms: to receive and send Instagram Direct Messages for a connected business account via the Instagram API, under Meta’s Platform Terms.
  • Telephony providers: to route and handle AI voice calls, including call recording infrastructure.
  • Cloud and hosting providers: for secure storage and computing infrastructure.
  • AI service providers: for natural language understanding and response generation, under strict data-processing agreements.
  • Advertising and analytics partners (e.g. Meta): to measure the performance of our own marketing campaigns, only where you have given consent via our cookie banner.
  • Legal and regulatory authorities: where required by law, court order, or to protect our legal rights.

We do not sell personal data.

Where you have given consent via our cookie banner, we may share limited technical identifiers (such as a hashed email/phone number, browser/device identifiers, or click identifiers) with advertising partners (e.g. Meta) solely to measure the effectiveness of our own marketing campaigns. This processing only occurs with your consent, which you can withdraw at any time via our cookie settings — see Section 11 below.

6. International Data Transfers

Some of our sub-processors are based outside the UK. Where we transfer personal data internationally, we ensure appropriate safeguards are in place, including UK-approved standard contractual clauses (SCCs) or equivalent protections under the UK GDPR international transfer framework.

7. Sub-Processors

We maintain an up-to-date list of sub-processors involved in processing passenger and booking data. This list is available on request by contacting info@cabmind.co.uk.

8. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including:

  • TLS/SSL encryption for data in transit
  • Encrypted storage with role-based access controls
  • Regular security assessments
  • Staff access limited to what is necessary for their role

9. Your Rights (UK GDPR)

Where CabMind is the data controller in relation to your data, you have the right to:

  • Access — request a copy of the personal data we hold about you
  • Rectification — request correction of inaccurate or incomplete data
  • Erasure — request deletion of your data where we have no legal obligation to retain it
  • Restriction — request that we limit how we process your data in certain circumstances
  • Portability — receive your data in a structured, machine-readable format
  • Object — object to processing based on legitimate interests
  • Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing

To exercise any of these rights, contact us at info@cabmind.co.uk. We will respond within one calendar month.

If CabMind is acting as a data processor (i.e., processing data on behalf of an operator), please contact the relevant operator directly as they are the data controller for that data.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

10. Retention

We retain personal data only for as long as necessary for the purposes for which it was collected:

  • Website enquiry data: up to 3 years from last contact
  • Booking and conversation records (including WhatsApp and Instagram messages): as directed by the business client (typically up to 7 years for business and legal purposes)
  • Instagram access tokens: until the business client disconnects Instagram or removes CabMind, when the token is deleted
  • Call recordings: up to 6 months
  • Website analytics: up to 26 months (aggregated)
  • Newsletter subscriber emails: until you unsubscribe or request deletion

11. Cookies

We use cookies and similar technologies in the following categories:

  • Strictly Necessary: required for the website and cookie-consent tool to function; these cannot be switched off.
  • Analytics: help us understand how visitors use the site, so we can improve it.
  • Advertising/Marketing: including Meta Pixel, used to measure and improve the performance of our own advertising campaigns. These are only set with your consent.

We use a cookie consent management tool to let you accept or reject non-essential cookies, and to record your choice. You can change your preferences at any time using the cookie settings link/icon on our site, or by clearing cookies in your browser.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The current version is always available on this page with the “Last Updated” date shown above. Material changes will be communicated to business clients by email.