Privacy Policy

Last updated: 15 October 2026

This policy explains what personal data Ceni collects, why, and what you can do about it.

Ceni is operated by The Anderson Halford Group Limited, registered in England and Wales, company number 15921653, registered office 167-169 Great Portland Street, 5th Floor, London, W1W 5PF. We are the data controller for personal data about our own customers, and a data processor for personal data our customers store in Ceni about their contacts.

That distinction matters and runs through everything below.

Who this policy is for

If you are a Ceni customer — you have an account with us and pay us a subscription — we are the controller of your personal data and this policy describes how we handle it.

If you are a contact in someone's Ceni account — a customer of a business that uses Ceni — that business is the controller of your data. We process it on their instructions. If you want your data corrected or removed, contact them directly. We will assist them in responding to you, but we cannot act on your data without their instruction.

What we collect about our customers

Account information — your name, email address, phone number, and the name and details of your organisation.
Billing information — your subscription tier, billing history and payment status. We do not store card details. Payments are handled by Stripe, who hold the card data.
Usage information — records of what was created, changed and sent in your account, so we can support you and investigate faults.
Support correspondence — anything you send us when asking for help.

Why we are allowed to process it

Data protection law requires us to have a lawful basis for each purpose, and to tell you what it is.

What we do	Our lawful basis	Why
Run your account and provide the service	Performance of a contract	We cannot deliver a subscription you have bought without processing the account it belongs to.
Take payment and manage your subscription	Performance of a contract	The same. Card details are held by Stripe and never reach us.
Keep accounting and tax records after your account closes	Legal obligation	The Companies Act 2006 and HMRC's record-keeping rules require six years. This is why the retention below is six years and not shorter.
Keep logs, investigate faults, and protect the service from abuse	Legitimate interests	Keeping a service working and secure is a legitimate interest, and it cannot be done without some record of what happened. We keep the minimum that answers "what went wrong".
Send you messages about your account — receipts, security notices, service notifications	Performance of a contract	These are part of running the service, not marketing.
Answer your support requests	Performance of a contract	Support is part of what the subscription provides.
Keep you signed in and secure forms against forgery	Performance of a contract	These are the only cookies we set. See Cookies below.
Send you marketing about Ceni — new features, things we think you would use	Soft opt-in under PECR where you are already a customer, and consent otherwise	Explained below.

Where we rely on legitimate interests, we have weighed our interest against your rights and are satisfied it does not override them. You can object to that processing at any time — see Your rights.

On marketing. If you are already a Ceni customer, we may email you about our own similar products and services under the soft opt-in in the Privacy and Electronic Communications Regulations — you were given the chance to refuse when we took your details, and you get that chance in every message afterwards. If you are not a customer, we only email you if you have agreed to it. Every marketing message carries an unsubscribe link, and one click is enough — you never have to reply, sign in, or ask us. Unsubscribing stops the marketing and nothing else: you will still receive the messages needed to run your account, because those are part of the service rather than promotion.

For the personal data our customers store about their own contacts, we determine no lawful basis, because it is not our decision to make. We are the processor: we act on our customer's instructions, and the customer — as controller — is responsible for having a basis and for telling the people concerned. That division is set out in Who this policy is for.

What our customers store, which we process on their behalf

Ceni is a CRM, so a customer's account may contain personal data about their own contacts:

Names, email addresses, phone numbers, addresses and any custom fields the customer has defined
Email and SMS messages sent to those contacts through Ceni, including their content
Appointment bookings and their details
Survey and assessment responses
Course enrolments, progress and written answers
Documents uploaded against a contact or company record
Meeting transcripts from Zoom, where a meeting participant matches an existing contact We do not use any of this for our own purposes. We do not sell it, and we do not use it to train AI models.

Integrations, and what each one shares

Customers may connect Ceni to other services. Each connection is optional and can be disconnected at any time.

Google Calendar and Microsoft Outlook (calendar) — when you connect an account, we use its calendar availability to avoid offering unavailable booking times. If you enable two-way sync, you choose one writable calendar from that account. Ceni reads and stores its event dates, times, timezone, title, description, location, attendees, recurrence and sync identifiers so you can view and manage those events in Ceni. Private events are shown as time blocks; their title, description, location and attendees are removed from Ceni's stored calendar copy.

With two-way sync enabled, creating, editing or deleting an event in Ceni changes the selected original calendar, and changes in that calendar are brought back into Ceni. Moving or deleting a linked customer booking can also update the booking, notify the customer and update or remove its connected online meeting. Ordinary events from your connected calendar are visible only to you in Ceni.

Stopping two-way sync removes Ceni's personal event copies and stops pending calendar changes, but leaves original calendar events in place. Availability checks continue until you disconnect the calendar account. Disconnecting calendar access also removes the personal event copies; separate connected email access, existing booking records and committed booking notifications are retained where needed for those services. You can also revoke access in your Google or Microsoft account settings. Deleted copies can remain in backups for the period described below.

We use connected calendar data to provide calendar, availability and booking features. We do not sell calendar data or use it for advertising or to train AI models.

Google user data. If you connect a Google account to Ceni, Ceni's use of information received from Google APIs, and its transfer to any other app, will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

We use your Google Calendar data only to provide and improve the calendar features you can see in Ceni: showing your calendar alongside your bookings, checking when you are free so we do not offer times you are busy, and keeping events you create in Ceni and in Google Calendar in step.
We do not use Google user data for advertising, and we do not sell it.
We do not transfer it to anyone else, except where that is needed to provide those features, to comply with the law, or as part of a merger or sale of our business (with notice to you).
People at Ceni do not read your Google data unless you ask us to (for example, to help with a problem), we need to for security reasons, or the law requires it.
We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models.

We store the access Google gives Ceni in encrypted form. You can disconnect Google Calendar in Ceni at any time, and you can remove Ceni's access in your Google Account settings at myaccount.google.com/permissions.

Zoom — where enabled, we create a Zoom meeting when a customer books an appointment, and we retrieve the transcript when a meeting is recorded. We check the meeting's participants against the contacts in your Ceni account. If no participant matches one of your contacts, the transcript is discarded without being stored — Ceni retrieves the file, checks the participants against your contacts, and where there is no match it is never written to our database. Where there is a match, the transcript is encrypted and filed against that contact. We do not store Zoom recordings, and we never download them. Deleting a contact deletes their transcripts.

Xero and QuickBooks — where connected, we create records in your accounting system for invoices raised in Ceni, and read back their payment status.

Companies House — when you look up a company by number, we retrieve its public register entry. This is public data and no personal data of yours is sent.

Stripe — handles subscription payments. Card details go to Stripe and never reach us.

Twilio — sends SMS and handles voice calls where those features are used.

Resend — sends email.

Anthropic (United States) — provides Ceni's AI features. The content of each AI request is sent to Anthropic's API, processed in the United States, and the result returned. Anthropic does not train on it. It processes, only when that feature is used:

AI meeting notes: the text of each filed Zoom transcript, with the meeting's topic and date (off unless you turn it on; see below).
Ceni, the assistant: your messages, and the contact, deal and activity details Ceni looks up to answer them.
Post: each scanned letter received through the post service, to give it a title.
Creating tasks from a document: the document you upload, and your organisation's members' names, to suggest who a task is for.
Website generation: the business details and instructions you give for your site.

AI meeting notes are the one AI feature that reads a client conversation, and they are off unless you turn them on. With the setting switched on — in Settings → Organisation, by an owner or admin — the text of each filed Zoom transcript, with the meeting's topic and date, is sent to Anthropic, which returns a summary, the decisions made and suggested action points. Nothing else about your account is sent: no contact details, no other records. With the setting off, which is how every account starts, no transcript is sent anywhere.

Where your data is stored

Ceni's database is hosted in the United States with Neon, in their US East (Ohio) region. The application runs on Vercel. Files are stored with Vercel Blob. Our public website and these policy pages are served by Cloudflare, which sees the IP address of anyone visiting them. Anthropic processes AI requests in the United States. Our sub-processors are listed above.

Transfers outside the UK are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an equivalent lawful transfer mechanism.

How long we keep it

Customer account data — for as long as you have an account, and for six years after it closes, to meet our legal and accounting obligations.

Data you store in Ceni — for as long as you keep it there. Deleting a record deletes it. Closing your account deletes your data, subject to backups.

Backups — our database keeps 30 days of point-in-time history, so data deleted from the live system remains recoverable from that history for up to 30 days before it expires.

Documents — where a customer uses Ceni to store documents, those are retained according to that customer's own retention policy.

Security

All data is transmitted over TLS.
Access tokens for connected services, and Zoom transcripts, are encrypted at rest using AES-256-GCM.
Each customer organisation's data is isolated, and every query is scoped to the organisation making it.
Access to production systems is limited to those who need it.
Backups are stored in a private location, not publicly addressable.

Your rights

Under UK data protection law you have the right to:

Be told what personal data we hold about you and why — this policy is part of that
Access a copy of your personal data
Correct data that is inaccurate or incomplete
Erase your data, where we have no overriding reason to keep it
Restrict how we use it while a concern is resolved
Object to processing carried out on the basis of legitimate interests — which for us means our logs, fault investigation and abuse prevention, listed above
Portability — receive your data in a structured, machine-readable format, or have it sent to another provider
Withdraw consent at any time, where consent is what we relied on To exercise any of these, email support@cenicrm.co.uk. We will respond within one month.

If you are a contact in someone else's Ceni account, direct your request to the business that holds your data. We will support them in answering it.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first.

Cookies

Ceni uses cookies that are necessary for the service to work — keeping you signed in, remembering which organisation you are viewing, and securing forms against cross-site request forgery. We do not use advertising or tracking cookies.

Changes

We will update this page when our processing changes, and change the date at the top. Material changes will be notified to customers by email.

Contact

support@cenicrm.co.uk

The Anderson Halford Group Limited

167-169 Great Portland Street, 5th Floor

London

W1W 5PF