Privacy Policy
1. Who we are
This policy explains how EnablSoft Technologies Limited (“EnablSoft”, “we”, “us”) handles personal data. We are a limited company registered in England and Wales at Companies House, company number 15431767. Our registered office is Flat 452 Station House, Elder Gate, Milton Keynes, MK9 1GA. We are based in Milton Keynes, UK.
We are the controller of personal data about visitors to this website, people who contact us, and our own business contacts. When we build or run automations for a client, we usually act as that client's processor, and the client is the controller. Section 8 covers that case.
Sarat Sarvepalli, who runs EnablSoft, also works as an independent consultant (sole trader) through his own site, sarat.sarvepalli.com. When he contacts you or you use his site in that role, including from his @enablsofttechnologies.uk email address, he is the controller, not EnablSoft, and his own privacy notice applies.
Contact for anything in this policy: sarat@enablsofttechnologies.uk.
2. What we collect
This website has no sign-up, no account area and no contact form. We set no cookies, and we run no advertising tools. The data we handle falls into these groups:
- Website visits. Our hosting provider (Vercel) keeps standard server logs, such as your IP address, browser type, pages requested and time. We use them for security and to keep the site running.
- Visit counts. We count visits with Vercel Web Analytics, which sets no cookies. For each visit it records the page visited, the referrer or the link tag you arrived from (for example a LinkedIn post, a QR code or an email), and your rough device type, browser and country. It does not follow you across sites or build a profile of you.
- Theme preference. If you switch between light and dark mode, your choice is saved in your own browser (local storage). It is not sent to us and no other site can read it.
- Fonts and links. The site’s fonts are hosted on our own servers, so loading a page sends nothing to a font company. Links to LinkedIn, Instagram, Spotify, Telegram and YouTube take you to those services, which have their own policies.
- Messages you send us. This site has no booking tool. If you email us, we receive what you choose to give us: usually your name, email address, company, and what you want help with. Some buttons on this site link to Sarat Sarvepalli’s own website (sarat.sarvepalli.com), where he offers calls. That is a separate site with its own privacy policy, and anything you enter there is covered by that policy, not this one.
- Business contact details. Names, work emails and company details of prospects and clients, collected from you directly or from public sources such as Companies House, company websites and LinkedIn.
- Client data we process for automation work. See section 8.
We do not knowingly collect data from children, and we do not collect special category data on purpose.
3. Why we use it, and our lawful bases
| Purpose | Data | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Keep the website secure and working | Server logs, IP address | Legitimate interests (running a secure site) |
| Reply to your enquiry or booking | Name, email, message | Legitimate interests, or steps at your request before a contract |
| Sell and deliver our services, send invoices, keep accounts | Contact and billing details | Contract, and legal obligation (tax and accounting records) |
| Contact businesses about services that may help them | Business name, work email, role | Legitimate interests (B2B outreach, with an easy opt-out; we follow PECR) |
| Run our own internal operations, including our Google Workspace automations (section 4) | Our own email, files and spreadsheets, which can include contact details of people who write to us | Legitimate interests (running the business efficiently) |
Where we rely on legitimate interests, we have weighed them against your rights and expect the impact on you to be low. You can ask us for details of that assessment.
When we contact businesses, we email only limited companies and LLPs. Sole traders, partnerships and other individuals are contacted only through LinkedIn, or by email if they have agreed to it. AI tools help us draft and personalise these messages, and a person reads and checks every message before it is sent. Reply no and we will not contact you again.
This also covers messages we send on LinkedIn, through your website contact form, or on a Facebook or Instagram business page. If we speak on a short feedback call, we take notes only with your agreement: your name and firm, your trade, the numbers you share, which problems are real for you, any objections, how the price sounded, and whether you want a follow-up. We do not share those notes by name. We keep them for 12 months, like other outreach data, then delete them.
4. Google user data and our Google OAuth app
We run workflow automations on a self-hosted n8n server (n8n.enablsofttechnologies.uk). To let those automations work with Google services, we use a Google OAuth app called Agent Vanar OAuth in the Google Cloud project agent-vanar-agency.
What it accesses and why
The app connects our automations to EnablSoft's own Google Workspace and Gmail accounts, and to Gmail, Drive and Sheets data in them. It is used only for our internal operations, for example sending status and alert emails, filing documents, and reading and updating our own tracking spreadsheets. It is not a consumer product and it is not offered to the public. If we ever connect a client's Google account, we do it only with that client's written agreement, and the same limits below apply.
How we handle it
- We use Google user data only to provide or improve the internal operations described above.
- We do not sell Google user data, and we do not share it with third parties except as set out in section 6 and as needed to run those operations, to comply with law, or with your consent.
- We do not use Google user data for advertising, and we do not use it to build or train generalised AI or machine learning models. Where an automation sends a piece of text to an AI provider to classify or draft something, it goes through that provider's API for that one task, under terms that do not allow the provider to train on it.
- People at EnablSoft do not read Google user data unless it is needed for security, to follow the law, to support a specific operation, or you have given consent.
- Access tokens are stored in the n8n credential store on our server, and the server is access controlled. You can revoke access at any time in your Google Account at myaccount.google.com/permissions.
Google API Services User Data Policy
EnablSoft Technologies' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. How long we keep it
- Server logs: kept by our host for a short, rolling period (typically days to weeks).
- Enquiries and emails: up to 2 years after our last contact, unless they lead to a contract.
- Outreach emails: 12 months after our last contact, unless they lead to a contract.
- Client contracts, invoices and accounting records: 6 years, as UK tax and company law expect.
- Client data we process: only as long as the client's agreement says, then returned or deleted. See section 8.
- Google OAuth tokens: until you or we revoke them, or the connected automation is retired.
6. Who we share data with (sub-processors)
We do not sell personal data. We use these service providers to run the business, and they handle data only on our instructions:
| Provider | What for |
|---|---|
| Vercel | Website hosting and delivery, and cookie-free visit counts (Vercel Web Analytics) |
| Google (Workspace, Gmail, Drive, Sheets) | Our email, documents and spreadsheets, plus the OAuth connection in section 4 |
| Supabase | Databases for our own operations and, where agreed, client automation data |
| Resend | Sending system and transactional email |
| OpenAI | AI processing through its API (for example classifying or drafting text) where an automation needs it |
| Anthropic (Claude) | Helping draft and personalise outreach messages, which are saved as Gmail drafts and checked by a person before they are sent |
| n8n, self-hosted on a rented virtual private server | Running our workflow automations. The server is ours; the hosting company only supplies the machine. |
We may also share data with our accountants and professional advisers, with regulators or law enforcement when the law requires it, and with a buyer if the business is ever sold (with the same protections). We update this list when it changes. For client work, the client's agreement lists the providers used for that client.
7. International transfers
Our Supabase databases are hosted in Zurich, Switzerland. Some other providers above, including Vercel, Google, Resend, OpenAI and Anthropic, process data outside the UK, including in the United States. Where that happens we rely on the UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified), or on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, plus our own check that the transfer is safe. You can ask us for a copy of the safeguards.
8. Client data and automation services
When we build or run an automation for a client, the client decides why and how their customers' or staff's personal data is used. We process it on the client's behalf and only on their documented instructions, under a written agreement that covers the points UK GDPR Article 28 requires. In practice that means:
- We access only the systems and data needed for the agreed work.
- We keep client data separate from our own and do not use it for our own purposes.
- Access is limited to people who need it, and credentials are stored in a secured credential store, not in code or documents.
- We use only the sub-processors listed in the client's agreement and tell the client before adding a new one.
- We tell the client without undue delay if we find a personal data breach.
- When the work ends, we return or delete the data, as the client chooses.
If you are a client's customer and want to use your rights over data we process for that client, please contact the client first. We will help them respond.
9. Security
We use access controls, encrypted connections (HTTPS) for the website and our services, restricted credential storage, and separate credentials per service. No online system is perfectly secure. If a breach is likely to put you at risk, we will tell you and the ICO as the law requires.
10. Your rights
Under UK GDPR you can ask us to:
- give you a copy of your personal data (access);
- correct data that is wrong;
- delete your data, in some cases;
- restrict how we use it, in some cases;
- hand over data you gave us in a portable format;
- stop using it where we rely on legitimate interests, and always stop B2B marketing to you if you ask.
Email sarat@enablsofttechnologies.uk. We aim to reply within one month. We may need to check who you are first. There is no fee unless a request is clearly unfounded or excessive. Where we rely on your consent, you can withdraw it at any time.
11. Complaints
Please tell us first so we can try to fix the problem. You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.
12. Changes to this policy
We will update this page when our practices change and revise the “last updated” date above. For significant changes affecting clients, we will tell them directly. See also our Terms of Service.
Contact: EnablSoft Technologies Limited, Flat 452 Station House, Elder Gate, Milton Keynes, MK9 1GA. Email sarat@enablsofttechnologies.uk.