Skip to content
Samesake
Menu

Privacy notice

How we use your details when you contact us, use an account or pay for the service, and your rights.

What this notice covers

This notice covers enquiries, our contacts at customer organisations, user accounts and billing. We decide how to use those details to run our business and provide the service.

The customer records your organisation sends to Samesake for matching, or includes in a support request, are different: your organisation decides why those records are processed, and we handle them on its behalf. Our data processing agreement covers that work. For a request about those records, contact the organisation that holds them.

Who we are

This website is run by APDTECH LTD, a private limited company registered in England and Wales (company number 10270738, incorporated on 11 July 2016), whose registered office is at 183 Main Street, Yaxley, Peterborough, England, PE7 3LD. APDTECH LTD is the data controller for the enquiry, account and billing details this notice covers.

We haven't appointed a Data Protection Officer. For anything about your details, email us at hello@samesake.co.uk.

What we collect

When you get in touch

  • Your email address. On the enquiry form, we need your email address to reply. Everything else is optional.
  • If you choose to give them: your name, your company and your role.
  • When you first sent the form, when you last updated your details, and how many times you've sent it.
  • Messages and attachments you send us, and our replies.

When your organisation uses the service

  • Account details: your name, work email address, sign-in identifier, organisation, role and account dates, including your last sign-in.
  • Billing details: the billing contact, company name, billing address, VAT details where provided, subscriptions, invoices and payment records.

We need account details to give you access, and billing details to administer a paid subscription. If they aren't provided, we may be unable to create the account or take payment. When you pay through Stripe, you enter your payment details on Stripe's pages. We don't store your full card number or its security code in Samesake.

Technical information

  • The IP address used to limit enquiry submissions is held in the app's memory for up to an hour. It isn't saved with your enquiry.
  • Account identifiers, sign-in events and errors in application logs, used to run and protect the service.

We receive these details from you, your organisation's administrator, our sign-in service and our payment provider. Our hosting and email providers also process technical information, including IP addresses, to deliver and protect their services. We don't buy contact lists.

Why we use it, and on what basis

  • To reply to you and talk about Samesake with you. Legitimate interests: replying to enquiries about our product, which you've asked us to do.
  • To stop abuse of the form, using your IP address. Legitimate interests: keeping the form secure and working for everyone.
  • To provide accounts, support and service notices. Legitimate interests: delivering the service to your organisation, managing our relationship with it and protecting accounts.
  • To administer subscriptions and payments. Legitimate interests: collecting payment and managing your organisation's subscription. If you're contracting with us personally, this processing is needed to carry out that contract or take steps you've requested before entering it.
  • To keep accounting and tax records. Legal obligation: meeting our company and tax record-keeping duties.
  • To handle complaints and legal claims. Legitimate interests: resolving disputes and establishing or defending legal rights. We also use information where needed to meet a legal obligation.

We don't make automated decisions about you using these enquiry, account and billing details. Stripe explains its own payment-security checks in its privacy policy.

How long we keep it

  • Enquiry form records: 12 months after the last submission or update through the form.
  • Enquiry correspondence: 12 months after our last contact, unless it becomes part of a customer relationship or is needed for a complaint, accounting or a legal claim.
  • Account details: while needed to give you access and administer your organisation's account. Access details are removed when your administrator removes you or the organisation's account is deleted. Records of actions in the service follow the data processing agreement.
  • Sign-in profiles: Microsoft holds your sign-in profile separately from your organisation's access list. Removing access doesn't by itself delete that profile. We review profiles without access and delete them when no longer needed for account administration, security or a legal obligation. You can also ask us to close a sign-in profile you no longer need.
  • Accounting and tax records: six years from the end of the last company financial year they relate to, or longer where the law requires it.
  • Complaints and legal claims: for as long as needed to resolve the matter and meet any related legal requirements.
  • Application technical logs: 30 days. The form's in-memory IP limit expires within an hour.

Deleting information from the live database doesn't immediately remove existing backup copies. Copies in Azure database backups can remain for up to 37 days while they expire. Our email and payment providers also retain information under their own terms and legal obligations, linked below.

Who we share it with

We don't sell your details or share them for marketing. We use these providers:

  • Microsoft (Azure and Entra External ID), for the app, its database and logs, and signing users in.
  • IONOS, which provides our email service at hello@samesake.co.uk and handles correspondence on our behalf under its data processing agreement.
  • Stripe, when you use its payment pages, for payments, subscriptions and invoices. Stripe processes some information on our instructions and acts as a separate controller for purposes such as protecting payments and meeting its own legal duties. Its privacy policy explains this.

Where necessary, we may also share relevant information with banks, professional advisers such as accountants, tax authorities, regulators or others where the law requires us to do so.

Where it is stored

Your enquiry and app account details are stored by Microsoft Azure in the UK South region. Microsoft Entra External ID holds sign-in directory data in Europe. Microsoft's data protection termsinclude safeguards for transfers outside the UK, including the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.

IONOS's processing terms provide for processing in the UK or European Economic Area, with safeguards required for any necessary transfers elsewhere. Stripe processes information internationally, including in the United States. Its data transfer termsset out the safeguards, including the EU Standard Contractual Clauses and UK International Data Transfer Addendum. You can contact us for more information or a copy of the safeguards relevant to your details.

Keeping it safe

The app's database is encrypted and its connections use encryption. We limit access to people who need it to handle enquiries, provide the service, support your account or deal with billing. Administrative access uses multi-factor authentication.

Analytics

This site doesn't currently use analytics.

Your rights

You have the right to:

  • see the details we hold about you;
  • correct them if they're wrong;
  • delete them;
  • restrict how we use them;
  • object to how we use them;
  • ask for a copy in a portable format, where this right applies.

These rights depend on the circumstances. For example, we may need to retain accounting records to meet a legal obligation.

To use any of these rights, email hello@samesake.co.uk. We'll reply within one month.

Complaints

If you're unhappy with how we've handled your details, please tell us first at hello@samesake.co.uk. We'll acknowledge your complaint within 30 days and tell you what we're doing about it.

You can also complain to the Information Commissioner's Office, the UK's data protection regulator.

Changes to this notice

We'll update this notice whenever how we use your details changes.

Last updated: 27 October 2026