Last updated: 28 October 2026
This notice explains how we use information about website visitors, people who contact us and professional contacts we research for relevant business opportunities.
Who is responsible?
Smarter BI is operated by Smarter Business Intelligence LTD, a UK registered company, number 16617610. The company is responsible for the personal information described in this notice.
For a privacy question or request, use our contact form. Choose “Something else” and explain your request. You do not need an account. Pishty Agha, founder of Smarter BI, monitors these requests. We may ask for enough information to find your records and confirm your identity, but please do not send identity documents unless we request them.
You can object to direct marketing at any time
If you receive a marketing email from us, you can reply to say you do not want further marketing. You do not need to explain why or use a form. You can also use our contact form. We will stop using your information for direct marketing and keep only the information needed to respect your objection and meet any separate legal obligations.
Sending an enquiry does not subscribe you to marketing. This privacy notice does not give us permission to send marketing where consent or another requirement applies.
Information you give us
Our enquiry form asks for your name, email address, topic and message. Your company name is optional. We store the enquiry in a private WordPress inbox, together with its submission time and notification status. We also receive and retain correspondence needed to deal with your question or business relationship.
A notification containing the enquiry is sent through Mailgun to our business mailbox. An enquiry can remain saved in the website inbox even if the notification fails. Please avoid sending passwords, confidential customer records or sensitive personal information.
Professional contacts and sources
For business research, we use relevant professional names, roles, organisations, business email addresses and public information about an organisation’s work. We record where information came from, why a service might be relevant, correspondence, draft messages and any objections or restrictions on contact.
Sources include information you provide, official organisation websites and their public professional material, and Apollo’s business-contact service where used. A public address is not evidence of consent. A departmental address is not treated as proof that a named person is the decision-maker.
We currently use Apollo for contact research and saved drafts. Preparing a draft does not mean we have sent it. Before contacting someone using indirectly obtained personal information, we must provide the required privacy information within the applicable time limit—normally no later than the first communication, or within one month of obtaining the information if that comes first.
Why we use information and our lawful bases
Enquiries and business correspondence: our legitimate interests in answering questions, maintaining business relationships and providing useful services. Where you are personally a party to a proposed or existing contract, we may need the information to take steps you request before a contract or to perform it.
Relevant business research and limited prospecting: our legitimate interests in identifying organisations that may benefit from our software or research services and considering relevant business conversations. We consider relevance, reasonable expectations and potential impact. This is not a blanket justification for contacting anyone whose details are public. Electronic-marketing rules and objections must also be respected. Our prospecting assessment and launch checks remain separate from publication of this notice.
Privacy requests and objections: meeting our applicable data-protection obligations. We retain minimal suppression information to honour objections and prevent renewed marketing contact.
Security and administration: our legitimate interests in protecting the website, preventing abuse and keeping appropriate business records, and legal obligations where particular records must be kept.
Analytics: measuring use of the website through Google Analytics, as described below. An enquiry does not subscribe you to marketing.
Website analytics and technical information
Google Analytics is our current website tracking service. It processes information about visits and interactions, such as pages viewed, referrals and browser or device information, and can use cookies and identifiers. Our code disables Google Signals and advertising-personalisation signals; this does not make all analytics information anonymous.
You can use browser controls or Google’s Analytics opt-out browser add-on to limit analytics collection.
After Mailgun accepts an enquiry notification, our analytics integration can count a submission event. That custom event contains a fixed form identifier, not your submitted name, email or message. A short-lived receipt cookie on the contact page helps avoid counting the same confirmation again; it expires after five minutes and is cleared when consumed. Standard Analytics visit information can still accompany the event.
The website also processes technical information needed to serve requests and protect the site. Our form uses an IP-derived security fingerprint for rate limiting. Hosting and security systems can process request and connection information; this is separate from marketing tracking.
Services that handle information
Our current services include:
- DigitalOcean: hosting the WordPress website and its enquiry records.
- Mailgun: delivering enquiry notifications.
- Google email services: business correspondence; and Google Analytics: website measurement.
- Apollo: professional-contact information, saved contact records and email drafts.
- HubSpot: connected email/calendar and correspondence records. Account settings allow inbox automation and creation of contacts from logged emails. An imported contact is not automatically a prospect or marketing subscriber.
- AI-assisted research and drafting tools: helping review business information and prepare correspondence, with human review rather than an unattended campaign sender.
Records also exist in restricted working files and backups. Providers’ roles depend on the service and purpose; not every provider acts only on our instructions. For example, Apollo also maintains its own business-information service. A supplier introduction requires your separate approval of the recipient and information to be shared.
Processing outside the UK
Our providers operate internationally, and using them can involve processing outside the UK. We do not promise UK-only storage. Providers’ published documentation describes contractual and other transfer safeguards, but the applicable arrangement depends on the service, contracting entity and destination.
We are still checking the account-specific transfer documentation and cannot yet give a complete account-by-account safeguards statement. This is an outstanding review, not a claim that every transfer has been verified. You can ask about processing locations and safeguards through our contact form.
Relevant provider information includes DigitalOcean’s data-processing agreement, HubSpot’s data-processing agreement, Apollo’s privacy policy and Google’s privacy policy. These explain providers’ practices; links alone do not establish which terms apply to our accounts.
How long we keep information
We keep information according to its purpose and review whether it remains needed. Our review policy is:
- Uncontacted prospect research: review within six months of collection and remove information without a current, documented business purpose. Remove irrelevant records sooner.
- Unanswered outreach: remove unnecessary prospect records twelve months after the last message.
- Closed enquiries and non-client correspondence: normally remove after twenty-four months from closure.
- Marketing objections: retain the minimum identifier and objection details needed while we continue relevant marketing, with an annual necessity review, so we do not contact you again by mistake.
These are manual review and removal rules, not a claim that every system has automatic deletion. A specific legal obligation or dispute may require limited information to be kept longer. Active client/project records are assessed separately according to the relationship and applicable obligations. Backups and provider-held copies may not disappear immediately when a working record is deleted; their separate expiry arrangements remain under review.
Google Analytics was configured with fourteen-month event and user-data retention, with reset on new activity enabled. That setting does not apply to all aggregate reports or to our enquiry, correspondence and security records.
Your rights
Depending on the circumstances, you can ask to access your personal information, correct it, delete it, restrict its use or receive a portable copy. You can object to processing based on legitimate interests. The right to object to direct marketing applies at any time. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.
Use the contact form for a request, or reply directly to a marketing email to object. We normally respond to rights requests within one month. If an applicable extension is needed, we will explain why. Some rights have legal limits, which we will explain rather than promise unconditional deletion.
Business research and drafting are reviewed by a person. Our current outreach workflow does not make solely automated decisions producing legal or similarly significant effects on you. Routine security controls and provider account automation are separate from that workflow.
Complaints and changes
You can raise a concern through our contact form. You also have the right to complain to the UK Information Commissioner’s Office; you do not have to contact us first.
We will update this notice when our practices change. The date at the top shows when it was last updated.