Privacy notice

Information we use and where it comes from

We use account and business contact details, brand briefs, access enquiries, research notes, publicly available professional information, source links, relevant correspondence, partnership terms and introduction permissions. Information comes from you, your organisation, potential partners, their public websites and professional profiles, and our researchers.

We also keep password hashes, session and security records, billing references, subscription status and records of important account actions. Stripe collects payment details on its own pages. We do not store full card numbers or card security codes. Please do not send unnecessary sensitive personal information in a brief or email.

Why we use information

We use information to assess enquiries, administer accounts, research business opportunities, confirm commercial terms, arrange requested introductions, provide support and manage payment. Where you contract with us personally, processing needed to provide that service is based on the contract. For business representatives and professional contacts, we rely on legitimate interests in providing and evaluating relevant business partnerships, balanced against their rights and expectations.

Security, fraud prevention and keeping evidence of permissions are based on our legitimate interests in protecting people and the service. We keep records required by accounting and other legal obligations. Where a particular use relies on consent, you can withdraw that consent by contacting us; withdrawal does not change the lawfulness of earlier processing. A request to stop contact is recorded so it can be respected.

Research and introduction decisions are reviewed by people. We do not use solely automated decisions with legal or similarly significant effects.

Who receives information

Access is limited to authorised staff and researchers who need it for their work. The application is hosted by Render in Frankfurt. Cloudflare stores encrypted recovery copies in its EU-restricted storage and supports recovery monitoring. Resend processes service emails using the configured Ireland sending region. Our mailbox and communications providers also process support and reply messages. Stripe processes payments and has its own privacy information at stripe.com/privacy. Professional advisers and authorities may receive information where necessary for legal obligations or claims.

When you request an introduction and the required permission is recorded, we share the relevant contact details and agreed context with the other participant. We do not sell personal information.

Providers may also process information outside the United Kingdom, including in the EEA and United States, for support, security and other service operations. Their data-processing agreements provide transfer arrangements, including applicable adequacy arrangements and standard contractual clauses with the UK international-transfer addendum. Contact us for information about the safeguards relevant to your data and how to obtain a copy.

How long information is kept

We retain account and service records for the active relationship and afterwards only as needed for outstanding work, billing, complaints, legal obligations or claims. We assess research records for continued relevance and accuracy, and remove or anonymise information that is no longer needed. Financial records are retained for the applicable statutory accounting period.

Security records are kept only for the period needed to detect and investigate incidents. A minimal record of a request not to be contacted may be retained so we do not contact you again. Scheduled cloud recovery copies are retained for seven days, with daily copies retained for thirty days. Separate restoration and recovery copies are restricted to recovery use and removed when no longer needed. If data is restored, applicable deletion and suppression requests must be reapplied. Contact us for the retention criteria relevant to a particular record.

Your rights

Depending on the circumstances, you can ask for access, correction, deletion, restriction or a portable copy of your information. You can object to processing based on legitimate interests and to direct marketing. Contact poppy@elodieandvale.com; we may need proportionate information to verify the request.

You can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. We would welcome the opportunity to address your concern first, but you do not have to contact us before raising it with the ICO.

Cookies and security

The application uses a necessary sign-in session cookie and security controls to protect accounts. The current site does not use advertising or optional analytics cookies. Stripe and other external websites operate under their own notices when you visit them.

Access controls, HTTPS and restricted operational access protect the service. No system can guarantee absolute security. We will update this notice when the way we handle personal information changes and make material changes clear.