1Who we are
EdenFlow AI is a trading name of Peter Eden, a sole trader based in Portsmouth. We build AI assistants, websites and workflow automation for small businesses in the UK.
For the data described in this notice, Peter Eden is the data controller. There is no separate company — EdenFlow AI is not a limited company, and any contract you enter is with Peter Eden personally.
Peter Eden, trading as EdenFlow AI
33 Sunningdale Road, Portsmouth, PO3 6EX, United Kingdom
Email: contact@edenflowai.uk
WhatsApp: 07434 170017
2Two different roles
This distinction matters, because it decides who you should contact about your data.
When we are the controller
For people who contact us — visitors to this website, people who use the demo assistant, businesses we approach, and our own clients — we decide how the data is used, so we are the controller. This notice covers that data, and you can contact us directly about it.
When we are only the processor
Our clients are small businesses who use our AI assistants to talk to their customers. If you messaged a plumber, a salon or a sealant contractor and an assistant we built replied, then that business is the controller and we are only the processor. We handle that data strictly on their written instructions, under a contract required by Article 28 of the UK GDPR.
If you are a customer of one of our clients and want to see, correct or delete your data, contact that business directly — they decide, not us. If you are not sure who they are, email us and we will point you to the right place.
3What we collect and why
We only collect what we actually need. Every use below has a lawful basis under Article 6 of the UK GDPR.
| What | Why | Lawful basis |
|---|---|---|
| Messages you send the assistant on this site — your name, contact details and whatever you tell it about the job or enquiry | To answer your question, give you a price and book you in | Steps prior to a contract, and our legitimate interest in responding to enquiries |
| Booking details — name, email, phone, the slot you chose | To hold the appointment and send confirmations and reminders | Steps prior to a contract |
| Business contact details — business name, trading name, phone number, sector, town | To introduce our service to businesses we think it suits | Legitimate interests (see section 4) |
| Client records — contact details, what we built, invoices and payments | To deliver and support the service, take payment and keep tax records | Contract, and legal obligation for the accounting records |
| Technical data — IP address, browser type, pages viewed | To keep the site working, secure and free of abuse | Legitimate interests |
| Advertising and analytics data | To measure and improve our advertising, if and when we enable it | Your consent, which you can withdraw at any time |
We do not knowingly collect data about children, and we do not collect special category data (health, beliefs, biometrics and so on). Please do not send it to the assistant.
The assistant is an AI. What you type into it is processed by a third-party AI model to generate a reply (see section 5). Do not put anything into it that you would not want processed that way — and it will tell you it is an AI if you ask.
4Where we get your data
Most of the time you give it to us directly, by messaging the assistant, booking a call or emailing us.
If we contacted you first
We sometimes approach small businesses we think would benefit from what we build. In that case we did not get your details from you, so the UK GDPR requires us to tell you where they came from.
We use business contact details — the business name, a publicly listed contact number, the sector and the town — compiled from publicly available business listings and directories using a lead-research tool. We do not buy marketing lists of private individuals, and we do not collect personal details beyond what a business publishes to be contacted on.
Our lawful basis is legitimate interests: promoting a relevant service to a business that may want it. We have weighed that against your interests, which is why we send a short message, only to businesses in sectors we actually serve, and only once unless you reply.
You can stop it immediately. Reply STOP to any message, or email contact@edenflowai.uk, and we will remove you and not contact you again. You also have an absolute right to object to direct marketing — see section 9.
6Data outside the UK
Some of the providers above are based outside the UK, mainly in the United States. That includes OpenAI, Meta, Stripe, Cloudflare and Google.
Where personal data is transferred out of the UK, we rely on the safeguards required by Chapter V of the UK GDPR — either an adequacy decision, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, as incorporated into each provider's terms.
7How long we keep it
| Data | Kept for |
|---|---|
| Enquiries that did not become work | 24 months from your last contact with us |
| Business contact details used for outreach | Until you ask us to stop, or 12 months with no reply — whichever is sooner. If you opt out we keep only enough to make sure we do not contact you again |
| Client records and correspondence | 6 years after the work ends |
| Invoices, payments and accounting records | At least 5 years after the 31 January filing deadline for the relevant tax year, as HMRC requires |
| Website technical logs | Up to 12 months |
When a retention period ends we delete the data or anonymise it so it can no longer identify you.
9Your rights
Under the UK GDPR you have the right to:
- Be informed about how we use your data — that is what this notice is for
- Access a copy of the personal data we hold about you
- Rectification — have inaccurate data corrected
- Erasure — have your data deleted, where we have no overriding reason to keep it
- Restrict how we use your data while a concern is resolved
- Data portability — receive data you gave us in a reusable format
- Object to processing based on legitimate interests
- Object to direct marketing at any time — this one is absolute, and we must stop
- Withdraw consent where we relied on it, without affecting what came before
Email contact@edenflowai.uk and we will respond within one month. It costs you nothing. We may ask you to confirm who you are first, so we do not hand your data to someone else.
Remember section 2: if your data reached us through one of our clients' assistants, that business is the controller and the request goes to them. We will help them answer it.
10Complaints
Please come to us first — most things are a misunderstanding we can fix quickly.
If you are not satisfied, you have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. Complaining to us first does not affect that right.
11Changes to this notice
We update this notice when what we do with data changes. The version number and date at the top always tell you which version you are reading. If a change materially affects you, we will tell the people concerned directly rather than relying on you to re-read the page.