Privacy Policy
Last updated: 9 October 2026
The short version
- We are CaanDoIt, a trading name of Caan Consultancy Ltd.
- We collect your name, email and message when you contact us, and use them to reply and to book your free audit.
- We receive and store enquiries in a mailbox hosted by Google (Google Workspace).
- The “Get started” form on a package card also saves your details in our website database.
- The AI advisor sends your task description through Lovable AI Gateway to OpenAI. Use general examples, not personal or confidential information.
- We don't sell your data and we don't use it for advertising.
- You can ask to see, correct or delete your data at any time by emailing hello@caandoit.com.
- If you're unhappy, you can complain to the ICO.
The rest explains this in detail.
1. Who we are
CaanDoIt™ is a trading name of CAAN CONSULTANCY LIMITED, registered in England & Wales, company number 09178365, registered office: Lytchett House, 13 Freeland Park, Wareham Road, Poole BH16 6FA, United Kingdom. We are the "controller" of the personal data described here. Contact us at hello@caandoit.com.
VAT No. GB 521 8618 93.
Post sent to our registered office may take longer to reach us, so email is the quickest way to get in touch.
What we collect and why
| What | Why | Lawful basis |
|---|---|---|
| Contact details and enquiry or audit information | To answer general enquiries and help company representatives | Legitimate interests in responding to business enquiries and arranging services |
| Information for a contract with you personally, including sole traders | To take steps you request before a contract and deliver an agreed service | Steps before a contract, or performance of that contract |
| Company representatives' details and service correspondence | To manage services supplied to their company | Legitimate interests in managing business relationships |
| Invoice, transaction and accounting records | To meet applicable tax and accounting duties | Legal obligation for records those laws require |
| Your AI advisor task description and generated suggestion | To provide the automation idea you request | Legitimate interests in providing optional business guidance; use non-identifying examples |
| Technical request information, such as IP address, browser details and requested pages | To deliver and protect the website, including loading fonts | Legitimate interests in operating a working, secure website |
We only collect what we need for these purposes. "Legitimate interests" here means our interest in answering your enquiry and running our business, balanced against your rights. You don't have to give us your details, but without them we can't reply to you or provide our service.
If you message us on WhatsApp, we also receive your phone number and WhatsApp profile name, and WhatsApp (Meta) processes that message under its own terms. If you follow our LinkedIn link, LinkedIn processes your visit and any message under its own privacy notice.
Contact form and email
When you submit the contact form, your name, email and message are sent to us as an email to hello@caandoit.com. Delivery runs through Lovable's managed email service (sent from the notify.caandoit.com subdomain), and the message lands in our hello@caandoit.com mailbox, which is hosted by Google (Google Workspace). The form does not save your message to a website database; once delivered, it is held in that Google-hosted mailbox, where Google stores it as part of providing our email service. Please do not include customer records, sensitive information or passwords in an enquiry.
“Get started” enquiry form
When you use a “Get started” button on a package card, we save what you type — your name, email, business name, the problem you describe, the tools you mention, the package you chose and the date — in a database held by our hosting provider (Lovable Cloud). Only CaanDoIt staff accounts can read those records; they are not shown to other visitors. We then email you a confirmation and send ourselves a copy, so the same details also sit in our Google-hosted mailbox. We don't store anything beyond what you type into the form.
We limit how often the form can be used. To prevent abuse, we keep a short-lived, scrambled (hashed) version of your network address for up to 24 hours, plus overall usage totals. We don't link this to what you type.
AI automation advisor — “What could you automate?”
When you select “Get my recommendation”, your description is sent to our hosting service and through Lovable AI Gateway to OpenAI GPT-6 Astra (model identifier: openai/gpt-6-astra) to produce an automation suggestion. The description and response are processed by those services. No name or email is required. Please describe the task generally: do not enter identifiable customer information, health or other sensitive data, confidential records, passwords or payment details.
This feature does not deliberately save descriptions or recommendations to an application database. Lovable AI Gateway lists this model and endpoint as zero data retention, meaning the AI provider does not keep your description after producing the response. Hosting and gateway services may still process short-lived technical logs (such as timings and usage totals). We do not promise UK-only processing. You can choose to contact us instead of using the AI advisor.
The current tool calls Lovable AI Gateway directly from our website's server, not through the suggest-automation edge function. The gateway endpoint is https://ai.gateway.lovable.dev/v1/chat/completions. We have not verified the country or region where the gateway and model process this data.
- We limit how often the tool can be used: up to 5 requests per visitor per hour, and 200 per day across the whole site (plus a site-wide cap of 40 per hour). To prevent abuse, we keep a short-lived, scrambled (hashed) version of your network address, a request count, a window start time and an expiry time, plus overall usage totals. Visitor and hourly counters expire at the end of the hour (within one hour); daily totals expire at midnight UTC (within 24 hours). Expired records are deleted on the next counter request or by a scheduled hourly cleanup, so expiry is not a guarantee of immediate deletion. We don't link this to what you type.
CaanAssist launch notifications
The “Notify Me at Launch” email box is currently inactive: its button does not submit your email, and we do not receive or save it through that box. There is no launch mailing list collected by this form, no retention period for submitted addresses and no subscription to unsubscribe from. Before activating it, we will explain its launch-only purpose, retention period and how to unsubscribe.
When we build automations for you
If we build an automation that handles your customers' details, such as names, contact details, and appointment or invoice information, you are normally the controller and we act on your instructions as your processor.
Every build includes a basic data-handling review that looks at what personal data is involved, which tools handle it, and basic UK GDPR points. It is a practical check, not a formal DPIA or legal advice. A review does not replace a required controller–processor agreement or a formal DPIA where the processing is likely to create a high risk. Before handling customer data on your behalf, the arrangements need to cover your instructions, confidentiality, security, approved subprocessors, assistance with rights and incidents, and return or deletion of the data.
Who we share data with
We don't sell your data. We share it only with providers that help us run the business, such as Google, which hosts our email, and Lovable, which hosts this website. We also share it if the law requires it, for example with HMRC or a court.
Our email provider is Google (Google Workspace): hello@caandoit.com is a Google-hosted mailbox, and Google receives and stores the enquiries that arrive there. Enquiry emails from the website are delivered by Lovable's managed email service, whose sender records for notify.caandoit.com authorise Mailgun to send on our behalf. The AI advisor uses Lovable AI Gateway and OpenAI. Fonts load from Google Fonts, so your browser sends Google information such as your IP address and request headers when fetching them. WhatsApp/Meta and LinkedIn handle visits or messages when you choose their links. “Get started” enquiry records are held by our hosting provider (Lovable Cloud), which stores the website database. Our accounting and other business providers are still being confirmed; contact us for information relevant to your enquiry.
How long we keep it
- Enquiries and audit correspondence, held in our Google-hosted mailbox: retention depends on whether the enquiry continues, the purpose of the correspondence and any dispute. A specific deletion period has not yet been confirmed.
- “Get started” enquiry records in our website database: kept while we decide whether to work together and resolve any question about your enquiry. A specific deletion period has not yet been confirmed.
- Service records: retention depends on the work, contractual requirements and any applicable legal claims; these are not automatically all accounting records.
- Invoices and statutory accounting records: the applicable tax and company-record rules determine the period and its starting date, rather than a blanket period after the work ends.
- Hosting and AI request logs: provider retention periods are still being verified.
Our detailed retention schedule is being confirmed. We have removed previously stated periods that were not verified. Contact us about a specific record or to request deletion; some records may need to be retained for legal reasons.
Transfers outside the UK
Our email provider (Google), website hosting and AI services (Lovable), fonts (Google Fonts) and messaging services may process information outside the UK. The countries and transfer arrangements for each provider still need verification. A lawful restricted transfer needs an applicable UK adequacy arrangement or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum, and any required assessment. We are not claiming that these checks are complete. Contact us to ask about a provider or the arrangements relevant to your data.
Automated decisions
The AI advisor produces an automated suggestion, not a decision with legal or similarly significant effects. Its output is not reviewed by a person before it appears. It may be inaccurate; a discussion with us is needed before deciding on an automation or service.
Your rights
You can ask us to:
- Give you a copy of your data
- Correct anything that's wrong
- Delete your data
- Limit how we use it
- Object to our use of it
- Move it to another provider
These rights depend on the purpose and lawful basis, and are not absolute. For example, deletion may not apply to records we must keep by law, and portability applies only in certain circumstances. You can object to processing based on legitimate interests. If we rely on consent, you can withdraw it without affecting earlier lawful processing.
Email hello@caandoit.com. We normally respond without undue delay and within one month. Where the law allows extra time for a complex request or multiple requests, we will explain the reason and extension within the initial period. Requests are normally free; legal exceptions can apply. We may need proportionate information to confirm your identity.
Security
Appropriate technical and organisational security is required for the information we handle. This notice does not certify particular access controls or two-step login practices; those arrangements still need confirmation. No system is perfectly secure. A personal-data breach must be assessed and reported to the ICO and affected individuals where the law requires, including the applicable notification deadlines.
Cookies and similar storage
The website uses browser session storage to restore your position when navigating. We have not added advertising or analytics scripts to the application. Published hosting may have its own technical storage or logging, which still needs checking. There is no cookie-choice panel on the site, and we do not claim one is available. Before introducing tracking or other storage that requires consent, an appropriate choice must be provided. Your browser settings can manage cookies and site storage, although blocking necessary storage can affect how a website works.
Complaints
To make a privacy complaint, email hello@caandoit.com with “Privacy complaint” in the subject. We will acknowledge it within 30 days, investigate and respond without undue delay, keeping you informed where needed. You do not have to contact us before approaching the ICO. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes
If we change this policy, we'll update the date at the top and tell you about any big changes.