Draft pending factual and legal review
This draft has not been approved by a solicitor, and Sentinel holds no GDPR or other certification. Items marked "to be confirmed" are still open. Public launch waits for this review.
Privacy
How Sentinel handles personal data
Draft dated 24 September 2026
Who we are
Sentinel by Noahsure is run by NOAHSURE GROUP LIMITED ("Noahsure", "we"). We decide how your account and security data is used for our own purposes (we are the controller). When you tell an agent to research, rewrite, read a page or phone someone, we act on your instructions. The roles for this work, and any data processing terms for business customers, are To be confirmed: controller/processor split and contract.
What we hold, why and on what legal basis
The legal bases below are proposals that still need legal review.
| Data | Purpose | Basis |
|---|---|---|
| Account: email, optional name, sign-in method (email/password or Google) | Create and secure your account | Contract (proposed) |
| Tasks and prompts you type, agent plans, steps, answers and sources | Run the agents you ask for | Contract; carried out at your direction |
| Page text, title and web address the browser plugin sends when you tick "use this page" or select text | Let an agent work on the page you chose | Contract; at your direction |
| Named agents, skill settings, limits, blocked sites and numbers, kill switch state | Apply your controls to every step | Contract |
| Approvals and refusals, blocked steps, injection flags, rule that decided each step | Security, abuse prevention, your audit trail | Legitimate interests in keeping the service safe (proposed) |
| Phone calls: number called, goal, scheduled time, status, duration, text transcript of both sides, AI summary | Place calls you ask a caller agent to make and show you the result | Contract, at your direction. You need a lawful reason to call the person |
| Agent memory: notes you save (preferences, facts), short summaries of finished tasks and clean calls, where each came from, and a numeric search index (embedding) of that text | Let named agents recall relevant context for your future tasks | Contract, at your direction (proposed). You can view, edit, pin, export or delete any entry, or forget everything |
What we do not hold: calls are not audio-recorded. Only the text transcript produced by speech recognition is kept. There are no organisation or team accounts. Agent memory never stores text from web pages or from the person on a call, and nothing from a task or call flagged as a possible injection. To build the memory search index, memory text is sent to Google's embedding model through Lovable's AI service (To be confirmed: Google embedding retention and training terms). Memory is kept until you delete it; no automatic expiry is implemented yet. Before anything is stored, we try to hide card numbers, one-time codes and passwords, but this automatic filtering can miss things.
Other people's data
Pages you send and people your caller agent phones may involve other people's personal data. Callees hear at the start that they are speaking to an AI assistant calling for a customer. Their spoken replies become part of the transcript. If you are that person, you can use the rights below by contacting us.
Who receives data
- Lovable: hosts the app, sign-in and database. The database runs on Supabase through Lovable Cloud, and the site runs on Cloudflare's network.
- OpenAI models through Lovable's AI service: task text, page text, call transcripts and the planning prompts, used to generate agent steps, answers, injection checks and call replies.
- Twilio: the number called, speech recognition of the callee and the text the agent speaks.
- Amazon Polly (through Twilio): turns the agent's text into speech. To be confirmed: whether Amazon receives it directly or only through Twilio
- Google: only if you choose Google sign-in.
- Public websites, DuckDuckGo and Wikipedia: when an agent searches or opens a page, the search terms or web address are sent to them from our servers, not from your device.
Where data is stored, transfers outside the UK and the safeguards used, and each provider's training and retention terms are To be confirmed: region and transfer mechanism for each provider. We do not sell personal data or use it for advertising.
How long we keep it
Today: tasks, steps, security records, named agents and call transcripts are kept until you delete them or ask us to close your account. There is no automatic deletion yet.
Proposed (not yet switched on):
- 90 days: task content, call transcripts and any unpinned memory
- kept until you remove them: preferences you pin
- 12 months: minimised security metadata and inactive pilot enquiries
- deletion from the live system within 30 days of a request, with backups expiring within 90 days
Your rights
You can ask for access, correction, erasure, restriction, objection (including to processing based on legitimate interests) and a portable copy of your data. Where we rely on consent, you can withdraw it at any time. You can cancel scheduled calls, use the kill switch and export your activity log from the security console yourself. For anything else, email info@noahsure.co.uk. We aim to reply within one month, as the law requires. If you are unhappy, you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).
Cookies and storage
We use browser storage only to keep you signed in. The plugin stores your sign-in in the extension's own storage. We use no advertising or analytics cookies. To be confirmed: whether hosting-level analytics or security cookies are set
Adults only, AI notices and automated decisions
Sentinel is for people aged 18 and over. Agents can make mistakes and can be misled by the pages they read, so check important results. The service makes no decisions about you that have legal or similarly significant effects.
Security
We apply limits, approvals, injection checks and access rules to every agent step. No system is perfectly secure, and Sentinel only controls the agents that run through it. See the security page.
Sentinel by Noahsure
Operated by NOAHSURE GROUP LIMITED, registered in England and Wales, company number 12364489.
Registered office: 1 Canada Square, Canary Wharf, London, England, E14 5AA
Email: info@noahsure.co.uk