Skip to content

Legal

Privacy policy

Last updated: 2 November 2026

1. Who we are

This website and our services are run by Sentientflow Ltd ("SentientFlow", "we", "our" or "us"). We have offices in the United Kingdom and South Africa.

SentientFlow conforms to South Africa's Protection of Personal Information Act, 2013 (POPIA) and complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy explains, in plain English, what personal information we collect, why we use it, and the choices and rights you have.

2. What information we collect

2.1 Information you give us on this website

  • Contact form: your name, email address, company, phone number (if given) and your message.
  • Email sign-up: your email address and, where asked, your name.

These details are sent securely to our automation system so we can reply to you and manage our contacts.

2.2 Voice assistant conversations

If you talk to our voice assistant, we process what you say (audio and/or a transcript) and any details you share, so the assistant can respond and so we can follow up and improve the service.

2.3 Analytics (only with your consent)

If you accept analytics cookies, we collect information about how you use the site, such as pages viewed, device and browser type, and approximate location. See section 12 on cookies.

2.4 Client data

When we build or run AI solutions for a client, we may process personal information that the client gives us (for example, details of their customers or staff). In that case we act on the client's instructions under a written agreement, and the client is responsible for telling those people how their information is used.

3. Why we use it and our lawful basis

  • Replying to enquiries and following up: our legitimate interest in running and growing our business, or steps you ask us to take before entering a contract.
  • Sending newsletters and marketing emails: your consent. You can unsubscribe at any time.
  • Voice assistant conversations: our legitimate interest in answering your questions and improving the assistant; consent where the law requires it.
  • Analytics: your consent, given through the cookie banner.
  • Delivering client projects: performance of our contract with the client.
  • Meeting legal duties: for example tax, accounting and responding to lawful requests.

Under POPIA we only process personal information for specific, lawful purposes, and we collect no more than we need.

4. How long we keep it

  • Enquiries and contact form messages: up to 2 years after our last contact with you, unless you become a client.
  • Email sign-up: until you unsubscribe. We then keep a minimal record so we don't email you again.
  • Voice assistant recordings and transcripts: up to 12 months.
  • Analytics data: up to 14 months.
  • Client and contract records: for the life of the contract and then up to 6 years (UK) or 5 years (South Africa) for legal and accounting reasons.
  • Client data processed for projects: as set out in the client agreement, and deleted or returned when the project ends.

5. Who we share it with

We do not sell your personal information. We share it only with trusted service providers who help us run our business, such as:

  • website hosting and infrastructure providers;
  • email and communication providers;
  • analytics providers (only if you consent);
  • AI and voice technology providers that power our assistants;
  • professional advisers, such as accountants and lawyers.

These providers may only use your information to provide services to us, under contracts that require them to keep it secure and confidential. We may also share information where the law requires it.

6. Where your information is stored and international transfers

Client project data stays in the client's country. Personal information we process for South African clients' projects is stored and processed in South Africa, and personal information we process for UK clients' projects is stored and processed in the UK.

Other information, such as website enquiries, email sign-ups, voice assistant conversations and analytics, may be handled by our service providers in other countries, including the European Union. Because we work across the UK and South Africa, this information may also be shared between our UK and South African teams. When information is transferred to another country, we make sure appropriate safeguards are in place. These include adequacy decisions, the UK International Data Transfer Agreement or Addendum, standard contractual clauses, or binding agreements that give protection equivalent to POPIA (section 72) and UK GDPR.

7. Keeping it secure

We use appropriate technical and organisational measures to protect personal information, including encryption in transit, access controls, strong authentication and regular reviews. If a security breach affects your information, we will notify you and the relevant regulator where the law requires it.

8. Your rights

Under POPIA and UK GDPR you have the right to:

  • ask for access to the personal information we hold about you;
  • ask us to correct information that is wrong or incomplete;
  • ask us to delete your information;
  • object to us using your information, including for direct marketing;
  • ask us to restrict how we use it;
  • ask for your information in a portable format;
  • withdraw your consent at any time (this doesn't affect anything we did before).

We will not send you direct marketing by electronic means unless you have consented or you are an existing customer, in line with section 69 of POPIA and UK law. Every marketing email includes an easy way to opt out.

To use any of these rights, email ivan@sentientflow.co.uk. We may need to confirm your identity, and we will respond within one month.

9. Automated decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our AI assistants help answer questions and route enquiries, but a person makes any decision that matters.

10. Children

Our website and services are aimed at businesses and are not intended for children under 18. We do not knowingly collect children's personal information. If you think we have, please contact us and we will delete it.

11. Complaints

If you have a concern, please contact us first and we will try to put it right. You also have the right to complain to a regulator:

12. Cookies and analytics

With your consent, we use Google Analytics to understand how visitors use our website (for example, pages viewed). These cookies are only set if you choose "Accept" in the cookie banner; if you choose "Reject", no analytics cookies are set. Your choice is stored in your browser and you can change it at any time by clearing this site's stored data.

13. Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed, and we will tell you about any significant changes.

14. Credits

The 3D head on our AI agents page is based on "Infinite" 3D head scan by Lee Perry-Smith (ir-ltd.net), based on a work at triplegangers.com, licensed under Creative Commons Attribution 3.0 (CC BY 3.0). We have modified it: simplified the mesh, removed textures and restyled it as a wireframe.