The short version: if you use Otter, Fireflies, Fathom, Read.ai, Zoom AI Companion or Microsoft Copilot to transcribe client calls, you are almost certainly recording, storing and possibly training AI on conversations that were never yours to share. Most small business owners have never opened the settings page that controls this, and most clients have no idea it’s happening. That’s not just a legal risk under GDPR, it’s a trust risk, and trust is the one thing a small consultancy or agency cannot afford to lose.
The call that made me go and check my settings
Last spring I was on a discovery call with a prospective client, a founder of a small manufacturing firm in the Midlands. Halfway through, she mentioned a supplier dispute in detail, names, figures, the lot, and said “obviously this is off the record.” I nodded. Then I remembered my notetaker was still running.
I went back into the app that evening, an AI transcription tool I’d been using for about eight months, and found a setting buried three menus deep that let the company use recorded calls “to improve our AI models and services.” It had been switched on by default since the day I signed up. Every call I’d recorded, every client confession, every awkward number someone shared thinking it was just between us, had potentially been sitting in a training pool.
I turned it off within the hour. But it made me go through every AI tool touching my business, and what I found should worry any small business owner who thinks a free transcription app is just a convenience.
How these tools work behind the scenes
Otter.ai’s free plan gives you 300 minutes of transcription a month, which sounds generous until you realise the trade-off. Free and lower-tier accounts historically had model training enabled by default, and turning it off required digging into account settings most users never open. Fireflies.ai offers a “workspace admin” toggle for data retention, but it’s set at organisation level, meaning one person on your team can leave it on for everyone without realising.
Zoom faced a public backlash in 2023 when updated terms of service appeared to grant the company rights to use customer audio, video and chat content to train its AI, including AI Companion. Zoom walked the wording back within days after journalists and privacy researchers flagged it, but the episode is worth remembering because it shows even household-name platforms will quietly expand what they can do with your recordings unless someone outside the company notices and makes noise.
Read.ai and Fathom both market themselves on how much they capture: sentiment, talk-time ratios, action items, even who interrupted whom. That’s brilliant for your own team meetings. It’s a different matter entirely when the bot is silently profiling a client who thought they were having a private conversation with you.
The consent problem UK small businesses keep missing
The UK is technically a one-party consent jurisdiction for recording calls, meaning you can legally record a conversation you’re part of without the other person’s agreement. But GDPR and PECR (the Privacy and Electronic Communications Regulations) sit on top of that and require you to tell people their data is being processed, and for what purpose, before you do it, not after. “Obviously this is off the record” from your client is a strong hint they haven’t been told an AI is transcribing, storing and potentially learning from what they say.
GDPR fines can reach €20 million or 4 percent of global annual turnover, whichever is higher, for the most serious breaches, and while a two-person consultancy is unlikely to draw a fine of that scale, the Information Commissioner’s Office has shown it will act on complaints from individuals, not just headline data breaches. The bigger practical risk for most small firms isn’t the fine. It’s the client who finds out, mentions it to two other people, and quietly stops referring you work. You can read the background on data protection rules on Wikipedia’s GDPR overview if you want the fuller legal picture before you go any further.
What I did about it (five steps, in order)
- Audit every tool that touches a client conversation. I listed six apps across my business, from the CRM to the AI notetaker to the email assistant, and checked each one’s data and training settings individually. It took an afternoon.
- Turn off model training wherever it’s on by default. On most platforms this is a toggle, not a subscription change. Otter, Fireflies and Fathom all have an option, it’s just rarely where you’d expect it.
- Add a one-line verbal disclosure to every recorded call. Mine now says: “Quick heads up, I use an AI notetaker for this call so I don’t miss anything, is that alright with you?” It takes four seconds and I’ve never once had someone say no.
- Put it in writing too. I added a line to my standard client onboarding email and to my terms page, so there’s a paper trail beyond the verbal ask.
- Check retention periods, not just training settings. Some tools keep transcripts for years by default. I set mine to delete after 90 days unless I manually flag something to keep.
Why the free plan is the most expensive option
Here’s the uncomfortable bit most posts about AI notetakers skip past. The free and cheap tiers of nearly every transcription tool are cheap precisely because your data, and your clients’ data, is part of the payment. Enterprise plans that guarantee zero data retention and no training use exist on almost every one of these platforms, but they cost more, often three to four times the consumer price, because that’s what genuine data isolation is worth to the vendor. If you’re billing clients £150 an hour and running their confidential conversations through a £10-a-month tool with training switched on, you’re not saving money, you’re quietly underwriting someone else’s AI model with your client’s business secrets.
This is the same logic that shows up in every strong brand story worth studying. Howard Schultz didn’t build Starbucks by cutting corners on the customer experience to save a few cents a cup, and there are real business lessons from Howard Schultz in how he treated consistency and trust as the actual product, not the coffee. The same principle applies here: the notetaker settings are invisible to your client, but the trust they represent isn’t, and it shows up eventually, usually at the worst moment.
Building the disclosure into how you market yourself
Once I’d sorted the settings, I realised there was a marketing opportunity hiding in the whole mess. Being upfront about how you handle client data, AI tools included, is a differentiator most small consultancies never mention on their site. Disney has spent decades proving that a brand built on trust and consistency compounds over time, and there’s a reason Disney’s marketing strategy leans so heavily on that promise being kept every single time, not just when it’s convenient. A small business saying plainly “here’s exactly how we use AI on client calls, and here’s how to opt out” does the same job on a tiny scale.
I also started thinking about how content teams handle client data at scale. Ahrefs built a huge amount of trust in the SEO world by being transparent about how its own data was gathered and what it meant, and the Ahrefs marketing strategy is worth studying for that reason alone, transparency as a growth lever, not a compliance chore.
What to check this week
If you use any AI notetaker, sit down for twenty minutes and do this:
- Log into your account settings and search for the words “training,” “improve,” or “AI model.” That’s usually where the toggle lives.
- Check the data retention period. If it says “indefinite” or doesn’t say at all, that’s your answer.
- Look for an enterprise or “team” tier and compare what it promises on data isolation versus your current plan.
- Write one sentence you’ll say out loud on every recorded call from now on, and use it.
- Add a line to your client agreement or onboarding email confirming what tools you use and why.
None of this requires a lawyer or a huge budget. It requires twenty minutes and the willingness to admit you probably haven’t looked at this before, because almost nobody has.
Where AI trust fits into the bigger picture
Napoleon Hill wrote about the compounding value of a good name long before anyone had heard of a data breach, and there’s a straight line from the business lessons in Napoleon Hill’s work to how small firms should think about AI tools today: reputation is built slowly and lost fast, and most reputational damage now starts with a setting nobody checked. If you want to turn transparency into something clients notice, rather than a line buried in a terms page, an AI implementation coach can help you audit every tool touching client data and turn the fix into a proper part of how you sell trust as a business, not just tick a compliance box.
And if you want to give clients something engaging that doesn’t involve recording a word they say, worth remembering that interactive calculators convert visitors without ever touching a live conversation, no consent conversation required because there’s no recording to consent to in the first place.
Frequently asked questions
Is it legal to record client calls in the UK without asking?
Technically yes, the UK allows one-party consent, meaning you can record a call you’re on without the other person agreeing. But GDPR and PECR still require you to inform people their data is being processed before you do it, so silence isn’t the same as compliance, and most clients will feel misled if they find out after the fact.
Do free AI notetaker plans really train on my calls?
Many do by default unless you find and switch off the setting yourself. Otter, Fireflies and similar tools have historically enabled model improvement or training on free and lower-tier plans, and the toggle to opt out is rarely somewhere an average user would think to look.
What should I say to a client before I start recording?
Keep it short and direct: “I use an AI notetaker for this call so I don’t miss anything, is that alright with you?” It takes seconds, almost nobody says no, and it turns a hidden practice into an honest one that builds confidence in how you run your business.
Is paying for the enterprise plan really worth it for a small business?
If you handle sensitive client information on calls, yes. Enterprise tiers on most transcription tools guarantee zero data retention and no training use, and the price difference is usually smaller than the cost of one client walking away after discovering their conversation was stored somewhere they never agreed to.
Related reading: The AI Meeting Notes Habit That’s Quietly Making Your Team Worse at Their Jobs and The AI Notetaker in Your Sales Calls Is Costing You More Than You Think.
