Privacy policy.

This policy explains what personal data Extol Affiliates collects through this website, why, and what you can do about it.

Who we are

Extol Affiliates is the data controller for the personal data described here. You can reach us at admin@extolaffiliates.com.

What we collect

What you send us, how you use the site, and, only if you allow it, analytics:

• Booking details: the name and email address, and anything else you choose to add, when you book a call with us through Calendly.
• Correspondence: the content of emails and messages you exchange with us.
• Requests on the site: when you ask us to email you the portfolio, we receive your email address, anything you type, the page you sent it from, the site that sent you to us, your device type and browser, and your approximate location (town and country, worked out from your IP address by our host). If you clicked Allow on the cookie banner, we also receive the pages you read during that visit and roughly how long you spent on each.
• Visit records: when you browse the site, our server notes the pages you view, roughly how long you stay, the site that sent you, your device type, and which organisation owns the network you are connecting from. Your IP address is used for that lookup and is not stored; the visit record is kept under a scrambled key for 30 minutes and then deleted. No cookies are used for this.
• Business contact details: if a visit comes from a company’s own office network and shows interest in our services, we may look up one relevant decision maker at that company (for example the founder or head of sales) in Apollo, a business contact database, and email them once about our services. This is their name, job title and work email. We do not do this when a visit comes from a home, mobile, cloud or public network, and we do not currently do it for companies in Canada.
• Usage data: if you click Allow on the cookie banner, Google Analytics records which pages you view, how you arrived, your approximate location, and your device and browser. It does not tell us who you are.

This site sets no advertising cookies. Google Analytics cookies (named _ga and _ga_*) are set only if you click Allow on the cookie banner. If you click No thanks, Google Analytics does not load at all. You can change your choice at any time with the Cookie settings link at the bottom of every page. If you click Allow, the site also remembers the pages you read during your visit in your browser’s session storage, so a request you make can be answered in context. It is cleared when you close the tab. Our host, Vercel, also counts page views without cookies and without identifying you, and may keep short-term server logs, including IP addresses, for security and reliability purposes.

Why we use it

• To reply to your enquiry and discuss whether we can help. Our lawful basis is our legitimate interest in responding to people who contact us.
• To provide services under a contract, where you become a client.
• To send you what you asked for on the site, with a short personal note from us. Our lawful basis is our legitimate interest in answering requests people make.
• To contact businesses that appear interested in our services, once, with a short relevant email. Our lawful basis is our legitimate interest in business to business marketing. Each company is emailed this way once only, every email says who we are, and you can object at any time by replying “unsubscribe”, after which we will not email you again.
• To meet legal and accounting obligations.
• To understand which pages are useful and improve the site, where you have allowed analytics cookies. Our lawful basis is your consent, which you can withdraw at any time.

We do not sell your data, and we do not add you to a marketing list because you booked a call, emailed us or asked for something on the site.

Automated replies. When you make a request on the site, our systems write and send the reply automatically, usually within a minute. One AI model (Jev) sorts the request by which of our services it relates to and how soon you may want to talk. Another (Claude, made by Anthropic) drafts the email from those facts. The email is sent without a person checking it first, and a copy goes to our team, who read every one. Your location is shown to our team only and is not used in the email. The same models decide whether a visit came from a company network and whether that company is a sensible fit before a business email is written and sent. None of this has a legal or similarly significant effect on you. If you would rather deal with a person, reply to the email and one will.

Who else sees it

We use a small number of processors to run the business. As at the last update these are:

• Calendly: call bookings
• Google Workspace: business email and documents, including enquiry and client records
• Vercel: website hosting, server logs and cookie-free page view counts
• Google Analytics: visit statistics, only if you allow analytics cookies
• Resend: sending the emails you request on the site
• IPinfo: identifying which organisation owns the network a visit comes from
• Apollo: finding a relevant business contact at a company that visited, and the source of the business contact details described above
• Upstash: holding visit records for 30 minutes and a note of which companies we have emailed
• OpenRouter: passing requests made on the site to the AI models that sort them and draft the reply (TypeSafe’s Jev and Anthropic’s Claude)

Each is bound by contract to process data only on our instructions. Where a provider is based outside the UK or EEA, transfers are covered by an adequacy decision or standard contractual clauses.

How long we keep it

Enquiries that do not become client work are deleted after 24 months. Client records are kept for the length of the relationship and then for 6 years to meet accounting and legal requirements. Requests made on the site are kept with our other enquiries and deleted after 24 months if they do not become client work. Visit records are deleted after 30 minutes. A note that we have emailed a company is kept so that we never email it this way again. Business outreach emails and replies are kept for 24 months, and if you ask us to stop, we keep your email address on a do not contact list so that we can honour it. Google Analytics data is kept for 14 months.

Your rights

Under UK GDPR you can ask us for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, and ask for it in a portable format. Email admin@extolaffiliates.com and we will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk.

Changes

If this policy changes we will update the date at the top. Material changes affecting existing clients will be notified directly.