This Privacy Policy explains how Sadie AI Ltd ("we", "us", "our") collects, uses, and protects your personal data when you use the Sadie AI service at app.sadieai.co.uk and our website at sadieai.co.uk.
We are committed to protecting your privacy and handling your data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
Sadie AI Ltd is a company registered in England and Wales.
- Registered address: 10 Brill Close, Alresford, England, SO24 9FG
- Contact for data protection matters: privacy@sadieai.co.uk
- ICO registration number: ZC153621
For the purposes of UK GDPR, Sadie AI Ltd is the data controller of personal data we collect about you as a user of our service. We are a data processor in respect of personal data you store in Sadie about your own customers (your clients).
2. What data we collect
From you (the Sadie user)
When you apply to join the waitlist, register an account, or use Sadie, we collect:
- Your name and business name
- Your email address and password (hashed)
- Your business address, VAT number, and Companies House number (if provided)
- Phone number (if provided)
- Communications you send us, including support requests
- Technical data: IP address, browser type, device information, and how you use the service
If you connect Google services (Gmail, Calendar), we receive OAuth tokens that allow us to send emails and create calendar events on your behalf. We do not store your Google password.
From your use of Sadie
We store the data you enter into the service in order to provide it to you:
- Jobs, quotes, invoices, materials lists, and notes
- Photos you upload of work or sites
- Voice notes you record (transcribed via OpenAI Whisper)
- Chat conversations with Sadie (processed via Anthropic Claude)
About your clients (data you put into Sadie)
When you use Sadie to manage your business, you enter information about your own customers — names, email addresses, phone numbers, addresses, and details of the work you do for them. You are the data controller for this information. We process it on your behalf as your data processor, in line with this policy and our Terms of Service.
3. How we use your data
We use your personal data to:
- Provide the Sadie service to you
- Send emails on your behalf via Gmail (when you authorise this)
- Generate quotes, invoices, and reminders
- Process voice recordings into text and structured data
- Respond to your support requests
- Improve the service
- Send you service-related emails (account confirmations, password resets, billing if applicable)
- Comply with our legal obligations
We do not sell your data. We do not share it with advertisers. We do not use it to train AI models.
4. Legal basis for processing
Under UK GDPR, we rely on the following legal bases:
- Contract — to provide the service you've signed up for
- Legitimate interests — to improve the service, prevent fraud, and operate our business
- Consent — for any optional features (e.g. connecting Google services). You can withdraw consent at any time.
- Legal obligation — where we are required by law to retain or share data
5. Who we share data with
We use the following third-party services to operate Sadie. Each processes data on our behalf under appropriate data protection terms:
| Service | Purpose | Where data is processed |
|---|---|---|
| Railway | Hosting and database | USA / UK |
| Anthropic (Claude) | AI assistant features (chat, email drafting) | USA |
| OpenAI (Whisper) | Voice note transcription | USA |
| Google (Gmail / Calendar) | Sending emails and calendar events on your behalf | USA / UK |
| Resend | Sending transactional emails (e.g. password resets, account and service notifications) | EU (Ireland) |
| Open-Meteo | Weather data for morning briefings | EU |
| Netlify | Landing page hosting | USA |
Where data is transferred outside the UK, we rely on appropriate safeguards including UK International Data Transfer Agreements or the UK extension to the EU-US Data Privacy Framework.
We will share your data with law enforcement or regulators if legally required to do so.
6. How long we keep your data
- Account data: kept while your account is active, and for up to 12 months after you close it
- Job, quote, and invoice data: kept while your account is active. UK businesses are legally required to retain financial records (invoices) for 6 years — you remain responsible for your own compliance.
- Voice recordings: transcribed immediately, then deleted within 7 days
- Chat history: stored locally in your browser with a 2-hour expiry; older messages are not retained
- Soft-deleted jobs: kept for 30 days in Trash for recovery, then permanently deleted
- Backups: may persist for up to 30 days after deletion
If you close your account, we will delete your personal data within 30 days unless we have a legal obligation to retain it.
7. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your data ("right to be forgotten")
- Restrict how we process your data
- Object to processing
- Portability — receive your data in a portable format
- Withdraw consent at any time where consent is the legal basis
To exercise any of these rights, email privacy@sadieai.co.uk. We will respond within one month.
You also have the right to complain to the Information Commissioner's Office:
- ICO website: ico.org.uk
- Helpline: 0303 123 1113
8. Security
We protect your data with:
- HTTPS encryption for all traffic
- Hashed passwords (never stored in plain text)
- Row-Level Security in our database — your data is isolated from other users at the database layer as well as the application layer
- OAuth tokens stored encrypted and scoped per user
- JWT-signed session tokens with server-side session management — signing out, or resetting your password, immediately invalidates the relevant sessions, and a password reset signs out all of your other devices for security
- Regular security audits of our codebase
No system is perfectly secure. If we become aware of a data breach affecting your personal data, we will notify you and the ICO within 72 hours where legally required.
9. Cookies
The Sadie app uses essential cookies and local browser storage to keep you logged in and remember your preferences. We do not use tracking cookies, advertising cookies, or analytics that profile individual users.
10. Children
Sadie is a business tool intended for use by people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe we hold data about a child, please contact us and we will delete it.
11. Changes to this policy
We may update this policy from time to time. When we do, we will update the "Last updated" date at the top. For significant changes, we will notify you by email or through the app.
12. Contact us
For any questions about this policy or how we handle your data:
Sadie AI Ltd 10 Brill Close Alresford England SO24 9FG
Email: privacy@sadieai.co.uk