Privacy Policy

1. Who we process data for — our two roles

The Platform is business software used by fabrication, kitchen and interior-design companies (“tenants”).

• Where we decide how data is used (controller): account and login details of tenant staff who use the Platform, billing records, support correspondence, and visitor data on our marketing sites. For this data, SAAS LOGIC LTD is the data controller and this policy applies directly.
• Where we act on a tenant’s instructions (processor): the customer records a tenant keeps in the Platform — their leads, customers, quotes, projects, appointment bookings, enquiry-form submissions and connected email. For this data the tenant is the controller and we process it only to provide the service. If you are a customer of one of our tenants and want to exercise your data rights over that data, contact that business directly; we will assist them in responding.

2. What we collect

Tenant staff accounts — name, work email address, role, password (stored only as a one-way bcrypt hash), optional passkey credentials, and staff profile details a tenant chooses to record.

Tenant business records (on tenants’ behalf) — lead and customer contact details (name, email, phone, address/postcode), quotes, projects, job and visit records, documents and photos uploaded to jobs, notes.

Connected email (optional, per tenant) — if a tenant administrator connects a Microsoft 365 or Gmail mailbox, we mirror messages to provide assistant features (classification, draft replies). See section 5 for the Google-specific commitments.

Voice and messaging (optional, per tenant) — if a tenant enables the phone/AI-receptionist features (provided through Twilio), we process call metadata, and call recordings and voicemail where the tenant has enabled them.

Website enquiry widgets — when you submit an enquiry form on a tenant’s website, the details you enter are delivered into that tenant’s account. The tenant is the controller of that data.

Technical data — server logs, IP addresses for security rate-limiting, error reports (with credentials and personal values redacted), and audit logs of actions taken in the Platform.

Marketing sites — these currently use only strictly-necessary cookies. If we introduce analytics cookies in future, we will update this policy and request your consent through a cookie banner before they are set.

3. Why we process it (lawful bases)

We do not sell personal data, and we do not use Platform data for advertising.

4. AI features

The Platform includes AI assistant features (email classification and drafting, an in-app assistant, an optional AI phone receptionist). These features send the relevant content to Anthropic’s Claude API on a per-request basis to generate the result.

• Anthropic processes this content under a no-training commitment: it is not used to train AI models.
• We do not train our own models on tenant or customer content.
• AI outputs are presented to a human user for review; the assistant does not send email without an explicit user action, except where a tenant administrator has expressly enabled an automated flow.

5. Use of Google Workspace APIs (Limited Use disclosure)

The Platform integrates with Google Workspace (specifically Gmail) when a tenant administrator chooses to connect their inbox. The integration uses these Google API scopes:

• gmail.modify — read, label, archive, and move email messages within the connected mailbox
• gmail.readonly — read email messages and metadata for assistant context
• gmail.send — send replies and drafts on behalf of the authenticated user
• userinfo.email — confirm the connected mailbox address

Limited Use commitment

SAAS LOGIC LTD’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not:

1. Use Gmail data for personalised advertising or any advertising purpose.
2. Sell or transfer Gmail data to data brokers, advertisers, or any other third party for any purpose unrelated to the user-facing features of the Platform.
3. Use Gmail data to train generalised AI/ML models. Where the Platform’s AI assistant uses message content for classification or drafting, processing happens on a per-request basis through Anthropic’s Claude API under a no-training agreement. We do not train any of our own models on user mailbox content.
4. Allow humans to read Gmail content except (a) where the connected user has given explicit consent for a specific support session, (b) where it is necessary for security purposes, or (c) where we are legally required to disclose the content under a valid request from a competent authority.

Gmail content received via the API is held only as long as necessary to provide the user-facing assistant features. Email content is automatically purged on a rolling basis: once the job, quote, or lead it relates to has closed it is deleted within 90 days, and email not linked to any active work is deleted within 90 days of receipt. The connected user can disconnect Gmail access at any time from the admin dashboard. Disconnecting immediately revokes the app’s OAuth grant with Google and deletes our stored credentials, so no further mailbox access is possible; email content already mirrored is then deleted under the retention schedule above. Disconnection does not affect the original messages, which remain in the user’s Gmail account. The same retention and use rules apply to mailboxes connected through Microsoft 365.

6. How long we keep data (retention)

Retention is enforced by automated deletion jobs, not manual housekeeping. The headline periods:

When a tenant leaves the Platform, their data is exported on request and then deleted, subject to the legal retention periods above.

7. Security

• Encryption in transit: all traffic uses TLS (HTTPS).
• Encryption at rest: customer personal data fields are encrypted with AES-256-GCM. Files are stored on Cloudflare R2 with provider-managed encryption. OAuth tokens are encrypted with AES-256-GCM.
• Access control: role-based access, per-tenant isolation enforced on every query, session cookies that JavaScript cannot read, CSRF protection, per-user rate limiting, and login throttling.
• Malware scanning: every file upload is scanned before storage.
• Monitoring: audit logging of sensitive actions and independent security scanning of our codebase in CI.

No system is perfectly secure; if we become aware of a breach affecting personal data we will notify affected tenants and, where required, the ICO without undue delay.

8. Who we share data with (sub-processors)

We use a small number of service providers to run the Platform. Each is bound by contract to process data only to provide their service to us:

We do not share personal data with advertisers or data brokers. We may disclose data where required by law or to protect the rights, safety or property of SAAS LOGIC LTD, our tenants or others.

Our application and database are hosted in the European Union (Netherlands). The UK recognises the EEA as providing adequate protection for personal data, so UK-to-EU hosting requires no additional safeguard. Where a sub-processor processes data outside the UK or EEA (for example, Anthropic in the United States), we rely on recognised transfer safeguards such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

9. Your rights

Under UK GDPR you have the right to: access the personal data we hold about you; have inaccurate data corrected; have data erased (where no legal retention applies); restrict or object to processing; data portability; and to withdraw consent where processing is based on consent.

To exercise any of these, email [email protected]. We respond within one month. If you are a customer of one of our tenants, we will route your request to the relevant business (the controller) and assist them in responding.

You also have the right to complain to the UK supervisory authority: the Information Commissioner’s Office (ico.org.uk).

10. Cookies

The Platform uses only strictly-necessary cookies: an encrypted, httpOnly session cookie to keep you signed in, and a CSRF-protection cookie. These are required for the service to function and do not track you across other sites. The marketing sites currently use only strictly-necessary cookies; if analytics cookies are introduced in future, this policy will be updated and consent requested via a cookie banner first.

11. Children

The Platform is business software and is not directed at children. We do not knowingly collect data from anyone under 16.

12. Changes to this policy

We will post any changes on this page and update the date at the top. For material changes affecting tenants, we will notify tenant administrators by email.

13. Contact

SAAS LOGIC LTD
Company number: 17184036
Registered office: 66 Paul Street, London, England, EC2A 4NA
Privacy contact: [email protected]