Privacy Policy

Got an email from us about your business? Here is what we hold and how to stop it.

Who we are

FloAutomate is operated by Mohamed Zahir Ibrahim, a sole trader trading as “FloAutomate”, based in Southport, Merseyside, United Kingdom. Postal address: 124 City Road, London EC1V 2NX. A limited company is forthcoming; these details will be updated on incorporation.

For the purposes of the UK GDPR, the data controller is Mohamed Zahir Ibrahim. You can reach us by email at zahir@floautomate.com.

• Data controller: Mohamed Zahir Ibrahim (sole trader, trading as FloAutomate)
• Location: Southport, Merseyside, United Kingdom
• Postal address: 124 City Road, London EC1V 2NX
• Contact: zahir@floautomate.com

What we collect

We only collect the data we need to respond to enquiries and run the business. That is:

• Contact and enquiry details: your name, email address, company name, and anything you choose to tell us about your project when you book a call, send a brief, or email us directly.
• Booking details: when you schedule a call, our booking provider records the information needed to confirm and manage the appointment.
• Anonymous performance data: aggregated, non-identifying metrics about how the site performs (for example page load speed), used to keep the site fast.
• Anonymous usage data: which pages are opened, roughly where in the world from, whether on a phone or a computer, and which link brought you here. We set no cookies and store nothing on your device for this. Visits are counted using a one-way code built from your IP address that changes every day, so it cannot be traced back to you or used to recognise you tomorrow, and we never keep the IP address itself.

We do not run advertising trackers, and we do not sell your data.

Why we use it, and our lawful basis

• To respond to your enquiry and provide a quote, lawful basis: taking steps at your request prior to entering a contract, and our legitimate interest in handling enquiries.
• To deliver and manage agreed work, lawful basis: performance of a contract.
• To keep the site secure and performant, lawful basis: our legitimate interest in maintaining a reliable service.
• To meet legal and accounting obligations, lawful basis: compliance with a legal obligation.

If we emailed you about your business

We sometimes email small UK limited companies about automating their admin. If you received one of those emails, this is what we hold and why.

• What we hold: your company’s details from the Companies House public register (name, number, status, registered address, and the names and roles of its directors); the business email addresses your company publishes on its own website, the page each was found on, and which one we wrote to; short quotes from your company’s own website or its public job adverts that the email referred to; the emails we sent and when; and, if you replied, up to 200 characters of your reply, what it was about, and a short note of how the conversation went.
• Where it came from: the Companies House register, public job adverts (GOV.UK’s “Find an apprenticeship” service and Reed.co.uk), and your company’s own website. We only email addresses that a company publishes on its own website: a director’s own address where there is one, otherwise the company’s general address such as info@ or office@, and only if it has neither, another address it publishes. We never email personal or free email addresses, and we only email limited companies and LLPs.
• Why, and our lawful basis: to introduce our services to businesses that may benefit from them. Our lawful basis is our legitimate interest in marketing our business to other businesses. We have written an assessment weighing that interest against yours, and you can ask for a copy. Every email is read and approved by Zahir before it is sent. We never use sensitive information about anyone to decide who to contact or what to say.
• Stopping it: reply “no” to any of our emails, use the Unsubscribe option your email app shows, or email zahir@floautomate.com. We will not email you again. To make sure of that, we keep a one-way code made from your address, rather than the address itself, and, where it is your own, your company’s web domain, on a do-not-contact list.
• How long we keep it: if you never reply, we delete your details 12 months after our last email. If you reply, we keep the conversation while we are in touch and delete it 12 months after it ends. If we looked at your company but never emailed you, we delete what we found 12 months after we last looked. Before we delete the details of anyone we emailed, we put a one-way code made from the address we wrote to, with your company’s registration number and, where it is your own, its web domain, on our do-not-contact list. That list is kept permanently, because deleting it could mean contacting you again.

These providers process it for us:

• Google (Workspace): the mailboxes we send from and receive replies in.
• Neon: our database, hosted in London.
• Hetzner: the server that sends our emails and reads replies, in Germany.
• Anthropic: the AI service that helps us draft emails and sort replies, in the United States.
• Telegram: the alerts Zahir gets on his phone. An alert about a reply can name your company and quote the public findings the email referred to. It never contains your email address or what you wrote.

Where data leaves the UK, we rely on the safeguards UK data protection law recognises. Your rights in the “Your rights” section below apply to this data too, including the right to object, which we always honour.

If we sent you a discovery questionnaire

Before a first call, we sometimes send a business a private link to a short questionnaire at discovery.floautomate.com. If you filled one in, this is what we hold and why.

• What we hold: your answers, your business’s name and the first name we greeted you by, when you sent it, and any documents you chose to upload.
• Why, and our lawful basis: to prepare for our conversation about your business and, if you go ahead, to scope the work. Our lawful basis is taking steps you have asked for before a possible contract with us.
• Where it is kept: in a private folder in our Google Drive. While you fill it in, your answers are saved in the browser on your own device, and cleared when you press Send. When you send it, we get a message saying you have finished; it contains none of your answers.
• How long we keep it: we delete your answers and documents 90 days after you send them, or 90 days after your link expires if you never send it. If you become a client, they move into the records for your project and are kept as those records are. To have them deleted sooner, email zahir@floautomate.com.
• Please don’t upload medical records or ID documents.

These providers process it for us:

• Google (Workspace): Google Drive, where your answers and documents are stored.
• Vercel: hosting the questionnaire.
• Telegram: the message telling us you have finished. It names your business and contains none of your answers.
• Anthropic: the AI service that helps us read your answers and documents when we prepare for our call, in the United States.

Where data leaves the UK, we rely on the safeguards UK data protection law recognises. Your rights in the “Your rights” section below apply to this data too.

Who processes your data

We use a small number of trusted third-party providers to run the site and book calls. These act as data processors on our behalf:

• Cal.com: scheduling and booking of calls.
• Vercel: website hosting and Speed Insights (anonymous performance data).
• Resend: sending the Automation Assessment result you ask for by email, and the copy of it that goes to us so we can reply.
• Vercel Web Analytics: cookieless, anonymous page views and assessment funnel events. No personal data.
• Supabase: our own record of the same cookieless, anonymous usage data, and of Automation Assessment results where you asked us to email you one, so we can answer you properly and keep track of what we have sent.

For the business emails described in “If we emailed you about your business”, we also use Google Workspace, Neon, Hetzner, Anthropic and Telegram, as set out in that section.

For discovery questionnaires, described in “If we sent you a discovery questionnaire”, we use Google Workspace, Vercel, Telegram and Anthropic, as set out in that section.

Where a provider processes data outside the UK, we rely on appropriate safeguards recognised under UK data protection law.

How long we keep it

We keep personal data only for as long as we need it. Enquiry correspondence is retained for the duration of any engagement and a reasonable period afterwards; records required for legal, tax, or accounting purposes are kept for as long as the law requires. When data is no longer needed, we delete it.

Your rights

Under the UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to how we process your data;
• data portability, where applicable;
• withdraw consent at any time, where we rely on consent.

To exercise any of these, email zahir@floautomate.com. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority, at ico.org.uk.

Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with a revised “last updated” date.

Contact

Questions about this policy or your data? Email zahir@floautomate.com.