Legal
Privacy policy
This policy explains how miniflo collects and uses personal data, why we do it, and the rights you have. It applies to people we contact about our services, people who visit miniflo.io or get in touch with us, and the businesses we work with.
Last updated: 11 October 2026
On this page
1. Who we are
miniflo is an automation studio that sets up AI phone assistants and workflow automation for UK businesses, including estate and letting agents. miniflo is a trading name of Yash Tongaonkar, who is the controller of your personal data and responsible for it under UK data protection law.
Contact: yash@miniflo.io
Post: miniflo, Hulme Street, Manchester, United Kingdom
Phone: 07342 593726
miniflo’s co-founder, Sumedh, works from India and helps run the business, including our technical work and records.
2. What this policy covers
This policy covers personal data we handle in four situations:
Business contacts: people at businesses we think could use our services, whom we may contact by email or phone.
Website visitors: people who visit miniflo.io.
Enquiries: people who contact us by email, phone or by booking a call.
Clients: people at businesses that use our services.
When we provide an AI phone assistant to a client, the client decides how the information of the people who call them is used. For that information the client is the controller and we act on their instructions as a processor, under a written agreement. If you called one of our clients and have a question about your data, please contact that business first. We will help them answer you.
3. What we collect
Business contacts
Your name and job title, where these are published.
Your work email address and work phone number.
Your business’s name, address, website, and publicly available details about it, such as its Google rating, opening hours, the services it offers and the software it uses.
Your business’s Companies House record, such as its company number and status.
A record of our contact with you: what we sent, when, and any reply.
Enquiries and clients
Your name, job title, email address and phone number.
The details you give us when you book a call or write to us.
Notes from our calls and meetings.
For clients, billing and contract details and the information needed to set up and support our services.
Website visitors
Technical information your browser sends when you load the site, such as your IP address, browser type and the pages requested. See section 13.
We do not ask for or intentionally collect special category data, such as health information, and we do not knowingly collect data about children.
4. Where we get it
From public sources: your business’s own website, Google business listings, property portals, Companies House, and professional profiles such as LinkedIn.
From you, when you reply to us, book a call or become a client.
From the booking and email tools you use to contact us.
5. How we use it, and our lawful basis
UK data protection law requires a lawful basis for each use of personal data. Ours are:
What we do
Why
Lawful basis
Contact business contacts about services relevant to their business
To tell businesses that could benefit from our services about them
Legitimate interests
Check that a business is a limited company or LLP before we email it
To follow the rules on electronic marketing
Legal obligation and legitimate interests
Keep a do-not-contact list
So we never contact people who have asked us not to
Legal obligation and legitimate interests
Reply to enquiries and arrange calls
To answer you and discuss your needs
Legitimate interests, or steps before entering a contract
Provide, support and bill for our services
To deliver what our clients have asked for
Contract
Keep business and financial records
To meet accounting and tax requirements
Legal obligation
Keep the website and our systems secure
To protect our business and the people we deal with
Legitimate interests
Where we rely on legitimate interests, we have assessed that our interest in telling businesses about relevant services is balanced against your rights. We contact people only in their business role, about a service relevant to that role, a small number of times, and we stop as soon as anyone asks.
6. Business-to-business marketing and how to opt out
We send marketing emails only to corporate subscribers, such as limited companies and limited liability partnerships, and we check Companies House before we do. We do not send unsolicited marketing emails to sole traders or ordinary partnerships.
Each person receives no more than four emails from us about a service, and every email tells you who we are and how to stop. To opt out, reply “no thanks” or email yash@miniflo.io. We will stop the same working day.
When you opt out, we keep only your email address, the date and the reason on a do-not-contact list, so that we never contact you again. We will not then call you about the same thing.
Before we make any marketing call, we screen the number against the Telephone Preference Service and the Corporate Telephone Preference Service.
Our emails do not contain tracking pixels, and we do not track whether you open them.
7. AI tools and automated decisions
We use AI tools to help research publicly available business information and to draft emails and documents. A person at miniflo reviews and sends every email. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.
8. Who we share it with
We do not sell personal data. We share it only with service providers who help us run the business, under contracts that require them to protect it and use it only on our instructions:
Zoho: business email.
Google: document and spreadsheet storage, and website fonts.
Lovable: website hosting.
Hostinger: domain and DNS.
Calendly: meeting booking.
Anthropic: AI tools used to help research and draft.
For client services: telephony and AI voice providers that run the phone assistants we set up.
We may also share personal data with professional advisers such as accountants and lawyers, or where the law requires it.
9. International transfers
Some of our providers store or process data outside the UK, including in the European Economic Area and the United States, and our co-founder accesses our records from India.
When personal data leaves the UK we make sure it is protected to UK standards. We rely on UK adequacy regulations where they apply, such as for the European Economic Area and for US organisations certified under the UK Extension to the EU-US Data Privacy Framework. Otherwise we use the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguards we use.
10. How long we keep it
Data
How long
Business contacts who have not become clients
12 months from our last contact, then deleted
Do-not-contact list
Kept indefinitely: email address, date and reason only
Enquiries that do not lead to work
12 months from our last contact
Client records, contracts and invoices
For the length of the contract and then 6 years, for legal and tax reasons
11. How we protect it
We use business accounts with two-factor authentication, limit access to the people who need it, and use providers that encrypt data in transit. No system is completely secure, but we work to protect your data and will act quickly if anything goes wrong, including telling you and the Information Commissioner’s Office where the law requires.
12. Your rights
Under UK data protection law you have the right to:
ask for a copy of the personal data we hold about you;
ask us to correct data that is wrong or incomplete;
ask us to delete your data;
ask us to restrict how we use it;
object to how we use it, including an absolute right to object to direct marketing;
ask us to transfer data you gave us to another organisation, where this applies;
withdraw consent at any time, where we rely on consent.
To use any of these rights, email yash@miniflo.io. It is free, and we will reply within one month. We may need to confirm your identity first.
13. Cookies and the website
14. Complaints
If you are unhappy with how we have handled your data, please contact us first at yash@miniflo.io and we will try to put it right.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator:
Website: ico.org.uk/make-a-complaint
Phone: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
15. Changes to this policy
We will update this policy when how we use personal data changes. The date at the top shows when it was last updated.
Questions about your data? Email yash@miniflo.io