Privacy Policy

1. Who we are

This privacy policy is issued by StudioData Limited, a company registered in England and Wales under company number 17326272, whose registered office is at The Farmhouse, Broadstone Estate, Enstone, Chipping Norton, England, OX7 5QL ("StudioData", "we", "us" or "our").

We are committed to protecting the privacy of everyone who visits our website at studiodata.ai (the "Website"), books a demo, uses the StudioData platform (the "Platform"), or otherwise interacts with us. This policy explains what personal data we collect, why, how we use and share it, and the choices and rights available to you.

StudioData is registered with the Information Commissioner's Office (ICO) under registration number ZC224229. Our nominated contact for data protection matters is the StudioData Data Protection Lead, reachable at privacy@studiodata.ai.

2. Scope of this policy — who it covers

StudioData wears two different hats depending on whose data is involved, and it matters which one applies:

• Where we are the controller: personal data about people who visit our Website, request a demo, subscribe to updates, or use the Platform as an authorised user on behalf of a subscribing PR agency (an "Agency User"). This policy governs that data directly.
• Where we are the processor: personal data that a subscribing PR agency (an "Agency") uploads to, or connects within, a client dashboard on the Platform — for example, data drawn from a Client's Google Analytics 4 or Google Search Console account, or details of named spokespeople or journalists entered into coverage records ("End-Client Data"). For End-Client Data, the Agency is the data controller and instructs StudioData as its processor under a separate Data Processing Agreement ("DPA") between StudioData and that Agency. This policy describes our general approach to security and sub-processing, but the Agency's own privacy notice and its DPA with StudioData govern that processing in detail. If you are an End-Client and have questions about how your data is used, please contact the PR agency that engaged StudioData on your behalf in the first instance.

3. Information we collect

3.1 Information you give us directly

This includes your name, job title, agency or company name, email address, telephone number and any message content, when you: complete a contact or "book a demo" form; sign up for an Agency User account; correspond with us by email or phone; or attend a call or meeting with us.

3.2 Information collected automatically

When you visit the Website or use the Platform, we (and our analytics providers) automatically collect technical information such as IP address, browser type, device information, pages viewed, referral source, and usage patterns within the Platform, generally via cookies and similar technologies — see "Cookies" below.

3.3 Information from third parties and connected data sources

Where an Agency connects a Client's own data sources to a Client Dashboard — for example a Client's Google Analytics 4 account, Google Search Console account, or the Client's social media accounts — StudioData receives data from that source for the purpose of populating that dashboard. Separately, competitor-benchmarking, SEO and AEO (AI-visibility) data shown within a Client Dashboard is sourced by StudioData itself, directly from third-party data providers we engage — the Agency and Client do not connect or control these particular sources, and as a matter of policy we do not publish which specific providers we use for them. Where any of this data is identifiable to an individual (for example, a named contact in backlink or coverage metadata, or a social media poster), it is treated as End-Client Data and processed as described in Section 2 above.

4. How we use personal data, and our legal basis for doing so

We only use personal data where we have a valid legal basis under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018. Depending on the purpose, we rely on one or more of the following:

• Performance of a contract — to create and administer Agency User accounts, provide the Platform and respond to support requests.
• Legitimate interests — to respond to enquiries, follow up on demo requests, improve and secure the Website and Platform, and understand how the Platform is used, provided this is not outweighed by your interests or rights.
• Consent — for direct marketing communications (e.g. product updates or newsletters), which you may withdraw at any time.
• Legal obligation — where we must keep or disclose information to comply with the law, for example accounting and tax records.

5. How we share personal data

We do not sell personal data. We share it only where necessary, with the following categories of recipient:

• Infrastructure and hosting providers who host the Website and Platform on our behalf including Vercel and Supabase.
• Authentication and background job execution providers such as Trigger.dev and Clerk.
• Google, in connection with Google Analytics 4 and Google Search Console integrations that an Agency connects for a Client, used to populate Client Dashboards.
• Relevant social media platforms (for example Instagram, TikTok or LinkedIn), in connection with a Client's own social account that an Agency connects, used to populate social mention data within a Client Dashboard.
• Third-party SEO, competitor-benchmarking and AEO/AI-visibility data providers that StudioData engages directly to generate dashboard content.
• Email, CRM and scheduling tools we use to manage enquiries, demo bookings and Agency relationships including Clerk, Resend, Klaviyo, Calendly and Zoom.
• Vetted third-party experts, but only where an Agency or its Client has opted into Expert Delivery Services, and only to the extent necessary to scope or deliver that specific engagement.
• Billing and payment providers including Stripe.
• Our professional advisers (e.g. accountants, lawyers, insurers) and, if StudioData is involved in a fundraising, merger, acquisition or restructuring, prospective investors or acquirers, always under appropriate confidentiality protections.
• Regulators, law enforcement or other third parties where we are required to do so by law, or to protect our rights or the safety of others.

6. Cookies and similar technologies

We use cookies and similar technologies on the Website and Platform for essential functionality, analytics, and (where you consent) marketing purposes. You can control non-essential cookies through the cookie banner shown on first visit and through your browser settings.

7. International data transfers

Some of the third parties listed above may process personal data outside the UK. Where this happens, we put in place appropriate safeguards recognised under UK data protection law — such as the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses, or reliance on a UK adequacy regulation — to ensure your data continues to receive an equivalent level of protection.

8. How we keep personal data secure

We use appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction, including access controls, encryption of data in transit, and restricting access to personal data to those who need it. No system is completely secure, and we cannot guarantee absolute security, but we keep our measures under review as the Platform develops.

9. How long we keep personal data

We keep personal data only for as long as necessary for the purposes it was collected: generally, Agency User account data for the duration of the applicable Subscriber Contract plus a period afterwards to meet legal, accounting and reporting obligations (typically up to six years); enquiry and demo-request data for as long as reasonably needed to follow up, or until you ask us to delete it; and marketing data until you unsubscribe or object. End-Client Data is retained and deleted in line with the applicable DPA and the instructions of the relevant Agency.

10. Children

The Website and Platform are intended for business use and are not directed at, and we do not knowingly collect personal data from, children under the age of 16.

11. Your rights

Subject to certain conditions and exemptions, UK data protection law gives you the right to: access the personal data we hold about you; have inaccurate data corrected; have your data erased; restrict or object to our processing of your data; receive certain data in a portable format; and withdraw consent at any time where we rely on consent. To exercise any of these rights, contact us at privacy@studiodata.ai. If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office at ico.org.uk.

12. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or for legal or regulatory reasons. We will post the updated version on the Website with a revised effective date, and where changes are material we will take reasonable steps to notify Agency Users directly.

13. Contact us

If you have any questions about this policy or how we handle personal data, please contact us at privacy@studiodata.ai or by post at: