Your datahandled plainly.

01Who we are

Sattva is a software agency. For the personal data described in this policy, we are the data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy covers sattva-ai.com, enquiries you send us, and the people we work with on client projects. Where we process personal data on a client’s behalf inside a product we build or run for them, we act as their processor under a separate agreement, and their own privacy notice applies.

02Information we collect

We keep what we collect to the minimum needed to do the job.

• Enquiries. When you use our contact form or email us: your name, email address, company (optional) and whatever you choose to tell us about your project.
• Clients and their teams. Names, work email addresses, phone numbers, job titles, billing details and the project correspondence needed to deliver and invoice the work.
• Technical data. When you visit the site, our servers receive your IP address, browser type and the pages requested, as every web server does. We use this to keep the site secure and to stop abuse of the contact form.
• Cookie choices and, only if you agree, analytics. See cookies below.

We do not knowingly collect data from children, and we don’t ask for special category data (such as health or beliefs). Please don’t send it to us.

03How we use it, and why

UK GDPR requires a lawful basis for each use. Ours are:

• Replying to enquiries and preparing proposals — our legitimate interest in answering people who contact us, or steps taken at your request before entering into a contract.
• Delivering projects, support and invoicing — performance of our contract with you or your organisation.
• Keeping accounting and tax records — legal obligation.
• Securing the site and preventing spam or abuse — legitimate interest.
• Analytics cookies — your consent, which you can withdraw at any time.
• Occasional updates about our work — sent to existing clients as permitted by the Privacy and Electronic Communications Regulations (PECR), or with your consent. Every message has a one-click way to opt out.

We never sell your personal data, and we don’t share it with anyone for their own marketing.

04Cookies and similar technologies

Cookies are small files a website stores in your browser. We also use browser storage (localStorage), which works in a similar way. The law (PECR) treats both the same, so this section covers both.

Strictly necessary

Required for the site to work and so exempt from consent. Today the only one is the record of your cookie choice, stored in your browser under the key sattva:consent until you clear it or we ask again after changing this policy.

Analytics — optional

With your permission, we may use privacy-respecting analytics to understand, in aggregate, which pages are visited and how the site performs. These never load until you choose “Accept all” or switch analytics on. We will list each provider and cookie here before we switch any of them on.

What we don’t use

No advertising cookies, no cross-site tracking, no selling of browsing data. Our fonts and media are served from our own servers, so viewing the site doesn’t hand your IP address to font or video providers. Links to LinkedIn and other networks only reach those sites if you click them, after which their own policies apply.

Change cookie settings

You can also block or delete cookies in your browser settings; blocking strictly necessary storage means we simply can’t remember your choice.

05Who we share it with

We use a small number of trusted suppliers who process data for us under written terms that require them to keep it secure and use it only on our instructions:

• Website hosting — IONOS, which runs the servers this site is served from.
• Transactional email — Resend, which delivers contact-form messages to our inbox.
• Business email, file storage and project tools — the providers we use to correspond with you and manage project work.
• Accountants and professional advisers — where needed to run the business and meet legal obligations.

We may also disclose data if the law requires it, or to protect our rights in a dispute.

06International transfers

Some suppliers, such as our email delivery provider, may process data outside the UK, including in the United States. Where that happens we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework) or the ICO’s International Data Transfer Agreement or Addendum, so your data keeps an equivalent level of protection. Ask us for details of the safeguard that applies.

07How long we keep it

• Enquiries that don’t turn into a project: up to 12 months after our last contact, then deleted.
• Client and project records: for the length of the engagement and six years after it ends, in line with limitation periods and HMRC record-keeping rules.
• Server and security logs: kept only as long as needed for security and troubleshooting, normally no more than 30 days.
• Your cookie choice: in your own browser until you clear it or change it.

08Keeping it safe

The site is served over HTTPS; access to our systems is restricted to the people who need it and protected by strong, unique passwords and multi-factor authentication where available; secrets are kept out of our code; and our suppliers are chosen with security in mind. No system is perfectly secure, but if a breach affecting your data were to happen we would act promptly and notify you and the ICO where the law requires.

09Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to how we use it, including for direct marketing;
• receive your data in a portable format; and
• withdraw consent at any time, where we rely on it.

To use any of these, email contact@sattva-ai.com. It’s free, and we’ll respond within one month. We may need to confirm your identity first.

10Complaints

If you’re unhappy with how we’ve handled your data, please tell us first at contact@sattva-ai.com so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

11Changes to this policy

We’ll update this page when our practices or the law change, and revise the date at the top. If a change affects the cookies we ask about, we’ll ask for your choice again. Our terms of business cover how we work with clients.