Privacy Policy

Last updated: 4 October 2026

Who we are

Ishigai Ltd ("Ishigai", "we") is an AI consultancy registered in England and Wales, company number 17360069, registered office 2 Jubilee Avenue, UK, NR20 4AS. We are the data controller for personal information collected through this website, ishigai.io. Contact: hello@ishigai.io.

What we collect

This website is intentionally minimal. We collect personal information only when you choose to give it to us:

• Email correspondence: if you email us, we hold your name, email address, and the contents of your message.
• Discovery-call bookings: bookings are handled by Cal.com, which collects your name, email address, and any notes you add. Their processing is covered by the Cal.com privacy policy.
• Technical logs: our hosting and network providers (Hostinger, Cloudflare) record standard server logs, including IP addresses, for security and reliability.

We do not run analytics trackers, advertising pixels, or marketing cookies on this site, and we do not buy contact lists.

Why we process it

• To respond to your enquiry and hold discovery calls: our legitimate interest in operating the business, and steps taken at your request before entering a contract.
• To deliver services under a signed engagement: performance of a contract.
• To keep the website secure: our legitimate interest in protecting our systems.

Who we share it with

We do not sell personal information. We share it only with the service providers needed to run the business: hosting (Hostinger), network security (Cloudflare), database hosting (Supabase, in the EU), scheduling (Cal.com), and email, each acting under their own data-processing terms.

How long we keep it

Enquiry correspondence is kept for as long as needed to handle the enquiry and for up to two years afterwards, unless it becomes part of a client engagement, in which case records are kept for the duration of the engagement plus six years (in line with UK contractual limitation periods).

FlowScan

FlowScan is our free tool that looks for repetitive admin in a Google or Microsoft work account. It only touches your data if you choose to connect your account to it. This section covers exactly what it does.

FlowScan has read-only access. It cannot send email, edit files or change spreadsheets. From the last 30 days it reads:

• Gmail: for emails that have attachments, the attachment file names and types, the sender's address and the subject line. It never downloads the text of your emails or the contents of attachments.
• Google Drive: the names, types and creation dates of new files, and how many times you've edited each spreadsheet.
• Google Sheets: the rows of recently edited spreadsheets (up to 5 tabs and 200 rows each), so it can spot the same data typed into two sheets. Rows are compared as one-way fingerprints during the scan and never stored.
• Microsoft 365 or Outlook: the same things from Outlook, OneDrive and Excel. For emails with attachments, the attachment names and types, the sender's address and the subject line, never the text or the attachment contents. From OneDrive, the names and dates of new files, how many times you've saved each Excel workbook, and (for business accounts) the rows of recently edited workbooks, compared as one-way fingerprints and never stored.

All of that raw data is held in memory while the scan runs and thrown away when it finishes. What we keep is:

• Your Google account name and email address, so we know whose results are whose.
• Your Google access tokens, encrypted, so you can scan again without reconnecting.
• The summary you see on screen: counts, estimated costs and a few examples, which can include file names, sender domains (such as supplier.co.uk) and spreadsheet names.
• If you ask us to build an automation, that request and any note you add.

We use this to produce your report, at your request (steps taken at your request before entering a contract). We only contact you about your results if you tick the box allowing us to, or if you ask us to build something (your consent).

We don't sell FlowScan data, use it for advertising, or use it to train AI models. Nobody at Ishigai looks at it unless you ask us to build an automation, you ask for help, or we have to for security or legal reasons. It's stored with Supabase in the EU and processed on our own server.

Ishigai FlowScan's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

FlowScan data is deleted automatically six months after your last scan, unless we're building an automation for you at the time. You can delete everything sooner with the "Disconnect and delete my data" button in FlowScan, which deletes our access tokens and, for Google, also removes our access to your account. You can remove our access yourself at any time at myaccount.google.com/permissions (Google), myapps.microsoft.com (Microsoft work accounts) or account.live.com/consent/Manage (personal Outlook accounts), or email hello@ishigai.io and we'll do it for you.

Your rights

Under UK GDPR you can ask us to access, correct, delete, or restrict the personal information we hold about you, object to our processing, or ask for a copy in a portable format. Email hello@ishigai.io and we will respond within one month.

If you are unhappy with how we handle your information, you can complain to the Information Commissioner's Office at ico.org.uk.

Changes

We will post any changes to this policy on this page and update the date at the top.

← Back to ishigai.io