Privacy policy
Last updated: 25 September 2026
Who I am
Giles Sales Desk is a trading name of Finley Giles, a sole trader based in England. In this policy, "I", "me" and "my" mean Finley Giles trading as Giles Sales Desk.
Contact: fin@gilessalesdesk.co.uk
Based in: Longdon, Tewkesbury, Worcestershire. A full postal address is available on request.
The two ways I handle personal data
- As a controller, for people who visit this website, contact me, or become clients. I decide how that data is used, and this policy explains it.
- As a processor, for the emails in my clients' sales inboxes. When a client connects a mailbox, I handle their customers' messages only on the client's instructions and under a written data processing agreement. The client is the controller of that data, and their customers should look at the client's own privacy notice too.
Website visitors
This website has no contact forms, no advertising and no analytics or tracking cookies. My hosting provider, Cloudflare, processes basic technical information such as IP addresses to deliver the site and protect it from attacks. The site's fonts are loaded from Google Fonts, which means your browser connects to Google's servers.
Enquiries and clients
If you email me or book a call, I use your name, email address, company, phone number (if you give it) and what you tell me, so that I can reply and discuss working together. If you become a client, I also keep contract, billing and contact details.
| Purpose | Lawful basis | How long I keep it |
|---|---|---|
| Replying to enquiries | Legitimate interests, or steps before entering a contract | Up to 2 years after our last contact, unless you become a client |
| Providing the service to clients | Performance of a contract | For the length of the contract |
| Invoices and accounts | Legal obligation | As long as HMRC requires, currently around 6 years |
I may occasionally email businesses I think could use my service. I only do this with company email addresses, I always say who I am, and every email lets you opt out. If you opt out, I keep a note of your address only so that I don't contact you again.
Client mailbox data and Google user data
To provide the service, clients connect their sales mailboxes to my software using Google's secure sign-in. I never see or store mailbox passwords. With the client's permission, the software accesses Gmail messages in the connected mailboxes so that it can:
- sort incoming sales emails into categories,
- pick out details such as order numbers,
- draft replies based on the client's own product information, prices and policies, and
- where the client allows it, send replies once I have reviewed and approved them.
Only mailboxes the client chooses to connect are accessed. A client can remove access at any time from their Google Account (Security, then Third-party connections), or by asking me.
Limited Use. Giles Sales Desk's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- Google user data is used only to provide and improve the features described above for the client who connected the mailbox.
- It is never sold, and never used for advertising.
- It is never used to develop, improve or train generalised artificial intelligence or machine learning models.
- People read it only to provide the service (I review drafted replies), with the client's agreement, for security, or where the law requires it.
Mailbox data is kept while the client uses the service, and deleted within 30 days of the mailbox being disconnected or the contract ending, unless the client asks me to delete it sooner.
Who I share data with
I use a small number of service providers to run the business. Each processes data only on my instructions.
| Provider | What for |
|---|---|
| Business email, calendar and the Gmail connection | |
| Anthropic | AI processing used to sort emails and draft replies |
| Supabase | Database for the software |
| Vercel | Hosting for the software |
| Cloudflare | Hosting for this website |
Some of these providers process data outside the UK, including in the United States. Where that happens, transfers are protected by UK-approved safeguards such as the UK Extension to the EU-US Data Privacy Framework or the International Data Transfer Addendum.
I will never sell personal data. I would only share it otherwise if the law required it.
Keeping data secure
Access to systems is protected by strong passwords and two-factor authentication, connections are encrypted, and access to client data is limited to what is needed to provide the service.
Your rights
Under UK data protection law you can ask to see the personal data I hold about you, and ask me to correct it, delete it, restrict or object to how I use it, or send it to you or someone else in a portable format. Email me at fin@gilessalesdesk.co.uk and I'll reply within one month.
If you are a customer of one of my clients, please contact that business first, as they control your data. I'll help them respond.
If you're unhappy with how I've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. I'd appreciate the chance to put things right first.
Changes to this policy
If I change this policy, I'll update the date at the top of this page. Significant changes affecting clients will be emailed to them.