Privacy Policy

Last updated: 29 June 2026

This Privacy Policy explains how Tech Brand Limited trading as Sales Triage (Company Number: 13495362), Suite 525, 5 The High St, Maidenhead, SL6 1JN ("Sales Triage", "we", "us", "our") collects, uses, shares, and protects personal data.

It applies to our website at https://salestriage.co.uk, our training and coaching services, our AI-powered coaching assistant, our Revenue Engine SaaS platform, and any related products and services (together, the "Services").

We are committed to processing personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and other applicable data protection law.

Note for business customers: Some of what we do makes us a data controller, and some makes us a data processor acting on your instructions. Section 3 explains the difference and which role applies to which activity. This distinction matters because it determines who is responsible for what.

1. Contact Details

Data controller Tech Brand Limited t/a Sales Triage
Registered office Suite 525, 5 The High St, Maidenhead, SL6 1JN, United Kingdom
Company number 13495362
ICO registration ZC162861
Privacy contact paul@salestriage.co.uk

If you have any questions about this Policy or wish to exercise your rights, please contact us using the details above. We have not appointed a statutory Data Protection Officer, but the privacy contact above is responsible for overseeing data protection matters.

2. Summary - What We Do With Data

In short:

  • We collect data you give us (e.g. when you enquire, buy training, create an account, or use our platform) and data we collect automatically (e.g. usage and device data).
  • We use it to deliver our Services, run our business, communicate with you, meet legal obligations, and improve what we offer.
  • When you use our AI Coach, your inputs are sent to one or more third-party AI providers to generate responses. Your data is not used to train AI models.
  • When you use our SaaS platform to store contacts/prospects or send tracked emails, you are the controller of that data and we are your processor - see Sections 3 and 11 and the Data Processing Terms in our Terms and Conditions.
  • We do not sell your personal data.

The rest of this Policy gives the detail UK GDPR requires.

3. Our Role: Controller vs Processor

Whether we are a "controller" (we decide why and how data is processed) or a "processor" (we process data on someone else's instructions) depends on the activity:

We act as a CONTROLLER for:

  • Our website and visitor/enquiry data;
  • Account registration, administration, billing, and support;
  • Our own direct marketing and communications;
  • Training, coaching, consulting, and online learning we deliver directly to individuals;
  • Usage analytics and security/operational logs relating to the Services;
  • The account-level and usage metadata generated when individuals use the AI Coach;
  • Recordings and transcripts of meetings we host (for example coaching or sales calls we run) - see Section 6A.

We act as a PROCESSOR (on behalf of a client organisation, who is the controller) for:

  • Contact, prospect, customer, supplier, and stakeholder records that a client stores in the Revenue Engine platform;
  • Notes, activity history, opportunities, tasks, and other CRM content a client creates;
  • Emails sent through the platform on a client's behalf, and the email engagement data generated by them;
  • Content a client's users submit to the AI Coach about third parties (e.g. prospect or meeting information);
  • Meeting notes, transcripts, and AI-generated summaries created within the platform on a client's instructions, including recordings and transcripts captured by the notetaker on meetings a client hosts (see Section 6A).

Where we act as a processor, our processing is governed by the Data Processing Terms set out in our Terms and Conditions (which constitute a UK GDPR Article 28 data processing agreement). In that role, the client organisation is responsible for having a lawful basis, providing privacy notices to data subjects, and responding to data subject requests; we assist them as required by law.

If you are an individual whose data a Sales Triage client has stored in our platform (for example, you are a prospect a client has added), Sales Triage is acting as a processor. Please direct your privacy requests to that client (the controller). If you do not know who they are, contact us and we will help identify them and route your request.

4. Personal Data We Collect

Depending on which Services you use, we may process the following categories of personal data.

4.1 Data you provide

  • Identity and contact data: name, email address, phone number, job title, employer/company, postal address.
  • Account data: username, account credentials (passwords are stored hashed), profile and preferences.
  • Billing data: billing name and address, VAT number where you give one, and transaction records. Invoices are raised and held by our accounting provider (Xero). Payment is taken either by Direct Debit through GoCardless or by card against the invoice, which is processed by Stripe through our Stripe account connected to Xero; we do not store full card numbers or bank account details ourselves.
  • Service content / coaching data: information you share during coaching, consulting, workshops, or online programmes; enquiries and correspondence.
  • AI Coach inputs: questions, business and sales information, prospect and client information, meeting notes, strategy documents, and uploaded files you submit to the AI Coach.
  • CRM / platform content: records and information you (or your organisation) enter into the Revenue Engine platform - see Section 10.

4.2 Data we collect automatically

  • Technical data: IP address, browser type and version, user-agent string, device information, operating system, time zone, and login records.
  • Usage data: pages and features used, actions taken, session duration, and similar analytics. This includes a short-lived server-side visit log - see Section 12.
  • Cookie and similar technology data: see Section 12.
  • Email engagement data (where applicable): email opens, link clicks, open/click timestamps, device and browser information, user-agent information, and truncated or hashed IP-related metadata - see Section 11.

4.3 Data from third parties

  • Data enrichment / prospecting sources: where you or your organisation import or enrich records using third-party providers (e.g. Apollo, Lusha, CRM imports, CSV uploads), that data may include third-party personal data. Responsibility for the lawful sourcing and use of that data sits with the importing organisation - see Section 10.4.
  • Service providers and integrations you connect to the Services.

4.4 Special category data

We do not intend to collect special category data (e.g. health, biometric, racial/ethnic, political, religious, or criminal-offence data). Please do not submit such data to the AI Coach or store it in the platform unless we have expressly agreed this in writing.

5. How and Why We Use Your Data (Purposes and Lawful Bases)

We rely on the following lawful bases under Article 6 UK GDPR. (Where we act as a processor - Section 3 - the lawful basis is determined by the client controller, not by us.)

Purpose Categories used Lawful basis
Responding to enquiries and pre-contract requests Identity, contact, content Legitimate interests; steps prior to entering a contract
Providing training, coaching, consulting, and online programmes Identity, contact, content, billing Performance of a contract
Providing and administering AI Coach and platform accounts Account, technical, usage, AI inputs Performance of a contract
Recording and transcribing meetings we host for follow-up, coaching, and service quality (Section 6A) Identity, contact, content Legitimate interests
Processing payments and managing billing Billing, identity Performance of a contract; legal obligation
Keeping accounting/tax records Billing, identity Legal obligation (e.g. HMRC retention)
Securing the Services, preventing fraud/abuse, troubleshooting Technical, usage, account Legitimate interests
Sending service/operational messages Contact, account Performance of a contract; legitimate interests
Direct marketing to business contacts and customers Identity, contact, usage Legitimate interests and/or consent (see Section 11 and PECR)
Improving and developing our Services Usage, technical (aggregated/de-identified where possible) Legitimate interests
Establishing, exercising, or defending legal claims; complying with law As relevant Legal obligation; legitimate interests

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You can ask us for more detail about that assessment.

Where we rely on consent (for example, certain cookies or marketing in some circumstances), you may withdraw it at any time without affecting prior processing.

6. The AI Coach and AI Processing

When you use the AI Coach, the text you submit, your prompts/instructions, and any files you upload are transmitted to one or more third-party AI providers via their business/API services to generate a response. Our AI providers currently include OpenAI and Anthropic, and the providers we use may change over time as we develop the Services. Content you submit through an AI feature is not automatically added to a searchable index. Separately, we may set up an assistant with reference material indexed at the provider so it can search that material - that upload is done by us rather than by you, and where an assistant is set up for a particular client it may hold that client's own material and be available only to them. Indexed material of that kind stays at the provider until we remove it. A file you attach to a message is uploaded to the provider for that request rather than indexed.

You should be aware that:

  • No model training. We use AI providers' business/API services under terms which mean the data you submit (including messages, prompts, uploaded files, and any indexed content) is not used to train the providers' AI models.
  • Limited provider retention. A provider may retain inputs and outputs for a limited period (often up to around 30 days) for abuse and misuse monitoring, after which they are deleted, unless a shorter or zero-retention arrangement applies. Because a conversation continues from the provider's record of the previous turn, that record exists at the provider for the same limited period. Two things persist for longer: reference material we upload for an assistant to search, which stays until we remove it and which may be a particular client's own material where an assistant is set up for them; and a file you attach to a message, which remains in the provider's file storage after the request. We do not currently delete an attached file from the provider once the request is done, and that is listed as an improvement.
  • International transfer. Some AI providers process data outside the UK (for example, in the United States). We rely on appropriate safeguards for such transfers - see Section 9.
  • AI outputs may be inaccurate. AI-generated responses can be incomplete, out of date, or wrong ("hallucinations"). You must not rely on them as professional, legal, financial, or other regulated advice, and you remain responsible for reviewing outputs before acting on them. This is reflected in our Terms and Conditions.
  • Do not submit sensitive or unlawful content. Please do not enter special category data, or data you are not entitled to share, into the AI Coach.

Where the content you submit to the AI Coach concerns third parties and is entered as part of your organisation's use of the platform, your organisation is the controller and we are the processor (Section 3).

6A. Meeting Recording and Transcription (Notetaker)

Where it is enabled, our meeting notetaker can join your online video meetings (for example Zoom, Microsoft Teams, or Google Meet) to capture an audio recording and produce a written transcript of the conversation. Video is not recorded. The notetaker joins as a visible participant, named so that attendees can see a notetaker is present (for example "[Name]'s Notetaker (powered by Sales Triage)").

What we do with it. The transcript is stored against the meeting record in the platform and is processed by our AI providers (see Section 6) to produce summaries, suggested actions, and follow-up drafts. The audio recording itself is held by our meeting provider (Nylas) and accessed through time-limited links; we do not keep the audio file on our own servers. Nylas deletes its copy of the recording and transcript after 14 days. Retention is covered in Section 13.

It captures everyone on the call. Because a recording and transcript reflect what all participants say, they contain the personal data of every attendee, including people who are not Sales Triage users and have not signed up to the Services (for example a prospect or a client's contact who is on the call).

Who is the controller.

  • Where Sales Triage hosts the meeting (for example a coaching or sales call we run), Sales Triage is the controller for the attendees' personal data captured in the recording and transcript, and this Policy applies. Our lawful basis is legitimate interests: keeping an accurate record of business meetings for follow-up, coaching, and improving the quality of our Services, weighed against attendees' rights and freedoms. We have assessed that this processing is proportionate; you can ask us for more detail about that assessment.
  • Where one of our clients hosts the meeting using the platform, the client is the controller and is responsible for informing their attendees and for having a lawful basis; Sales Triage acts as the processor (Section 3).

Being told, and your choices. We aim to make recording visible rather than hidden: the notetaker appears as a named participant, and the host can choose not to record. If you are on a recorded meeting and would prefer not to be recorded or transcribed, you can ask the host not to record, decline to continue, or contact us (Section 1). Where Sales Triage is the controller, you also have the right to object to this processing (Section 14).

6B. Call Recording and Transcription (Calling and SMS)

Where the Calling and SMS add-on is enabled, calls a user places or receives through the in-browser phone can be recorded, and the recording is transcribed to text so the conversation appears on the relevant contact's timeline for follow-up and coaching. Calls are recorded for training and quality purposes.

What we do with it. The audio recording is held by our telephony provider (Telnyx); we pull it to produce a written transcript through our AI provider (OpenAI) and store that transcript against the call record in the platform. The transcript may then be used by our AI features (see Section 6) to support summaries, suggested actions, and follow-up drafts. Retention is covered in Section 13.

It captures both parties. A call recording and transcript reflect what everyone on the call says, so they contain the personal data of the other party as well as the user, including people who are not Sales Triage users (for example a prospect or a client's contact).

Controller and lawful basis. Where Sales Triage records its own calls, our lawful basis is legitimate interests (Article 6(1)(f) UK GDPR): keeping an accurate record of business calls for follow-up, coaching, and service quality, weighed against the other party's rights and freedoms. Our assessment of that balance is available on request. Where one of our clients records calls using the add-on, the client is the controller and is responsible for informing the people they call and for having a lawful basis; Sales Triage acts as the processor (Section 3).

Being told, and your choices. There is no legal requirement in the United Kingdom to announce a recording when we are a party to the call, and we do not play a separate in-call announcement; recording is disclosed here and in our Terms, and our people may also mention it at the start of a conversation. If you are on a recorded call and would prefer not to be recorded, you can ask the user not to record, decline to continue, or contact us (Section 1). Where Sales Triage is the controller, you also have the right to object to this processing (Section 14).

7. The Revenue Engine Platform (CRM and Prospecting)

When your organisation uses the Revenue Engine platform, it may store and process contact, prospect, customer, supplier, and stakeholder records, together with notes, activity history, opportunities, tasks, communications history, and reporting data.

For this processing, your organisation is the controller and Sales Triage is the processor. See Section 10 for what this means in practice, and the Data Processing Terms in our Terms and Conditions for the full contractual position.

8. Who We Share Data With

We share personal data with the following categories of recipient, under appropriate contracts:

  • Subprocessors and service providers who help us run the Services (see the list below);
  • Our accounting provider (Xero), which raises and holds your invoices, and our payment processors (GoCardless for Direct Debit, Stripe for card payment against an invoice);
  • Our professional advisers (lawyers, accountants, insurers) where necessary;
  • Authorities, regulators, or law enforcement where required by law, or to protect our rights, safety, or property;
  • A buyer or successor in the event of a merger, acquisition, or business reorganisation, subject to confidentiality.

We do not sell personal data, and we do not share it for third-party advertising.

Current subprocessors / key providers

The list below is maintained in code (the same source that drives our Security and Transparency pages), so it stays current and consistent wherever it is shown:

Anthropic

Their role
A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for
Powers our AI features - drafting emails, analysing meeting transcripts, and generating playbooks and reports.
What we share with them
The content you put into AI features, which can include messages, meeting transcripts, and CRM notes.
Where they process data
United States
How transfers out of the UK are safeguarded
UK Addendum to the EU SCCs, incorporated at Schedule 3 of the Anthropic DPA.
Data processing agreement
View the agreement

Apollo

Their role
A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for
An alternative provider for discovering and enriching the prospects you choose to research.
What we share with them
Contact identifiers such as name, company, and work email used to retrieve professional information.
Where they process data
United States
How transfers out of the UK are safeguarded
UK Transfer Addendum (the ICO IDTA of 21 March 2022), named in the Apollo DPA, which is incorporated into their terms of service.
Data processing agreement
View the agreement

Bunny.net

Their role
A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for
Hosts and streams the video messages you record in the platform.
What we share with them
The video and audio you record, along with video titles and thumbnail images.
Where they process data
United Kingdom and European Union (storage in London and Frankfurt, with EU-only delivery routing).
How transfers out of the UK are safeguarded
Storage is pinned to London and Frankfurt. The UK leg is domestic, and the Frankfurt leg is a transfer to the EEA, which the UK adequacy regulations cover, so no IDTA or UK Addendum is needed. That matters because the signed DPA names no instrument of its own: it instead treats the account's region settings as our documented instruction (sections 3 and 9), while section 4.6 reserves processing 'from anywhere in the world'. The region setting is therefore the safeguard, and changing it would leave global processing with nothing behind it.

Companies House

Their role
A public data source: we read information they publish. They do not process anything on our behalf.
What we use them for
Looks up UK company information when you research and add prospects.
What we share with them
The company names and registration numbers you search for.
Where they process data
United Kingdom
How transfers out of the UK are safeguarded
United Kingdom only - no restricted transfer.

Exa

Their role
A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for
An alternative provider for discovering companies and searching news when you research prospects.
What we share with them
The company names, search terms, and ideal-prospect criteria used to find companies and relevant news.
Where they process data
United States
How transfers out of the UK are safeguarded
UK IDTA to the EU SCCs (version B.1.0), named in the Exa DPA, which is incorporated into their terms of service.
Data processing agreement
View the agreement

Fasthosts

Their role
A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for
Provides the UK virtual server that hosts the application and database during beta.
What we share with them
All platform data is hosted on this server, including the records and notes you store.
Where they process data
United Kingdom
How transfers out of the UK are safeguarded
United Kingdom only - no restricted transfer.
Data processing agreement
View the agreement

GoCardless

Their role
An independent controller: they decide their own purposes for the data, so they answer for it directly rather than processing it on our instructions.
What we use them for
Collects payment by Direct Debit for invoices raised through Xero.
What we share with them
Your name, email address, billing address, bank account details, and the invoices collected against your account.
Where they process data
United Kingdom and European Union
How transfers out of the UK are safeguarded
United Kingdom and European Economic Area processing, relied on under adequacy. GoCardless is an independent controller, so no Article 28 transfer instrument applies between us.

Lusha

Their role
A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for
An alternative provider for enriching the prospect and contact records you choose to research.
What we share with them
Contact identifiers such as name, company, and work email used to retrieve professional information.
Where they process data
United States and European Union
How transfers out of the UK are safeguarded
UK IDTA to the EU SCCs (version B.1.0), named in the Lusha DPA, which is incorporated into the master services agreement.
Data processing agreement
View the agreement

Microsoft OneDrive

Their role
A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for
Stores offsite backup copies of the platform.
What we share with them
Backup copies of the platform database, which contain the data you store in the platform.
Where they process data
United Kingdom
How transfers out of the UK are safeguarded
IDTA implemented by Microsoft, per the Microsoft Products and Services Data Protection Addendum, which applies automatically to a Microsoft 365 business tenant.
Data processing agreement
View the agreement

Mux

Their role
A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for
Streams webinars - ingesting the live broadcast, delivering it to attendees, and storing the recording.
What we share with them
The live video and audio you broadcast and its recording, and the IP address and player/device information of each attendee who watches the stream.
Where they process data
United States

Nylas

Their role
A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for
Connects your email inbox and calendar so you can send messages and manage meetings from inside the app, and powers the meeting notetaker that records and transcribes online meetings.
What we share with them
Email content, calendar events, and contact details from the inbox you connect, and the audio recording and transcript of meetings the notetaker joins.
Where they process data
United Kingdom (London, where they host their EU region), with limited access from the United States or Canada when a support ticket needs it.
How transfers out of the UK are safeguarded
UK Addendum to the EU Standard Contractual Clauses, incorporated at Annex III of Exhibit B to the Data Processing Addendum signed 8 October 2026. The Clauses are signed for both Module Two and Module Three, so they cover the data we control and the data we process on behalf of a client. The account is set to their EU region, which Nylas confirmed on 9 October 2026 is hosted in London, so application data, connector data and grant information are stored in the UK and storage itself is not a restricted transfer. The EU and US regions are isolated with no data moved between them. The only routine transfer out is a support engineer outside the UK reading error logs on a support ticket, which the Clauses govern. Nylas is additionally certified under the UK Extension to the EU-U.S. Data Privacy Framework; the signed Clauses are the primary instrument and the certification a secondary basis. The region is fixed for the life of the application: moving it would mean creating a new application and every user reconnecting their inbox, so it cannot change without us knowing.

OpenAI

Their role
A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for
An alternative AI provider for the same drafting, analysis, and generation features, and transcribes recorded calls to text.
What we share with them
The content you put into AI features, which can include messages, meeting transcripts, and CRM notes, and the audio of recorded calls, which is transcribed to text.
Where they process data
United States
How transfers out of the UK are safeguarded
UK Addendum to the EU SCCs, defined and incorporated in the OpenAI DPA.
Data processing agreement
View the agreement

Stripe

Their role
Both, depending on what they are doing: they follow our instructions for part of it, and decide their own purposes for the rest - a payment provider deciding how to screen a card payment for fraud, for example.
What we use them for
Takes card payment against an invoice. Our Stripe account is connected to Xero, so the "Pay now" link on an invoice is processed by Stripe.
What we share with them
The payer's name and email address, billing address, the amount and reference of the invoice being paid, and the card details entered to pay it. We never see or hold the full card number.
Where they process data
United States and European Union
How transfers out of the UK are safeguarded
UK International Data Transfer Addendum, via the Data Transfers Addendum incorporated into the Stripe DPA.
Data processing agreement
View the agreement

Tavily

Their role
A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for
Searches the web for company news and context when you research prospects.
What we share with them
The company names and search terms used to find relevant news.
Where they process data
United States

Telnyx

Their role
A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for
Powers the Calling and SMS add-on - in-browser calling, call recording, and text messaging.
What we share with them
The phone numbers you dial or text, the content of text messages, and the audio recordings of calls, which are recorded for training and quality. Recordings are stored in a Telnyx-managed store whose region is not customer-selectable.
Where they process data
United States and European Union
How transfers out of the UK are safeguarded
UK International Data Transfer Addendum to the EU SCCs, at Schedule 3 of the Telnyx DPA.
Data processing agreement
View the agreement

Xero

Their role
A processor: they handle data only on our instructions, under a data processing agreement with us.
What we use them for
Raises and sends your invoices, and holds them as our accounting records. Card payment against an invoice is passed to the payment service connected to Xero (Stripe); Direct Debit collection is passed to GoCardless.
What we share with them
Your organisation name, billing contact email, billing address, VAT number where you have given one, and the invoices raised against your account.
Where they process data
New Zealand, Australia, United States and European Union
How transfers out of the UK are safeguarded
UK Addendum to the EU SCCs, named in the Xero data processing terms; New Zealand relied on under adequacy.
Data processing agreement
View the agreement

Apollo, Lusha and similar prospecting/enrichment tools are generally used by clients as their own data sources, not as Sales Triage subprocessors. Where a client imports or enriches data using such tools, the client is responsible for the lawful sourcing and use of that data (Section 10.4).

We use, or may use, the AI providers listed above, and route personal data to a given provider only once it is engaged under an appropriate data processing agreement. We keep an up-to-date list of subprocessors and will inform platform clients of material changes as set out in our Data Processing Terms.

9. International Transfers

Some of our providers process data outside the UK (for example, in the United States). Where we transfer personal data outside the UK, we ensure an appropriate safeguard is in place, such as:

  • transfers to a country covered by UK adequacy regulations; or
  • the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment where appropriate.

You can request more information about the safeguards that apply by contacting us.

10. Platform Data - Responsibilities (Controller/Processor Detail)

This section applies where your organisation uses the Revenue Engine platform.

10.1 Your organisation is the controller

You decide what data to store, why, and on what lawful basis. We process it on your documented instructions to provide the Services.

10.2 Your responsibilities

As controller, you are responsible for:

  • having and documenting a lawful basis for processing the personal data you store and for any marketing you send;
  • providing your own privacy notice to your contacts/prospects and keeping any privacy-notice URL configured in the platform accurate and accessible;
  • ensuring the accuracy and legality of the data you enter;
  • obtaining any consents required (including for cookies/tracking and certain marketing);
  • handling data subject requests relating to that data (we assist you).

10.3 Our responsibilities

As processor, we:

  • process the data only on your instructions and as needed to provide the Services;
  • apply appropriate technical and organisational security measures;
  • use only approved subprocessors under equivalent obligations;
  • assist you with security, breach notification, data subject requests, and (where applicable) impact assessments;
  • return or delete the data at the end of the relationship, subject to the export window in our Terms. We provide this export on request; a self-serve export is in development.

10.4 Prospecting and enrichment data

Where you import or enrich records (e.g. via CSV upload, CRM import, or providers such as Apollo or Lusha), you warrant that you have a lawful basis to obtain and use that data and that doing so complies with UK GDPR, PECR, and any applicable laws in the recipient's jurisdiction. Sales Triage does not verify the lawfulness of data you import.

10.5 Your client protection list

Your organisation can upload the website addresses of its existing clients so that nobody in your organisation can add them as a prospect, and so our Suspect Finder never puts them forward.

We do not store those addresses. Each one is converted to a one-way fingerprint (an HMAC-SHA256 value computed under a secret key held outside the database) and only the fingerprint is kept. We cannot read the list back, export it, or show it to you - which is why removing an entry means typing the address again so we can fingerprint it and match it. Nothing on the list is sent to any third party, and it is never written to our logs.

Separately, you may choose to let us keep a small number of clients by name so that "find companies like our best clients" has something to learn from. That is opt-in per company and off by default. For a company you tick, we store its name and website address in the ordinary way, and we may send the website address to a discovery provider (see Section 8) to look for similar companies. Companies you do not tick remain fingerprints and nothing else.

11. Email Sending and Engagement Tracking

Where the platform sends emails on a user's behalf (including one-to-one, prospecting, follow-up, nurture, and workflow-generated emails) and tracks engagement, we may process:

  • email addresses and delivery status;
  • email open events and timestamps;
  • link click events, timestamps, and clicked URLs;
  • device, browser, and user-agent information;
  • truncated or hashed IP-related metadata;
  • opt-out, objection, suppression, and tracking-preference records.

How emails are sent. Emails are sent through each user's own connected mailbox (Google/Gmail or Microsoft/Outlook) using a secure OAuth connection the user authorises. The platform adds tracking and compliance elements. The user's mailbox provider processes the message under the user's own agreement with that provider; Sales Triage does not operate a separate bulk-sending service.

Roles and lawful basis:

  • For emails our clients send through the platform, the client is the controller and is responsible for the lawful basis (typically legitimate interests supported by an assessment, or consent where required) and for PECR compliance. We are the processor.
  • For our own marketing emails, Sales Triage is the controller and relies on legitimate interests and/or consent, applying the PECR "soft opt-in" to existing customers where it is available, and always providing an unsubscribe option.

Controls. The platform can insert compliance disclosures, "why am I receiving this?" notices, unsubscribe/objection links, and preference mechanisms. These must not be removed or circumvented, and recorded opt-outs must be honoured (see our Terms and Conditions).

A cookie consent banner (provided by CookieYes) is deployed on our website; non-essential website cookies, including analytics, are set only where you have consented (see Section 12). Email open/click tracking, described in this Section 11, is a separate mechanism that uses pixels and tracked links within emails rather than website cookies, and is governed by the lawful bases set out above.

12. Cookies and Similar Technologies

Cookies are small files placed on your device. We use cookies and similar technologies (such as pixels and local storage) to operate the website, keep it secure, understand how it is used, and support embedded content.

When you visit https://salestriage.co.uk, a cookie consent banner (provided by CookieYes) is displayed and links to this Privacy Policy. Strictly necessary cookies are always active; non-essential cookies (such as analytics and embedded media) are not set until you consent to them. You can Accept all, Reject all, or Customise your choice by category, and you can change or withdraw your consent at any time using the cookie settings link in our website footer.

The categories of cookies we use are:

Category Purpose Examples Consent needed?
Necessary Logging you in, maintaining your session, security, and remembering your cookie choices Session, security, and consent-state cookies No - always on
Functional Enabling embedded media and remembering preferences YouTube / Vimeo embeds Yes
Analytics Understanding how visitors use the site so we can improve it Google Analytics (e.g. _ga, _gid) Yes
Advertisement Categorising any advertising or retargeting cookies Not currently in active use Yes

Analytics and functional cookies are set only where you have consented. We do not currently use advertising or retargeting cookies; the Advertisement category appears in our consent tool but holds no active cookies at present. Our consent tool may also list an "Uncategorised" group for any cookies it has not yet classified.

Embedded content (e.g. videos from YouTube or Vimeo) may set its own cookies and behaves as if you had visited the third-party site; it is governed by that third party's privacy policy.

Email tracking uses pixels and tracked links within emails rather than website cookies - see Section 11.

Separately from cookies, our web server keeps a short-lived visit log so we can see how many people are on the website and which pages are busy. For each page view by a visitor who is not signed in it records a keyed hash of the IP address (the raw address is not stored and the hash cannot be reversed without our secret key), the page path (not the query string), the browser user-agent string and the time. No cookie is set on your device and nothing is placed on it. The one cookie connected with this log is set only on our own staff's browsers, by them, from inside our admin area, so that their own visits stay out of the log; it holds no identifier and is never set on a visitor's device. The log is visible only to our platform operator, is used to spot returning visitors and busy pages, and may indicate that a visit could be from a business contact who previously clicked a tracked link or made a booking from the same address - a possibility rather than an identification, and never for a contact who has opted out of tracking. We rely on legitimate interests (understanding use of our website) for this, and the log is deleted after 30 days.

You can also control or delete cookies through your browser settings, though blocking strictly necessary cookies may affect how the website works.

13. How Long We Keep Data (Retention)

We keep personal data only as long as necessary for the purposes set out in this Policy, then delete or anonymise it. Our indicative retention periods are:

Data Indicative retention
Account data For the life of the account, then up to 6 years
Billing / accounting records 6 years (HMRC requirement)
Enquiries / support correspondence Up to 24 months
Marketing contacts Until you object/unsubscribe, reviewed periodically
Suppression / opt-out records Retained as long as needed to honour the opt-out
Client platform data (as processor) Kept for as long as the client's account is open, because the client decides what to keep and for how long. There is no automatic expiry, and no setting in the platform that applies one. A client can ask us to delete specific records, a specific individual's data, or a date range at any time, and we carry that out; we also act on any retention instruction a client gives us. On termination the data is available for export or return for up to 30 days and is then deleted (see Terms). Export is provided on request rather than self-serve.
AI Coach inputs/outputs (provider side) A limited period for abuse monitoring (often up to ~30 days). Reference material we upload for an assistant to search persists until we remove it, and may be a particular client's own material where an assistant is set up for them. A file you attach to a message remains in the provider's file storage after the request; we do not currently delete it (see Section 6)
Connected inbox and calendar data (provider side) For a mailbox connected by IMAP rather than Google or Microsoft, our email and calendar provider (Nylas) keeps a rolling copy of the most recent 90 days of messages. Its database backups are kept for 7 days.
Meeting recordings and transcripts (Section 6A) No fixed statutory period applies; we keep them no longer than necessary. Audio is held by our meeting provider behind time-limited links and is not retained by us; the provider deletes its copy of the recording and transcript after 14 days, and its own backups are kept for 7 days. The transcript we store is kept for the life of the associated meeting record and then deleted. As client platform data, it follows the export/deletion position in this table and in our Terms.
Call recordings and transcripts (Section 6B) No fixed statutory period applies; we keep them no longer than necessary. The audio is held by our telephony provider; the transcript is kept for the life of the associated call record and then deleted. As client platform data, it follows the export/deletion position in this table and in our Terms.
Website/usage analytics Typically 14-26 months
Server-side visit log (hashed IP, Section 12) 30 days
Security/access logs Typically up to 12 months

We may keep data longer where required to comply with law or to establish, exercise, or defend legal claims.

14. Your Rights

Under UK data protection law you have the right to:

  • Access the personal data we hold about you;
  • Request rectification of inaccurate or incomplete data;
  • Request erasure ("right to be forgotten") in certain circumstances;
  • Request restriction of processing;
  • Object to processing based on legitimate interests, and to direct marketing at any time;
  • Request data portability for data you provided, where applicable;
  • Withdraw consent at any time where we rely on consent;
  • Not be subject to solely automated decisions producing legal or similarly significant effects (we do not currently make such decisions).

To exercise any right, contact us using the details in Section 1. We will respond within one month (extendable for complex requests). There is normally no charge. We may need to verify your identity.

Where the data is held by us as a processor on a client's behalf, we will refer your request to that client (the controller) and assist them in responding.

Complaints. You can complain to us first, and we will try to resolve it. You also have the right to complain to the UK Information Commissioner's Office (ICO) at https://ico.org.uk or 0303 123 1113.

15. Security

We implement reasonable technical and organisational measures to protect personal data, including access controls, multi-factor authentication, encryption in transit, hashed passwords, encryption at rest for stored API credentials, integration secrets and mailbox tokens, tested backups, and the use of reputable infrastructure providers. Our current security posture, including both the controls that are in place and the ones we have not yet built, is described on our Security and Transparency pages. No system can be guaranteed completely secure, and we cannot warrant that the Services will be free from unauthorised access or breach. We maintain procedures to detect, report, and respond to personal data breaches as required by law.

16. Children

The Services are intended for business and professional users and are not directed at children under 18. We do not knowingly collect data from children.

17. Changes to This Policy

We may update this Policy from time to time. We will post the updated version here with a revised "Last updated" date and, where changes are significant, take reasonable steps to notify you.

18. Contact

For any privacy question or to exercise your rights, contact:

Tech Brand Limited t/a Sales Triage - paul@salestriage.co.uk Suite 525, 5 The High St, Maidenhead, SL6 1JN, United Kingdom

Copyright Tech Brand Limited t/a Sales Triage. All rights reserved. VAT Registration Number: 505 5342 16.