sakura.

Draft — not yet in force. These documents are drafted to how Sakura works and UK law, but have not been reviewed by a solicitor and still contain unfilled details. They are not legal advice. Do not launch on them until counsel has checked them.

Privacy Policy

What personal data Sakura processes, the lawful basis for it, who it is shared with, and your rights under UK GDPR.

Who we are

Sakura is operated by [YOUR FULL NAME] trading as Sakura, a sole trader based in the United Kingdom. Contact address: [TRADING ADDRESS, incl. postcode]. Email: [support@sakurascales.com].

For data-protection matters we are registered with the Information Commissioner's Office (registration [ICO REGISTRATION NUMBER]).

Controller and processor

For personal data about you (the account holder) we are the controller.

For personal data about the people you research and contact through Sakura, you are the controller and we are your processor. We process that data only to provide the service and on your instructions. The relevant processor terms are in our Terms of Service; if you need a separate signed Data Processing Agreement, contact us.

Data we process about you

Account data: your email address, a hashed password (handled by our authentication provider), and — if you use Google sign-in — the name and profile fields Google returns. Lawful basis: performance of our contract with you.

Billing data: your Stripe customer and subscription identifiers, plan and trial status. Card details are entered directly with Stripe and are never seen or stored by us. Lawful basis: contract, and our legitimate interest in taking payment and keeping records.

Provider credentials: your Anthropic API key and any Twilio or HighLevel tokens you connect, encrypted at rest with AES-256-GCM bound to your workspace and never returned to your browser. Lawful basis: contract.

Usage and technical data: research runs, message counts, token and cost totals, audit events, and server logs (which may include IP addresses and error details). Lawful basis: our legitimate interest in operating, securing and supporting the service, and meeting legal obligations.

Data you upload about other people

When you import leads we store the business and contact details you provide, the public web pages Sakura reads for research, the facts it extracts, the messages it generates, and — where you send SMS — message content, delivery status, and consent and opt-out records.

Sakura researches only a lead's own website. It does not buy data, scrape social networks, or build profiles from multiple sources.

You must have a lawful basis under UK GDPR (or the equivalent local law) to hold and use that contact data and to message those people. See the Acceptable Use Policy.

Why we process it and what we do not do

To provide the service: authentication, storing your workspace, running research and generation, sending SMS through your connected provider, and exporting to your CRM.

To take payment, provide support, secure the service, prevent abuse and meet legal obligations.

We do not sell your data or the data you upload, we do not use it for our own marketing profiling, and it is not used to train AI models.

Sub-processors and recipients

Supabase — database, authentication and storage.

Vercel — application hosting.

Cloudflare — DNS and content delivery for the site.

Stripe — subscription billing and payment processing.

Anthropic — AI research and message generation, using the API key you provide (billed to your own Anthropic account).

Twilio and HighLevel — only if you connect them, for sending and receiving SMS and CRM export.

We may also disclose data where required by law, to enforce our terms, or to protect our rights, users or the public.

International transfers

Some sub-processors process data outside the UK, including in the United States and the EEA. Transfers are covered by UK adequacy regulations, the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, or another lawful safeguard.

Retention

Account and workspace data is kept while your account is active and deleted when you delete your account.

SMS message content and delivery records are retained for [RETENTION PERIOD, e.g. 12 months] for delivery reconciliation and compliance, then removed.

Server logs are retained for [LOG RETENTION, e.g. 30–90 days]. Encrypted backups are retained for [BACKUP RETENTION, e.g. 30 days] and then rotated out.

Your rights

You can access and export all of your workspace data at any time from Settings → Workspace → Export my data, or by contacting us.

You can permanently delete your account and all associated data from Settings → Workspace → Delete account. Deletion is immediate; residual copies in encrypted backups are removed on the normal backup rotation.

Under UK GDPR you also have rights to rectification, erasure, restriction, objection and portability, and the right not to be subject to solely automated decisions with legal or similarly significant effects. Contact us to exercise them; we will respond within one month.

If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office (ico.org.uk).

Security

Data is encrypted in transit (HTTPS) and provider credentials are encrypted at rest. Access to production systems is restricted. No system is perfectly secure. Report a suspected vulnerability to [support@sakurascales.com].

Cookies

Sakura uses only strictly necessary cookies for authentication and security. It does not use advertising or analytics cookies, so no consent banner is required. The marketing site may use minimal, privacy-preserving analytics — [confirm and describe, or delete this sentence].

Changes

We will post material changes here and update the date below. Current version: 2026-09-11. Last updated 11 September 2026.