Privacy policy

1. Who we are

Intillia is provided by INTILLIA LTD, a company registered in England and Wales (company number 17378577). Our registered office is 20 Fieldfare Way, Ashton-Under-Lyne, England, OL7 9TA. You can contact us about privacy at team@intillia.com.

In this policy, "Intillia", "we" and "us" mean INTILLIA LTD. A "customer" is a business that subscribes to Intillia, usually one wholesale branch. "Staff" means people our customers authorise to use Intillia.

2. Our role: controller or processor

UK data protection law treats us differently depending on whose data it is.

• We are the processor for data we handle for our customers when they use Intillia. That includes enquiries, attachments, their customers' contact details, quotes, supplier correspondence, and data from their ERP and connected mailboxes and WhatsApp numbers. Our customer, the wholesaler, is the controller and decides why this data is processed. We act only on their instructions, under a data processing agreement. If you are one of our customer's own customers or suppliers, please also read that wholesaler's privacy notice, and contact them first with any request.
• We are the controller for data about our customers' staff as users of Intillia (accounts, sign-in and usage), for people who contact us or visit this website, and for our own business contacts.

3. What we collect

Account and usage data (we are controller)

• Staff names, work email addresses, branch, role and sign-in details.
• Records of actions in Intillia (for example, who approved a quote), security logs, IP addresses, device and browser information.
• Correspondence with us, such as support emails.

Customer data (we are processor)

• Enquiries: the content of enquiry emails, WhatsApp messages and uploaded files (including attachments, photos and voice notes), and the sender's name, email address or phone number.
• The wholesaler's customer records: customer accounts and contacts, account status and terms, and order and invoice details read from the wholesaler's ERP system.
• Quotes: quote lines, prices, approvals, and messages sent to customers, including follow-ups.
• Supplier correspondence: price requests to manufacturers or suppliers that Intillia drafts in a staff member's mailbox (or sends) on the wholesaler's behalf, and the suppliers' replies, which can include the supplier contact's name and details.
• Catalogue and pricing data: products, prices and stock. This is business data and usually contains no personal data.

We also hold product information (manufacturers, part numbers, technical specifications) from industry data sources and public manufacturer documents. It contains no personal data.

4. Connected mailboxes (Microsoft and Google)

A staff member can choose to connect their work mailbox (Microsoft 365, Outlook.com or Gmail) so that enquiries reach Intillia automatically, and, if their organisation turns it on, so that supplier price requests, quotes and follow-ups go out from their own mailbox. This is how it works.

Reading mail

• Permissions: we ask only to read mail, plus basic profile details (name and email address) to identify the connection. With Microsoft we request Mail.Read (and Mail.Read.Shared if a shared mailbox such as sales@ is connected), User.Read and offline_access. With Google we request gmail.readonly. Permission to draft and send is separate, and is asked for only if your organisation turns those features on (see below).
• Only new mail: we process messages that arrive after the mailbox is connected. We do not import or read older mail.
• Only enquiries and supplier replies are kept: each new message is checked automatically to decide whether it is a customer enquiry, or a reply from a supplier to a price request Intillia drafted. Only those messages, and their attachments, are stored and used to prepare quotes. Messages sent through Intillia are also kept (see below). For every other message we keep only a minimal record (the mailbox, the message's identifiers, the decision and the time), so we don't check it again. We never keep its subject, body or attachments.
• No other use: mailbox data is used only to provide Intillia's quoting features to the customer whose staff connected it.
• Access tokens are encrypted at rest, kept on our servers only, never sent to the browser and never written to logs.
• Every read is recorded: we log who connected a mailbox and what Intillia read, and when.

Drafting and sending from your mailbox (optional)

Your organisation's administrator decides whether Intillia may draft and send email from staff mailboxes. If it's turned on, each staff member is asked to approve the extra permission when they connect: with Microsoft, Mail.ReadWrite (to create drafts) and Mail.Send; with Google, gmail.compose (to create and send drafts). If it's off, Intillia sends quotes from its own email service instead (see section 9), and nothing is drafted or sent from your mailbox.

• Supplier price requests: when a requested product isn't in your catalogue, Intillia creates a draft email to the supplier in your mailbox. You review it, edit it if you like, and send it yourself. The request contains only the manufacturer, part number, quantity and your customer's own description of the item. It never includes your customer's contact details or product data from third-party databases. Each request carries a short reference code so the supplier's reply can be linked back to it.
• Quotes and follow-ups: once staff approve a quote, Intillia sends it from your mailbox as a reply in the customer's original email thread. Follow-ups on unanswered quotes are drafted for you to send, or sent automatically only if your organisation has turned on automatic follow-ups.
• Linking replies: after a supplier request is sent, Intillia finds it in your Sent folder to record its message ID, the content actually sent and the time, so that replies can be matched to it. It reads nothing else in your Sent folder.
• What we keep: a record of each message drafted or sent through Intillia (recipient, subject, content, message ID and time), linked to the quote it belongs to.
• Nothing else is sent. Intillia never sends marketing or any message you or your organisation's settings haven't approved, and never deletes or changes your other mail.

5. Google user data and Limited Use

Intillia's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Gmail data only to provide and improve the user-facing features of Intillia described in this policy: finding customer enquiries and supplier replies, preparing quotes from them, and, where your organisation has turned it on, drafting and sending the supplier price requests, quotes and follow-ups described in section 4.
• We do not transfer Gmail data to others except as needed to provide those features (for example, to the service providers listed in section 9), to comply with the law, or as part of a merger or acquisition with appropriate safeguards.
• We do not use Gmail data for advertising, including retargeting, personalised or interest-based advertising.
• We do not sell Gmail data, and we do not use it to determine creditworthiness or for lending purposes.
• No person at Intillia reads Gmail data unless the user has given affirmative consent for specific messages, it is necessary for security purposes (such as investigating abuse), it is needed to comply with the law, or the data has been aggregated and anonymised for internal operations.
• We do not use Gmail data to develop, improve or train generalised or non-personalised AI or machine-learning models.

6. WhatsApp

A wholesaler can connect its WhatsApp Business number through Meta's WhatsApp Business Platform (Cloud API). Messages and media that customers send to that number after it is connected are passed to Intillia so that enquiries can be quoted. We do not import earlier chat history. Messages that staff send from the WhatsApp Business app may also be shared with Intillia so we know when a customer has already had a reply. Intillia sends WhatsApp messages only to customers who have messaged the business or opted in, as WhatsApp's policies require. Meta processes these messages under its own terms as the provider of the WhatsApp service.

7. How we use AI

• We use Google's Gemini models through Google's API to read enquiries and attachments, recognise requested products and quantities, and classify messages. We use Gemini under Google's paid service terms, under which Google does not use our prompts or the responses to improve its products. Google keeps prompts and responses for a limited period only to detect and prevent abuse.
• AI output is a draft. Staff review and approve every quote before it is sent.
• We do not use customer data, mailbox data or WhatsApp data to train general-purpose AI models. Corrections that a customer's staff make, such as confirming which product a customer means by a particular description, may be used to improve results for that customer.
• We do not make decisions that have legal or similarly significant effects on individuals solely by automated means.

8. How we use data, and our lawful bases

For customer data, we process data only on our customer's instructions to provide Intillia. Our customer is responsible for having a lawful basis for that processing. For data where we are the controller:

9. Who we share data with

We don't sell personal data. We share it only with service providers (sub-processors) that help us run Intillia, under contracts that require them to protect it, and only as needed:

When a customer connects them, data also flows to and from services the customer chooses: their own email provider (Microsoft or Google), Meta's WhatsApp Business Platform, and their ERP system. Those providers act under their own terms with the customer.

We may also disclose data if the law requires it, to protect rights and safety, or to a buyer of our business, who would be bound by this policy.

10. International transfers

Some providers process data outside the UK, mainly in the USA. When they do, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the provider is certified) or on the UK International Data Transfer Agreement or Addendum, with additional safeguards where needed.

11. How long we keep data

We keep data only as long as needed. These are our standard periods. A customer can ask us to delete its data sooner, subject to legal requirements.

12. Security

• Data is encrypted in transit (TLS) and at rest.
• Mailbox and WhatsApp tokens are encrypted and kept on our servers only.
• Each customer's data is kept separate from every other customer's, and access is checked on every request.
• Access by our own staff is limited to what's needed and is recorded.
• If a breach affects personal data, we tell the affected customers without undue delay, and the ICO where the law requires.

13. Disconnecting and deleting data

• Disconnect in Intillia: go to Settings, then Connections, then Disconnect. We revoke our access and delete the access tokens straight away.
• Remove access from your provider: you can also remove Intillia's access from your Google Account or from your Microsoft account's apps page.
• Delete data: email team@intillia.com. If you are one of our customer's customers, we'll pass your request to the wholesaler, who controls that data, and help them respond.

14. Your rights

Under UK data protection law you have the right to: access your personal data; have it corrected; have it erased; restrict or object to its processing; and data portability. You can also object at any time to processing based on our legitimate interests. To exercise a right, email team@intillia.com. We'll respond within one month.

You can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. We'd appreciate the chance to resolve your concern first.

15. Cookies

This website does not use cookies or tracking. The Intillia web app stores only what is strictly necessary to keep you signed in, using your browser's storage. It uses no advertising or tracking cookies.

16. Children

Intillia is a business service and isn't intended for anyone under 18.

17. Changes to this policy

We'll update this page when our practices change, and tell customers in advance of significant changes. If we ever want to use mailbox data in a new way, we will update this policy and ask for consent before doing so.

18. Contact us

INTILLIA LTD, 20 Fieldfare Way, Ashton-Under-Lyne, England, OL7 9TA
Email: team@intillia.com