Privacy Policy

This policy explains how Pental Limited collects, uses and shares personal data when you visit pental.io, register an account, subscribe to the Platform, or use a portal a Pental customer hosts. It is written to meet the UK GDPR and the Data Protection Act 2018, the EU GDPR, and equivalent frameworks elsewhere.

Who we are

Pental Limited is registered in England and Wales (company number 17172077) at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF. For privacy enquiries or data subject requests, email hello@pental.io.

Controller or processor

If you are an End Client using a portal operated by a testing firm, that firm controls your data. Your requests should go to them; we will support them in responding.

What we collect as controller

• Account. Name, work email address, company name, and the role you hold on the account.
• Subscription. Plan, term, status, renewal dates and plan limits.
• Billing. A customer reference held with our payment processor, together with the billing address and tax details you supply. We never see or store full card numbers.
• Domain routing. The subdomain or custom domain you use, and its DNS status, so requests reach your portal.
• Correspondence. What you send us by email or through the contact form, and our replies.
• Demo bookings. When you book a live demo, the time you chose, your name, work email and company, and anything you tell us you would like to see.
• LinkedIn advert forms. If you send us a form on a LinkedIn advert, what you entered in it, which LinkedIn passes to us, and which advert it was on.
• Plan usage. Two numbers and a date: how many internal users and how many client records exist in your Platform instance, and when they were last counted. Not who they are, not what they are called, not what they contain.
• Website telemetry. Standard server logs for pental.io, including IP address, user agent and requested path, used for security and diagnostics.
• Where you came from. If you reach pental.io from an advert or a campaign link, the campaign on that link, the page you landed on and the site that referred you, saved with your account or enquiry when you create one. If you came from a Google or LinkedIn advert, that platform is told about your sign-up, as described under adverts, and what we tell the platforms.

Why we process it, and on what basis

The emails we send, and unsubscribing

Emails about your account itself go whatever you choose, because the service needs them: sign-in codes, confirmation of changes to your subscription, security notices and notices about your portal. Three kinds of email are optional, and you can stop each of them on its own:

• Product news and offers about Pental, sent to customers.
• Reminders before a free trial ends, while no payment method is on the account.
• Admin notifications, which go only to Pental's own staff and the addresses they list.

Every optional email has an unsubscribe link at its foot and carries a List-Unsubscribe header, so the Unsubscribe button your mail app shows works too. Unsubscribing needs no sign-in and takes effect at once: the next email of that kind is checked against it before it is sent. Customers can also change each one under Email Preferences in their account dashboard, and anyone can email hello@pental.io and we will take them off.

We keep a record of what you chose, when and how, so that a no is honoured for as long as we might otherwise email you. That record holds your address only as a one-way SHA-256 hash, not the address itself. Our emails carry no tracking pixels and no link tracking, and every one of them names Pental Limited with its registered number and office.

Sub-processors and third parties

These are the third parties involved in running Pental. Each is engaged under terms requiring appropriate safeguards.

If you configure an AI provider or an email relay, those are your arrangements, made on your keys and governed by your agreement with that provider. They are not our sub-processors, and the traffic does not pass through us.

Adverts, and what we tell the platforms

No advertising or analytics script runs on pental.io, and nothing is stored on your device to follow you around the web. When you arrive from an advert, the parameters on its link travel in the page address while you browse, and if you create an account or send an enquiry we keep the campaign with it.

If that link came from a Google or LinkedIn advert, our server, never your browser, tells that platform when your account starts a trial, finishes setup, adds a card during the trial or makes its first payment, and when an enquiry is sent or a demo is booked. It sends:

• the click identifier from the advert's own link, which we delete after 90 days;
• a SHA-256 hash of the account email address, which the platform can match against its own accounts but cannot turn back into the address;
• what happened and when, with the monthly list price of the chosen plan for a trial, setup or card, and, for a first payment, a year of what your subscription is charged at.

We do this on the basis of our legitimate interest in knowing which adverts bring firms to Pental. Nothing goes to a platform whose advert you did not click, and Google is told the information may not be used to personalise advertising. You can opt out at any time: switch off Advert Measurement under your account on pental.io, or email hello@pental.io. Anything still waiting is then never sent; anything already sent is held by that platform under its own terms.

Some LinkedIn adverts carry a form of LinkedIn's own, for instance to receive a checklist. If you send one, LinkedIn passes us what you entered: usually your name, work email, company and job title, and your answer to any question on the form. We keep it as an enquiry, reply to it, and delete it on request. If you then create an account, book a demo or send an enquiry from that email address, it counts as coming from that advert, and LinkedIn is told as described above, using the reference of the form you sent as well as the hash of your email address. The same opt-out applies.

We also give Google and LinkedIn a list of the email addresses of firms with a Pental account, for the single purpose of telling those platforms not to show them our adverts. The platform converts each address to a hash on upload and uses it only to match against its own accounts. The basis is the same legitimate interest, and the interest runs both ways: nobody wants to be advertised a product they already pay for. The same switch controls it. If you switch off Advert Measurement, we leave you off that list as well, which means we can no longer stop our adverts being shown to you.

Connecting a Google or Microsoft mailbox

Pental can send your firm's email through your own mailbox, so that a report notification reaches your client from your address rather than ours. Connecting a mailbox is optional and nothing here applies until you choose to do it.

When you connect a Google account, Pental asks Google for one permission that touches your mail: https://www.googleapis.com/auth/gmail.send. It also asks for openid, email and profile, which tell us which account was connected so we can show it to you and send from the right one.

• What we do with it. The gmail.send permission is used for one thing: sending the emails you or your workflow ask Pental to send, from your account, at the moment you send them.
• What we cannot do with it. gmail.send does not grant the ability to read, search, download, modify or delete anything in your mailbox, and Pental requests no scope that would. We never read your mail.
• What we store. The OAuth refresh and access tokens, the address the account sends from, and the display name. Tokens are held in your own Supabase project, under your account, encrypted at rest by Supabase. We do not store the contents of messages you send; they go to Google's API and are kept in your own Sent folder by Google, not by us.
• Who we share it with. Nobody. Google user data obtained through these scopes is not sold, not used for advertising, not used to train any model, and not passed to any third party. It is not used for any purpose other than sending the email you asked for.
• How to end it. Disconnect the mailbox in Pental, which deletes the stored tokens, or revoke Pental's access directly at myaccount.google.com/permissions. Either one stops it immediately.

Pental's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Connecting a Microsoft 365 mailbox works the same way and on the same terms, through the Microsoft Graph Mail.Send permission. Signing in to Pental with Google or Microsoft is separate again: that asks only for openid, email and profile, and touches no mailbox at all.

International transfers

Your Postgres project sits in the region you chose when you created it. Our own account records are held in the UK or EEA. Where a provider processes data outside the UK or EEA, transfers rely on adequacy decisions or on standard contractual clauses with supplementary measures.

Retention

• Account and subscription records: for the life of the account, then up to 12 months.
• Financial records: six years, as required by UK tax law.
• Support correspondence: up to 24 months.
• Demo bookings: deleted 24 months after the demo.
• Plan usage figures: the latest count only. Each report overwrites the one before it, so there is no history to keep, and the figures are deleted with the account.
• Server logs: up to 90 days.
• Where you came from: with the account or enquiry it belongs to, and deleted with it. A record that a sign-up or payment happened, with its campaign and nothing identifying you, is kept to measure marketing over time. An advert's click identifier is deleted after 90 days.
• Email choices: what you chose for each kind of optional email, when and how, held against a one-way hash of your address for as long as we might email you, so that an unsubscribe is always honoured.
• Your engagement data: retained by you, in your database, on whatever schedule you set. We cannot delete it and do not hold a copy.

Security

Measures we apply to the systems we do operate, and that the Platform applies inside your database:

• TLS 1.2 or higher on every endpoint, with certificates issued and renewed automatically.
• Row-level security policies evaluated by Postgres on every query against your data.
• Multi-factor authentication required before the portal opens, with data access gated on a recent second-factor check rather than on enrolment alone.
• Secrets such as mail credentials and provider API keys encrypted on write inside your own database, using a key generated in that same database, with the plaintext column nulled.
• Passwords hashed, never encrypted or stored recoverably; reset tokens stored only as hashes and single use.
• Least privilege on internal access, and multi-factor authentication on Pental staff accounts.
• A documented incident response procedure, and periodic review of the Platform by the people who wrote it, who test systems of this kind professionally.

No system is perfectly secure and we do not claim otherwise. What we can say precisely is which data would be exposed by a compromise of our systems, and the answer is the account list above.

Your rights

Where we are the controller you may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. You can object to marketing, or withdraw consent to it, at any time and without giving a reason: use the link in any of those emails, your account dashboard, or email hello@pental.io. For anything else, email us and we will respond within one month.

You may complain to the UK's data protection regulator (ico.org.uk) or to your local supervisory authority. We would rather you told us first.

Cookies

pental.io sets a small number of cookies and local storage entries, all functional. They are listed in the Cookie Policy.

Children

The Platform is a business tool sold to companies and is not directed at children. We do not knowingly collect personal data from anyone under 16.

Changes

We may update this policy. Material changes will be notified by email or in the Platform before they take effect, and the date at the top of this page always reflects the current version.