Legal

Privacy Policy

How SalesJet (operated by Elevyn Systems) collects, uses and protects your information.

Last updated: 11 September 2026

1. Who we are

SalesJet is operated by Elevyn Systems Ltd, a private limited company registered in England & Wales under company number 16847394, with its registered office at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. We provide an AI receptionist service to salons, clinics and other appointment-based businesses to help them respond to enquiries and book appointments. When this policy says "we", "us" or "our", we mean Elevyn Systems Ltd. We are the data controller for the information described in this policy, except where we say otherwise.

For any privacy questions, contact us at admin@elevynsystems.com or 020 3488 6395.

2. What we collect

Information you provide as a SalesJet account holder

• Your name, business name, email and phone
• Your business's services, pricing, team members and brand voice
• Connection tokens for Instagram, Facebook Messenger, WhatsApp, SMS/voice and your calendar provider
• Payment details processed by Stripe (we never see your full card number)

Information about leads who contact your business

When a member of the public messages your business through a channel SalesJet handles, we process on your behalf:

• Their name, phone, email, social handle
• The content of the conversation between them and the AI
• Any booking, payment or treatment information they share

You are the data controller for these records, and SalesJet acts as your data processor. We process this data only to provide the service to you.

Information we collect automatically

• Standard log data (IP, browser, pages visited)
• Anonymous usage analytics to improve the product
• Cookies, only essential ones to keep you signed in

3. How we use it

• To run the AI receptionist, reply to enquiries and confirm bookings
• To show you analytics on your dashboard
• To bill you, support you, and notify you about your account

We never sell your data or your leads' data. We never use the content of your conversations to train third-party AI models. Anthropic's API terms explicitly prohibit using API inputs and outputs for model training without consent.

Our lawful basis for processing

Under UK GDPR we must tell you the legal ground we rely on for each kind of processing:

• Performance of a contract — running your account, providing the service, taking payment and sending you service messages about your bookings and billing.
• Legitimate interests — keeping the service secure, preventing abuse, keeping system logs, and improving the product using aggregate usage data. Our interest is operating a reliable service; we balance it against your rights and use the minimum data needed.
• Consent — any marketing email or message you have opted into. You can withdraw consent at any time, and withdrawing it does not affect processing carried out beforehand.
• Legal obligation — keeping billing records for HMRC, and responding to lawful requests.

Where a member of the public messages a business that uses SalesJet, that business decides the lawful basis for the conversation, because it is the controller of those records. We act on its instructions.

4. Who we share data with

We use trusted infrastructure partners to run the service. Each is GDPR/UK GDPR compliant and bound by a Data Processing Agreement (DPA):

• Airtable — stores lead records, conversations and account data
• Anthropic (Claude AI) — receives message content to generate AI replies; does not retain or train on this data under their API DPA
• Twilio for WhatsApp, SMS and voice calls
• Manychat for Instagram and Facebook Messenger integration
• Stripe for payments
• Railway for application hosting
• Cloudflare for website hosting, network delivery and encrypted backup storage (R2). All traffic to our sites passes through Cloudflare's network, and a nightly backup of our database is stored in it.
• SendGrid (Twilio) for transactional email. Amazon SES (AWS, EU — Ireland) is configured as a fallback sender.
• Google — our demo request form is processed through Google's Apps Script and Sheets services, and our websites load fonts from Google's font service, which receives visitors' IP addresses.

5. Your rights

Under UK GDPR you have the right to access, correct, export, restrict or delete your personal data, and to object to processing. Where we rely on consent, you can withdraw it at any time. To exercise any of these, email admin@elevynsystems.com. We will respond within one calendar month, and will tell you if a complex request means we need longer.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, if you believe we have handled your data improperly — ico.org.uk/make-a-complaint or 0303 123 1113. We would rather you came to us first so we can put it right.

If you message a business that uses SalesJet, you can opt out at any time by replying "STOP", "unsubscribe", or similar. We honour these requests automatically across every channel.

6. How long we keep data

• Account data: while your subscription is active, plus 90 days after cancellation
• Lead conversations: automatically and permanently deleted after 90 days of inactivity; you can also delete any lead manually at any time from the dashboard
• Billing records: 7 years for HMRC compliance
• System logs: 30 days rolling, no personally identifiable information retained in logs

7. Security

All traffic is encrypted in transit with TLS. Data at rest is encrypted by our infrastructure providers. Access is limited to authorised staff and audited. We use industry standard measures, no system is ever 100% secure, but we treat your data and your leads' data with the seriousness it deserves.

8. Cookies

Our public website (salesjet.co.uk) sets no cookies at all. We run no analytics, no advertising pixels and no third-party trackers on it. Because of that, we are not required to show you a cookie consent banner, and we don't.

When you sign in to the SalesJet app or the staff portal, we set a single essential cookie that keeps you signed in. It is strictly necessary to provide a service you have asked for, so it does not require consent. You can clear it at any time in your browser, which signs you out.

One thing to note: our pages load fonts from Google's font service, which means Google receives your IP address when a page loads. That is not a cookie, but we'd rather tell you than not.

9. International transfers

Some of our processors are based outside the UK and EU — including SendGrid (Twilio), Cloudflare and Google, which are US companies. Where data leaves the UK or EU, we rely on the UK International Data Transfer Addendum, Standard Contractual Clauses, or equivalent safeguards approved under UK GDPR.

10. Changes to this policy

If we make material changes, we'll email account holders and update the "Last updated" date at the top of this page. Continued use of the service after a change means you accept the new policy.