Privacy policy

1. Who is responsible and what this covers

The website and its enquiry activities are operated by SENTR TECHNOLOGIES LTD (“SENTR”, “we”, “us” or “our”). The company is the controller responsible for deciding how the personal information described here is used.

Privacy contact: ian@sentr.io.

Company update — 23 September 2026: SENTR TECHNOLOGIES LTD has been incorporated and is identified here as the website operator. Earlier versions named Ian Martens, trading as SENTR. This update does not expand the purposes for which your information may be used or create marketing permission. The same privacy contact can help with records collected before incorporation and explain who is responsible for them; incorporation alone does not transfer historical contracts or records.

This notice addresses the UK GDPR and Data Protection Act 2018, as amended, and the EU GDPR where applicable. Our Data protection policy explains the distinction between website information and customer platform data. Our Cookie policy explains browser storage and your choices.

This policy covers website visitors, assistant users, prospective customers, partners and business contacts. It does not replace a customer's privacy notice or the data-processing agreement governing fraud-event data inside SENTR.Tower or SENTR.Citadel. Platform processing, evaluation datasets and production integrations require separate agreed arrangements.

2. Information we collect and its sources

• Information you provide: email, name, organisation, role if supplied, enquiry, selected session, availability, business requirements and correspondence. You choose how much optional detail to provide.
• AI information: messages, answers, the current public SENTR page and recent conversation. A requested email follow-up also includes the limited journey context described below.
• Technical information: requests to the website include an IP address, browser/device information and timing. Providers process these to deliver and secure the service. Our application uses hashed network identifiers for rate limits; these are not necessarily anonymous.
• Optional measurement: only when enabled and allowed, public-page visits, selected interactions and recognised campaign source, channel and name.
• Business introductions: a colleague, partner or professional contact may introduce you or share business contact details. We may receive information through a business event or direct professional correspondence. When information did not come from you, we explain its source when contacting you and provide this notice within the applicable legal period.
• Enquiry preparation: when you submit an enquiry, chat follow-up, booking or newsletter sign-up, we may look up your public work profile with Apollo.io (job title, seniority, employer, business location and LinkedIn profile) to prepare for the conversation. We fill missing fields only, never infer purchasing authority from a title, and you can ask us to remove or correct this information.
• Business-data enrichment: HubSpot can supplement business contact and company records using its commercial dataset, public information and third-party sources. Available information can include job title, professional role, seniority, business location, LinkedIn profile, company industry, size, estimated revenue and website technologies. Coverage and accuracy vary; these are research inputs, not confirmed statements about your needs or purchasing authority.

We do not obtain the contents of your other browser tabs. We do not need payment-card details, identity documents or your customers' fraud records to answer a website enquiry.

3. Purposes and legal grounds

Responding and arranging sessions

We use contact details, requirements and correspondence to answer questions, arrange meetings, provide requested materials and assess relevance. Our legitimate interests are responding to people who contact us and developing relevant business relationships. Where you personally enter a contract, rather than representing an organisation, necessary pre-contract steps may instead be the legal ground.

Providing the assistant

We process your question and necessary context to generate the answer you request. Our legitimate interest is providing an optional, useful information service. Conversation storage supports the assistant you choose to use. Email and booking remain available without AI.

Security and records

Our legitimate interests include preventing abuse, avoiding duplicate submissions, controlling costs, investigating faults and maintaining accurate enquiry records. If a specific legal duty requires records or disclosure, the ground is compliance with that duty. Establishing or defending legal claims may also require limited records.

Relevant business context

We use business-data enrichment to keep records accurate, understand an organisation's context and avoid asking you to repeat basic business information. We rely on legitimate interests only where that use is necessary and proportionate after considering your rights. We do not infer sensitive characteristics or treat enriched data as marketing permission. You can request correction or object at ian@sentr.io.

Analytics and marketing

Optional analytics uses consent, not an assumption based on visiting. A requested reply, recap, reminder or agreed later follow-up is not a newsletter subscription. Separate promotional campaigns require their own appropriate legal ground and prior consent where electronic-marketing rules require it. We do not treat website enquiries or chat submissions as that consent.

SENTR Insights is a separate email series. We send it only if you tick the Insights consent box. That tick is consent for the SENTR Insights subscription. An enquiry, chat follow-up or booking does not tick it, and ticking it does not create an enquiry. You can unsubscribe from any Insights email. The legal ground is consent.

For legitimate interests, we consider purpose, necessity and effects on you, minimise information and respect applicable objections. You may ask for details of that assessment.

4. AI conversations and email follow-up

When you ask a question

Your question, recent conversation and current public page are sent through our Netlify-hosted service to OpenAI, together with relevant SENTR product information, to generate an answer. We do not send the full page address with its query parameters or the separately collected follow-up email as separate AI inputs. Personal information typed into a message is, however, part of that message.

We disable stored Responses API conversation state. This is not zero retention: OpenAI's standard abuse-monitoring logs can include content and are normally retained for up to 30 days, with longer retention possible for legal or safety reasons. OpenAI states that API content is not used to train its models by default. Temporary processing or caching may also apply. See OpenAI's data controls.

The assistant is AI, not a human adviser, and can make mistakes. Our team can confirm important details. Website conversations are not automatically used to train SENTR's fraud-detection models.

Continuing across pages

This tab remembers recent messages, a draft and assistant state so you can navigate without restarting. The session becomes unavailable after 30 minutes of inactivity. “Clear conversation” removes the local record, not provider records or a follow-up already sent to HubSpot.

Only if you request email follow-up

Explicitly submitting follow-up sends HubSpot your email, preference (an answer, a recap or contact in about a month), up to 12 displayed messages, current public page, recent SENTR page paths, referenced pages, exchange count, approximate time with the page visible and whether you clicked a booking link. Recognised campaign context is included only where your optional measurement choice permits it.

This snapshot helps our team respond. A click is not proof of a booked meeting. Later messages are not silently appended to that submission. No email is needed to use the assistant. Change or cancel follow-up by contacting ian@sentr.io.

5. Enquiries, bookings and communications

Forms explain the requested information and next step. An email is needed for an email response; scheduling requires enough detail to issue an invitation. Optional questions help preparation. If a form prepares an email draft rather than sending directly, nothing is sent until you send the email yourself.

Submitted enquiries and requested chat follow-up are managed in HubSpot. An email may match an existing record. Internal notifications and tasks help us respond; they do not themselves make you a qualified opportunity or marketing subscriber.

We also use these business records to manage response times, meeting outcomes, qualification and sales reporting. This does not depend on optional analytics consent and does not turn on tracking of your browsing. We do not reconstruct declined browsing analytics from server logs or link that activity to your enquiry. You can object to legitimate-interest processing as explained below.

How HubSpot enrichment shares information

For initial contact enrichment, HubSpot uses first name, last name and work email; company enrichment uses the company domain. If HubSpot verifies a processed contact, its limited identifying details may also be added to HubSpot's commercial dataset and used to enrich other customers' records. This is separate from processing our enquiry records on our instructions. HubSpot describes its use of that dataset in its privacy policy and enrichment explanation. Our enquiry text, chat transcripts and qualification notes are not fields submitted by standard enrichment.

We configure enrichment to fill missing business details and refresh enrichment-supplied values, not replace your corrections with assumptions. Contact us to correct or stop our use of enriched information. You can also use HubSpot's enrichment opt-out form to request removal from its commercial dataset. A request to one organisation does not automatically erase the other's records. Turning off future enrichment does not itself undo information already contributed.

Bookings use HubSpot scheduling and our connected calendar. Loading an embedded calendar connects your browser to HubSpot; the external link does so on HubSpot's site. That service receives technical information and your submitted booking details, and may use functional or security cookies. Read the notices displayed by the service.

Google Workspace supports business email and calendars; Google Meet provides online meetings. Invitations, confirmations and reminders include information needed to attend. Our current booking process does not automatically record or transcribe meetings. If proposed, we will explain recording or transcription beforehand and meet applicable notice and consent requirements.

Cancel or reschedule using invitation links or contact us. We do not sell enquiry records or provide them to advertising platforms as a customer audience through this website setup.

6. Cookies, storage and analytics

Following the company update on 23 September 2026 and the addition of optional HubSpot visit history on 26 September 2026, we ask you to renew an earlier opt-in before further measurement starts. Existing unexpired rejections remain respected.

Your choice: select “Accept analytics” to enable Google Analytics and HubSpot visit history, “Reject optional” to continue without either, or “Settings” to choose each one separately and save your preference. The same approach applies to UK and EU visitors. Advertising tags remain disabled.

Analytics does not start simply because you visit, scroll, continue browsing or close the settings panel. Chat, enquiries and bookings remain available either way. We do not send pre-consent browsing events to Google or replay them after you accept. We do not currently run a separate consent-exempt audience-measurement tracker.

• Assistant continuity: tab storage sentr-ai-conversation-v3 holds recent chat state with a 30-minute inactivity expiry. It supports the assistant, not cross-site advertising.
• Privacy choice: local storage sentr-measurement-choice-v1 remembers accept or reject for up to 180 days, without renewing that period just because you return. New choices also record the decision time and notice version in your browser. This preference record is not sent to Google as a visitor identifier. You can change your choice at any time.
• Recognised campaign: after permission, sentr-campaign-context-v1 stores approved campaign, source, channel and creative-id values in this tab for 30 minutes. Arbitrary identifiers and search terms are discarded. Permitted context may accompany an enquiry or explicit chat handoff.
• HubSpot visit history: only after you allow it, HubSpot cookies (hubspotutk, __hstc, __hssc, __hssrc) record which SENTR pages this browser views. Nothing is linked to you unless you later submit an enquiry, chat follow-up or booking; then that page history is attached to your enquiry record in HubSpot so we can prepare. hubspotutk and __hstc last up to 13 months, __hssc 30 minutes and __hssrc the browser session. Withdrawing removes these cookies from this browser and stops further collection.
• Analytics cookies: after permission, cookies such as _ga and _ga_* distinguish browsers and sessions for measurement. Their configured lifetime is up to 180 days and can renew on subsequent consented activity. Browser restrictions may shorten it.

Consented measurement covers public-page visits, visible-page time, scroll depth, sections viewed, navigation and CTA clicks, classified external links and download requests, media progress, calculator and fit-assessment steps, operating-model choices, calendar loading, and enquiry or chat actions and delivery outcomes. Google also processes browser/device information and derives approximate location from network information. We use these reports to improve content, diagnose drop-off and understand which channels lead to enquiries.

We do not send form answers, financial calculator inputs, chat messages, emails, search text or CRM identifiers to Google Analytics. Page addresses omit query parameters and fragments; approved campaign values pass separately. For recognised search, professional-network and AI-assistant referrals, we retain only the referring service's domain, not its private path or search text. A session click or loaded calendar is not counted as a confirmed booking. Advertising, Google Signals and customer-data matching are not part of this website analytics setup.

Google Analytics event-level and user-level retention are configured to 14 months; the user-level retention period can reset with new consented activity. Standard aggregated reports may be retained longer. This is separate from the browser cookie lifetime and our 12-month inactive-enquiry review.

Use “Privacy choices” in the footer to change your decision. Declining leaves pages, chat and bookings available. Withdrawal stops further website analytics collection and clears local campaign state and accessible analytics cookies, but does not erase data already received by Google. Blocking storage may affect chat continuity or remembered choices. Third-party embeds have their own controls.

The HubSpot tracking script loads only after you allow HubSpot visit history. Without it, submissions and requested calendar loading are separate connections and no browsing history is linked to your enquiry.

7. Providers and international transfers

We share the information needed for these services:

• Netlify: hosting, server functions, security and short-lived request records. Privacy information; processing terms.
• HubSpot: enquiries, requested follow-up, tasks, scheduling, optional consented visit history and business-data enrichment, including the separate commercial-dataset use explained above. Privacy information; processing terms.
• OpenAI: generating assistant answers. Processing terms.
• Google Workspace and Meet: email, calendar and meetings. Processing terms.
• Google Analytics: optional, consented website measurement. Privacy information; processing terms.

Providers may act as processors on our instructions for service data and separately as controllers for their own account, security or legal purposes. Their notices describe those activities. Authorised people working with SENTR access information where relevant to their work. Professional advisers, authorities or courts may receive limited information where needed for advice, legal duties or protection of rights.

Providers operate internationally. Information may be processed outside the UK or EEA, including the United States; we do not promise UK-only or EU-only processing. For restricted transfers, applicable provider processing terms include safeguards such as European Commission standard contractual clauses and the UK transfer addendum. Applicable adequacy decisions may also support transfers. The mechanism depends on the provider, destination and service arrangement; a provider's location or certification alone does not cover every transfer.

Ask us for details or a copy of safeguards relevant to your information, subject to necessary confidentiality protections. Where historical records transfer to the company, we will provide any required controller-change information. The company update above does not authorise unrelated use of those records.

8. Retention

• Inactive enquiries: reviewed after 12 months without meaningful contact, then deleted or anonymised unless an ongoing relationship, legal requirement or documented, proportionate dispute/security reason justifies retention. This is a manual responsibility, not automatic HubSpot deletion.
• Active relationships and meetings: records are kept while needed to manage the relationship and follow-up, then fall under the inactive-enquiry review. Subsequent customer records follow the relevant contractual and legal arrangements, not indefinite retention of every prospect's chat.
• Browser chat: 30-minute inactivity expiry. Closing a tab normally clears session storage, although browser session-restore behaviour can vary.
• Application metadata: scheduled cleanup is configured for request/duplicate-protection records after seven days, rate-limit records after one day and AI request metadata after seven days. These are not stored transcripts. Aggregate spending counters contain no conversation content.
• Provider records: operational logs, abuse monitoring and backups may have separate retention. OpenAI's standard limits are described above. Deletion from active systems may precede backup expiry; retained backups should not be restored to ordinary use without respecting deletion requests.
• Objections and legal matters: we may keep minimum information to honour a do-not-contact request, show how a rights request was handled or meet a legal duty. Claim/security records are limited to the issue and reviewed when the reason ends.

You need not wait for a scheduled review to request deletion.

9. Security

The website uses HTTPS, server-side API credentials, validation, rate limits and duplicate-submission controls. Access to enquiries should be restricted to those who need it. No internet service can promise absolute security.

Do not send passwords, API keys, payment-card details, identity documents, special-category data, allegations about identifiable customers or production fraud datasets through public forms or chat. Ask for an agreed secure channel and appropriate processing/confidentiality terms first. Report suspected exposure to ian@sentr.io without forwarding the exposed secret.

10. Your rights and choices

Depending on the law and circumstances, you may request access, correction, deletion, restriction or portable data where portability applies. Rights concerning solely automated decisions with legal or similarly significant effects may also apply.

You can object to legitimate-interest processing because of your particular situation, and to direct marketing at any time. Consent can be withdrawn without affecting earlier lawful processing. Declining analytics or marketing does not prevent an enquiry.

Contact ian@sentr.io with enough information to locate the record. Do not send identity documents unless we explain why proportionate verification is necessary. We normally respond without undue delay and within one calendar month. Applicable law may permit extensions or exceptions; we will explain relevant reasons and timing. Requests are normally free.

Clearing chat, cancelling a booking and deleting a CRM record are different actions. Tell us what information your request concerns so we can address the relevant systems and providers.

11. Children and automated decisions

This business website is intended for adults, not directed at children. Contact us if you believe a child has provided personal information so we can consider removal.

Website fit recommendations, assistant answers and session routing are informational. They do not decide eligibility for credit, employment or another service with legal or similarly significant effects. Fraud decisions in a customer's deployment are a separate activity governed by its notices and the service arrangements.

12. Changes and complaints

We update this policy when the operator or processing materially changes and show the revision date above. Where required, we provide further notice or obtain a new choice before a materially different use. Updating a policy is not retrospective permission for unrelated marketing.

Contact Ian at ian@sentr.io or the registered office above with concerns. You can complain to a competent authority, including the UK Information Commissioner's Office. Where EU law applies, this can include the authority where you habitually live, work or believe an infringement occurred. You do not need our permission to complain.