Privacy Policy
Last updated: 29 June 2026
This Privacy Policy explains how Tech Brand Limited trading as Sales Triage (Company Number: 13495362), Suite 525, 5 The High St, Maidenhead, SL6 1JN ("Sales Triage", "we", "us", "our") collects, uses, shares, and protects personal data.
It applies to our website at https://salestriage.co.uk, our training and coaching services, our AI-powered coaching assistant, our Revenue Engine SaaS platform, and any related products and services (together, the "Services").
We are committed to processing personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and other applicable data protection law.
Note for business customers: Some of what we do makes us a data controller, and some makes us a data processor acting on your instructions. Section 3 explains the difference and which role applies to which activity. This distinction matters because it determines who is responsible for what.
1. Contact Details
| Data controller | Tech Brand Limited t/a Sales Triage |
| Registered office | Suite 525, 5 The High St, Maidenhead, SL6 1JN, United Kingdom |
| Company number | 13495362 |
| ICO registration | ZC162861 |
| Privacy contact | paul@salestriage.co.uk |
If you have any questions about this Policy or wish to exercise your rights, please contact us using the details above. We have not appointed a statutory Data Protection Officer, but the privacy contact above is responsible for overseeing data protection matters.
2. Summary - What We Do With Data
In short:
- We collect data you give us (e.g. when you enquire, buy training, create an account, or use our platform) and data we collect automatically (e.g. usage and device data).
- We use it to deliver our Services, run our business, communicate with you, meet legal obligations, and improve what we offer.
- When you use our AI Coach, your inputs are sent to one or more third-party AI providers to generate responses. Your data is not used to train AI models.
- When you use our SaaS platform to store contacts/prospects or send tracked emails, you are the controller of that data and we are your processor - see Sections 3 and 11 and the Data Processing Terms in our Terms and Conditions.
- We do not sell your personal data.
The rest of this Policy gives the detail UK GDPR requires.
3. Our Role: Controller vs Processor
Whether we are a "controller" (we decide why and how data is processed) or a "processor" (we process data on someone else's instructions) depends on the activity:
We act as a CONTROLLER for:
- Our website and visitor/enquiry data;
- Account registration, administration, billing, and support;
- Our own direct marketing and communications;
- Training, coaching, consulting, and online learning we deliver directly to individuals;
- Usage analytics and security/operational logs relating to the Services;
- The account-level and usage metadata generated when individuals use the AI Coach;
- Recordings and transcripts of meetings we host (for example coaching or sales calls we run) - see Section 6A.
We act as a PROCESSOR (on behalf of a client organisation, who is the controller) for:
- Contact, prospect, customer, supplier, and stakeholder records that a client stores in the Revenue Engine platform;
- Notes, activity history, opportunities, tasks, and other CRM content a client creates;
- Emails sent through the platform on a client's behalf, and the email engagement data generated by them;
- Content a client's users submit to the AI Coach about third parties (e.g. prospect or meeting information);
- Meeting notes, transcripts, and AI-generated summaries created within the platform on a client's instructions, including recordings and transcripts captured by the notetaker on meetings a client hosts (see Section 6A).
Where we act as a processor, our processing is governed by the Data Processing Terms set out in our Terms and Conditions (which constitute a UK GDPR Article 28 data processing agreement). In that role, the client organisation is responsible for having a lawful basis, providing privacy notices to data subjects, and responding to data subject requests; we assist them as required by law.
If you are an individual whose data a Sales Triage client has stored in our platform (for example, you are a prospect a client has added), Sales Triage is acting as a processor. Please direct your privacy requests to that client (the controller). If you do not know who they are, contact us and we will help identify them and route your request.
4. Personal Data We Collect
Depending on which Services you use, we may process the following categories of personal data.
4.1 Data you provide
- Identity and contact data: name, email address, phone number, job title, employer/company, postal address.
- Account data: username, account credentials (passwords are stored hashed), profile and preferences.
- Billing data: billing name and address, VAT number where you give one, and transaction records. Invoices are raised and held by our accounting provider (Xero). Payment is taken either by Direct Debit through GoCardless or by card against the invoice, which is processed by Stripe through our Stripe account connected to Xero; we do not store full card numbers or bank account details ourselves.
- Service content / coaching data: information you share during coaching, consulting, workshops, or online programmes; enquiries and correspondence.
- AI Coach inputs: questions, business and sales information, prospect and client information, meeting notes, strategy documents, and uploaded files you submit to the AI Coach.
- CRM / platform content: records and information you (or your organisation) enter into the Revenue Engine platform - see Section 10.
4.2 Data we collect automatically
- Technical data: IP address, browser type and version, user-agent string, device information, operating system, time zone, and login records.
- Usage data: pages and features used, actions taken, session duration, and similar analytics. This includes a short-lived server-side visit log - see Section 12.
- Cookie and similar technology data: see Section 12.
- Email engagement data (where applicable): email opens, link clicks, open/click timestamps, device and browser information, user-agent information, and truncated or hashed IP-related metadata - see Section 11.
4.3 Data from third parties
- Data enrichment / prospecting sources: where you or your organisation import or enrich records using third-party providers (e.g. Apollo, Lusha, CRM imports, CSV uploads), that data may include third-party personal data. Responsibility for the lawful sourcing and use of that data sits with the importing organisation - see Section 10.4.
- Service providers and integrations you connect to the Services.
4.4 Special category data
We do not intend to collect special category data (e.g. health, biometric, racial/ethnic, political, religious, or criminal-offence data). Please do not submit such data to the AI Coach or store it in the platform unless we have expressly agreed this in writing.
5. How and Why We Use Your Data (Purposes and Lawful Bases)
We rely on the following lawful bases under Article 6 UK GDPR. (Where we act as a processor - Section 3 - the lawful basis is determined by the client controller, not by us.)
| Purpose | Categories used | Lawful basis |
|---|---|---|
| Responding to enquiries and pre-contract requests | Identity, contact, content | Legitimate interests; steps prior to entering a contract |
| Providing training, coaching, consulting, and online programmes | Identity, contact, content, billing | Performance of a contract |
| Providing and administering AI Coach and platform accounts | Account, technical, usage, AI inputs | Performance of a contract |
| Recording and transcribing meetings we host for follow-up, coaching, and service quality (Section 6A) | Identity, contact, content | Legitimate interests |
| Processing payments and managing billing | Billing, identity | Performance of a contract; legal obligation |
| Keeping accounting/tax records | Billing, identity | Legal obligation (e.g. HMRC retention) |
| Securing the Services, preventing fraud/abuse, troubleshooting | Technical, usage, account | Legitimate interests |
| Sending service/operational messages | Contact, account | Performance of a contract; legitimate interests |
| Direct marketing to business contacts and customers | Identity, contact, usage | Legitimate interests and/or consent (see Section 11 and PECR) |
| Improving and developing our Services | Usage, technical (aggregated/de-identified where possible) | Legitimate interests |
| Establishing, exercising, or defending legal claims; complying with law | As relevant | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You can ask us for more detail about that assessment.
Where we rely on consent (for example, certain cookies or marketing in some circumstances), you may withdraw it at any time without affecting prior processing.
6. The AI Coach and AI Processing
When you use the AI Coach, the text you submit, your prompts/instructions, and any files you upload are transmitted to one or more third-party AI providers via their business/API services to generate a response. Our AI providers currently include OpenAI and Anthropic, and the providers we use may change over time as we develop the Services. Content you submit through an AI feature is not automatically added to a searchable index. Separately, we may set up an assistant with reference material indexed at the provider so it can search that material - that upload is done by us rather than by you, and where an assistant is set up for a particular client it may hold that client's own material and be available only to them. Indexed material of that kind stays at the provider until we remove it. A file you attach to a message is uploaded to the provider for that request rather than indexed.
You should be aware that:
- No model training. We use AI providers' business/API services under terms which mean the data you submit (including messages, prompts, uploaded files, and any indexed content) is not used to train the providers' AI models.
- Limited provider retention. A provider may retain inputs and outputs for a limited period (often up to around 30 days) for abuse and misuse monitoring, after which they are deleted, unless a shorter or zero-retention arrangement applies. Because a conversation continues from the provider's record of the previous turn, that record exists at the provider for the same limited period. Two things persist for longer: reference material we upload for an assistant to search, which stays until we remove it and which may be a particular client's own material where an assistant is set up for them; and a file you attach to a message, which remains in the provider's file storage after the request. We do not currently delete an attached file from the provider once the request is done, and that is listed as an improvement.
- International transfer. Some AI providers process data outside the UK (for example, in the United States). We rely on appropriate safeguards for such transfers - see Section 9.
- AI outputs may be inaccurate. AI-generated responses can be incomplete, out of date, or wrong ("hallucinations"). You must not rely on them as professional, legal, financial, or other regulated advice, and you remain responsible for reviewing outputs before acting on them. This is reflected in our Terms and Conditions.
- Do not submit sensitive or unlawful content. Please do not enter special category data, or data you are not entitled to share, into the AI Coach.
Where the content you submit to the AI Coach concerns third parties and is entered as part of your organisation's use of the platform, your organisation is the controller and we are the processor (Section 3).
6A. Meeting Recording and Transcription (Notetaker)
Where it is enabled, our meeting notetaker can join your online video meetings (for example Zoom, Microsoft Teams, or Google Meet) to capture an audio recording and produce a written transcript of the conversation. Video is not recorded. The notetaker joins as a visible participant, named so that attendees can see a notetaker is present (for example "[Name]'s Notetaker (powered by Sales Triage)").
What we do with it. The transcript is stored against the meeting record in the platform and is processed by our AI providers (see Section 6) to produce summaries, suggested actions, and follow-up drafts. The audio recording itself is held by our meeting provider (Nylas) and accessed through time-limited links; we do not keep the audio file on our own servers. Nylas deletes its copy of the recording and transcript after 14 days. Retention is covered in Section 13.
It captures everyone on the call. Because a recording and transcript reflect what all participants say, they contain the personal data of every attendee, including people who are not Sales Triage users and have not signed up to the Services (for example a prospect or a client's contact who is on the call).
Who is the controller.
- Where Sales Triage hosts the meeting (for example a coaching or sales call we run), Sales Triage is the controller for the attendees' personal data captured in the recording and transcript, and this Policy applies. Our lawful basis is legitimate interests: keeping an accurate record of business meetings for follow-up, coaching, and improving the quality of our Services, weighed against attendees' rights and freedoms. We have assessed that this processing is proportionate; you can ask us for more detail about that assessment.
- Where one of our clients hosts the meeting using the platform, the client is the controller and is responsible for informing their attendees and for having a lawful basis; Sales Triage acts as the processor (Section 3).
Being told, and your choices. We aim to make recording visible rather than hidden: the notetaker appears as a named participant, and the host can choose not to record. If you are on a recorded meeting and would prefer not to be recorded or transcribed, you can ask the host not to record, decline to continue, or contact us (Section 1). Where Sales Triage is the controller, you also have the right to object to this processing (Section 14).
6B. Call Recording and Transcription (Calling and SMS)
Where the Calling and SMS add-on is enabled, calls a user places or receives through the in-browser phone can be recorded, and the recording is transcribed to text so the conversation appears on the relevant contact's timeline for follow-up and coaching. Calls are recorded for training and quality purposes.
What we do with it. The audio recording is held by our telephony provider (Telnyx); we pull it to produce a written transcript through our AI provider (OpenAI) and store that transcript against the call record in the platform. The transcript may then be used by our AI features (see Section 6) to support summaries, suggested actions, and follow-up drafts. Retention is covered in Section 13.
It captures both parties. A call recording and transcript reflect what everyone on the call says, so they contain the personal data of the other party as well as the user, including people who are not Sales Triage users (for example a prospect or a client's contact).
Controller and lawful basis. Where Sales Triage records its own calls, our lawful basis is legitimate interests (Article 6(1)(f) UK GDPR): keeping an accurate record of business calls for follow-up, coaching, and service quality, weighed against the other party's rights and freedoms. Our assessment of that balance is available on request. Where one of our clients records calls using the add-on, the client is the controller and is responsible for informing the people they call and for having a lawful basis; Sales Triage acts as the processor (Section 3).
Being told, and your choices. There is no legal requirement in the United Kingdom to announce a recording when we are a party to the call, and we do not play a separate in-call announcement; recording is disclosed here and in our Terms, and our people may also mention it at the start of a conversation. If you are on a recorded call and would prefer not to be recorded, you can ask the user not to record, decline to continue, or contact us (Section 1). Where Sales Triage is the controller, you also have the right to object to this processing (Section 14).
7. The Revenue Engine Platform (CRM and Prospecting)
When your organisation uses the Revenue Engine platform, it may store and process contact, prospect, customer, supplier, and stakeholder records, together with notes, activity history, opportunities, tasks, communications history, and reporting data.
For this processing, your organisation is the controller and Sales Triage is the processor. See Section 10 for what this means in practice, and the Data Processing Terms in our Terms and Conditions for the full contractual position.
8. Who We Share Data With
We share personal data with the following categories of recipient, under appropriate contracts:
- Subprocessors and service providers who help us run the Services (see the list below);
- Our accounting provider (Xero), which raises and holds your invoices, and our payment processors (GoCardless for Direct Debit, Stripe for card payment against an invoice);
- Our professional advisers (lawyers, accountants, insurers) where necessary;
- Authorities, regulators, or law enforcement where required by law, or to protect our rights, safety, or property;
- A buyer or successor in the event of a merger, acquisition, or business reorganisation, subject to confidentiality.
We do not sell personal data, and we do not share it for third-party advertising.
Current subprocessors / key providers
The list below is maintained in code (the same source that drives our Security and Transparency pages), so it stays current and consistent wherever it is shown:
Anthropic
- Their role
- A processor: they handle data only on our instructions, under a data processing agreement with us.
- What we use them for
- Powers our AI features - drafting emails, analysing meeting transcripts, and generating playbooks and reports.
- What we share with them
- The content you put into AI features, which can include messages, meeting transcripts, and CRM notes.
- Where they process data
- United States
- How transfers out of the UK are safeguarded
- UK Addendum to the EU SCCs, incorporated at Schedule 3 of the Anthropic DPA.
- Data processing agreement
- View the agreement
Apollo
- Their role
- A processor: they handle data only on our instructions, under a data processing agreement with us.
- What we use them for
- An alternative provider for discovering and enriching the prospects you choose to research.
- What we share with them
- Contact identifiers such as name, company, and work email used to retrieve professional information.
- Where they process data
- United States
- How transfers out of the UK are safeguarded
- UK Transfer Addendum (the ICO IDTA of 21 March 2022), named in the Apollo DPA, which is incorporated into their terms of service.
- Data processing agreement
- View the agreement
Bunny.net
- Their role
- A processor: they handle data only on our instructions, under a data processing agreement with us.
- What we use them for
- Hosts and streams the video messages you record in the platform.
- What we share with them
- The video and audio you record, along with video titles and thumbnail images.
- Where they process data
- United Kingdom and European Union (storage in London and Frankfurt, with EU-only delivery routing).
- How transfers out of the UK are safeguarded
- Storage is pinned to London and Frankfurt. The UK leg is domestic, and the Frankfurt leg is a transfer to the EEA, which the UK adequacy regulations cover, so no IDTA or UK Addendum is needed. That matters because the signed DPA names no instrument of its own: it instead treats the account's region settings as our documented instruction (sections 3 and 9), while section 4.6 reserves processing 'from anywhere in the world'. The region setting is therefore the safeguard, and changing it would leave global processing with nothing behind it.
Companies House
- Their role
- A public data source: we read information they publish. They do not process anything on our behalf.
- What we use them for
- Looks up UK company information when you research and add prospects.
- What we share with them
- The company names and registration numbers you search for.
- Where they process data
- United Kingdom
- How transfers out of the UK are safeguarded
- United Kingdom only - no restricted transfer.
Exa
- Their role
- A processor: they handle data only on our instructions, under a data processing agreement with us.
- What we use them for
- An alternative provider for discovering companies and searching news when you research prospects.
- What we share with them
- The company names, search terms, and ideal-prospect criteria used to find companies and relevant news.
- Where they process data
- United States
- How transfers out of the UK are safeguarded
- UK IDTA to the EU SCCs (version B.1.0), named in the Exa DPA, which is incorporated into their terms of service.
- Data processing agreement
- View the agreement
Fasthosts
- Their role
- A processor: they handle data only on our instructions, under a data processing agreement with us.
- What we use them for
- Provides the UK virtual server that hosts the application and database during beta.
- What we share with them
- All platform data is hosted on this server, including the records and notes you store.
- Where they process data
- United Kingdom
- How transfers out of the UK are safeguarded
- United Kingdom only - no restricted transfer.
- Data processing agreement
- View the agreement
GoCardless
- Their role
- An independent controller: they decide their own purposes for the data, so they answer for it directly rather than processing it on our instructions.
- What we use them for
- Collects payment by Direct Debit for invoices raised through Xero.
- What we share with them
- Your name, email address, billing address, bank account details, and the invoices collected against your account.
- Where they process data
- United Kingdom and European Union
- How transfers out of the UK are safeguarded
- United Kingdom and European Economic Area processing, relied on under adequacy. GoCardless is an independent controller, so no Article 28 transfer instrument applies between us.
Lusha
- Their role
- A processor: they handle data only on our instructions, under a data processing agreement with us.
- What we use them for
- An alternative provider for enriching the prospect and contact records you choose to research.
- What we share with them
- Contact identifiers such as name, company, and work email used to retrieve professional information.
- Where they process data
- United States and European Union
- How transfers out of the UK are safeguarded
- UK IDTA to the EU SCCs (version B.1.0), named in the Lusha DPA, which is incorporated into the master services agreement.
- Data processing agreement
- View the agreement
Microsoft OneDrive
- Their role
- A processor: they handle data only on our instructions, under a data processing agreement with us.
- What we use them for
- Stores offsite backup copies of the platform.
- What we share with them
- Backup copies of the platform database, which contain the data you store in the platform.
- Where they process data
- United Kingdom
- How transfers out of the UK are safeguarded
- IDTA implemented by Microsoft, per the Microsoft Products and Services Data Protection Addendum, which applies automatically to a Microsoft 365 business tenant.
- Data processing agreement
- View the agreement
Mux
- Their role
- A processor: they handle data only on our instructions, under a data processing agreement with us.
- What we use them for
- Streams webinars - ingesting the live broadcast, delivering it to attendees, and storing the recording.
- What we share with them
- The live video and audio you broadcast and its recording, and the IP address and player/device information of each attendee who watches the stream.
- Where they process data
- United States
Nylas
- Their role
- A processor: they handle data only on our instructions, under a data processing agreement with us.
- What we use them for
- Connects your email inbox and calendar so you can send messages and manage meetings from inside the app, and powers the meeting notetaker that records and transcribes online meetings.
- What we share with them
- Email content, calendar events, and contact details from the inbox you connect, and the audio recording and transcript of meetings the notetaker joins.
- Where they process data
- United Kingdom (London, where they host their EU region), with limited access from the United States or Canada when a support ticket needs it.
- How transfers out of the UK are safeguarded
- UK Addendum to the EU Standard Contractual Clauses, incorporated at Annex III of Exhibit B to the Data Processing Addendum signed 8 October 2026. The Clauses are signed for both Module Two and Module Three, so they cover the data we control and the data we process on behalf of a client. The account is set to their EU region, which Nylas confirmed on 9 October 2026 is hosted in London, so application data, connector data and grant information are stored in the UK and storage itself is not a restricted transfer. The EU and US regions are isolated with no data moved between them. The only routine transfer out is a support engineer outside the UK reading error logs on a support ticket, which the Clauses govern. Nylas is additionally certified under the UK Extension to the EU-U.S. Data Privacy Framework; the signed Clauses are the primary instrument and the certification a secondary basis. The region is fixed for the life of the application: moving it would mean creating a new application and every user reconnecting their inbox, so it cannot change without us knowing.
OpenAI
- Their role
- A processor: they handle data only on our instructions, under a data processing agreement with us.
- What we use them for
- An alternative AI provider for the same drafting, analysis, and generation features, and transcribes recorded calls to text.
- What we share with them
- The content you put into AI features, which can include messages, meeting transcripts, and CRM notes, and the audio of recorded calls, which is transcribed to text.
- Where they process data
- United States
- How transfers out of the UK are safeguarded
- UK Addendum to the EU SCCs, defined and incorporated in the OpenAI DPA.
- Data processing agreement
- View the agreement
Stripe
- Their role
- Both, depending on what they are doing: they follow our instructions for part of it, and decide their own purposes for the rest - a payment provider deciding how to screen a card payment for fraud, for example.
- What we use them for
- Takes card payment against an invoice. Our Stripe account is connected to Xero, so the "Pay now" link on an invoice is processed by Stripe.
- What we share with them
- The payer's name and email address, billing address, the amount and reference of the invoice being paid, and the card details entered to pay it. We never see or hold the full card number.
- Where they process data
- United States and European Union
- How transfers out of the UK are safeguarded
- UK International Data Transfer Addendum, via the Data Transfers Addendum incorporated into the Stripe DPA.
- Data processing agreement
- View the agreement
Tavily
- Their role
- A processor: they handle data only on our instructions, under a data processing agreement with us.
- What we use them for
- Searches the web for company news and context when you research prospects.
- What we share with them
- The company names and search terms used to find relevant news.
- Where they process data
- United States
Telnyx
- Their role
- A processor: they handle data only on our instructions, under a data processing agreement with us.
- What we use them for
- Powers the Calling and SMS add-on - in-browser calling, call recording, and text messaging.
- What we share with them
- The phone numbers you dial or text, the content of text messages, and the audio recordings of calls, which are recorded for training and quality. Recordings are stored in a Telnyx-managed store whose region is not customer-selectable.
- Where they process data
- United States and European Union
- How transfers out of the UK are safeguarded
- UK International Data Transfer Addendum to the EU SCCs, at Schedule 3 of the Telnyx DPA.
- Data processing agreement
- View the agreement
Xero
- Their role
- A processor: they handle data only on our instructions, under a data processing agreement with us.
- What we use them for
- Raises and sends your invoices, and holds them as our accounting records. Card payment against an invoice is passed to the payment service connected to Xero (Stripe); Direct Debit collection is passed to GoCardless.
- What we share with them
- Your organisation name, billing contact email, billing address, VAT number where you have given one, and the invoices raised against your account.
- Where they process data
- New Zealand, Australia, United States and European Union
- How transfers out of the UK are safeguarded
- UK Addendum to the EU SCCs, named in the Xero data processing terms; New Zealand relied on under adequacy.
- Data processing agreement
- View the agreement
Apollo, Lusha and similar prospecting/enrichment tools are generally used by clients as their own data sources, not as Sales Triage subprocessors. Where a client imports or enriches data using such tools, the client is responsible for the lawful sourcing and use of that data (Section 10.4).
We use, or may use, the AI providers listed above, and route personal data to a given provider only once it is engaged under an appropriate data processing agreement. We keep an up-to-date list of subprocessors and will inform platform clients of material changes as set out in our Data Processing Terms.
9. International Transfers
Some of our providers process data outside the UK (for example, in the United States). Where we transfer personal data outside the UK, we ensure an appropriate safeguard is in place, such as:
- transfers to a country covered by UK adequacy regulations; or
- the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment where appropriate.
You can request more information about the safeguards that apply by contacting us.
10. Platform Data - Responsibilities (Controller/Processor Detail)
This section applies where your organisation uses the Revenue Engine platform.
10.1 Your organisation is the controller
You decide what data to store, why, and on what lawful basis. We process it on your documented instructions to provide the Services.
10.2 Your responsibilities
As controller, you are responsible for:
- having and documenting a lawful basis for processing the personal data you store and for any marketing you send;
- providing your own privacy notice to your contacts/prospects and keeping any privacy-notice URL configured in the platform accurate and accessible;
- ensuring the accuracy and legality of the data you enter;
- obtaining any consents required (including for cookies/tracking and certain marketing);
- handling data subject requests relating to that data (we assist you).
10.3 Our responsibilities
As processor, we:
- process the data only on your instructions and as needed to provide the Services;
- apply appropriate technical and organisational security measures;
- use only approved subprocessors under equivalent obligations;
- assist you with security, breach notification, data subject requests, and (where applicable) impact assessments;
- return or delete the data at the end of the relationship, subject to the export window in our Terms. We provide this export on request; a self-serve export is in development.
10.4 Prospecting and enrichment data
Where you import or enrich records (e.g. via CSV upload, CRM import, or providers such as Apollo or Lusha), you warrant that you have a lawful basis to obtain and use that data and that doing so complies with UK GDPR, PECR, and any applicable laws in the recipient's jurisdiction. Sales Triage does not verify the lawfulness of data you import.
10.5 Your client protection list
Your organisation can upload the website addresses of its existing clients so that nobody in your organisation can add them as a prospect, and so our Suspect Finder never puts them forward.
We do not store those addresses. Each one is converted to a one-way fingerprint (an HMAC-SHA256 value computed under a secret key held outside the database) and only the fingerprint is kept. We cannot read the list back, export it, or show it to you - which is why removing an entry means typing the address again so we can fingerprint it and match it. Nothing on the list is sent to any third party, and it is never written to our logs.
Separately, you may choose to let us keep a small number of clients by name so that "find companies like our best clients" has something to learn from. That is opt-in per company and off by default. For a company you tick, we store its name and website address in the ordinary way, and we may send the website address to a discovery provider (see Section 8) to look for similar companies. Companies you do not tick remain fingerprints and nothing else.
11. Email Sending and Engagement Tracking
Where the platform sends emails on a user's behalf (including one-to-one, prospecting, follow-up, nurture, and workflow-generated emails) and tracks engagement, we may process:
- email addresses and delivery status;
- email open events and timestamps;
- link click events, timestamps, and clicked URLs;
- device, browser, and user-agent information;
- truncated or hashed IP-related metadata;
- opt-out, objection, suppression, and tracking-preference records.
How emails are sent. Emails are sent through each user's own connected mailbox (Google/Gmail or Microsoft/Outlook) using a secure OAuth connection the user authorises. The platform adds tracking and compliance elements. The user's mailbox provider processes the message under the user's own agreement with that provider; Sales Triage does not operate a separate bulk-sending service.
Roles and lawful basis:
- For emails our clients send through the platform, the client is the controller and is responsible for the lawful basis (typically legitimate interests supported by an assessment, or consent where required) and for PECR compliance. We are the processor.
- For our own marketing emails, Sales Triage is the controller and relies on legitimate interests and/or consent, applying the PECR "soft opt-in" to existing customers where it is available, and always providing an unsubscribe option.
Controls. The platform can insert compliance disclosures, "why am I receiving this?" notices, unsubscribe/objection links, and preference mechanisms. These must not be removed or circumvented, and recorded opt-outs must be honoured (see our Terms and Conditions).
A cookie consent banner (provided by CookieYes) is deployed on our website; non-essential website cookies, including analytics, are set only where you have consented (see Section 12). Email open/click tracking, described in this Section 11, is a separate mechanism that uses pixels and tracked links within emails rather than website cookies, and is governed by the lawful bases set out above.
12. Cookies and Similar Technologies
Cookies are small files placed on your device. We use cookies and similar technologies (such as pixels and local storage) to operate the website, keep it secure, understand how it is used, and support embedded content.
When you visit https://salestriage.co.uk, a cookie consent banner (provided by CookieYes) is displayed and links to this Privacy Policy. Strictly necessary cookies are always active; non-essential cookies (such as analytics and embedded media) are not set until you consent to them. You can Accept all, Reject all, or Customise your choice by category, and you can change or withdraw your consent at any time using the cookie settings link in our website footer.
The categories of cookies we use are:
| Category | Purpose | Examples | Consent needed? |
|---|---|---|---|
| Necessary | Logging you in, maintaining your session, security, and remembering your cookie choices | Session, security, and consent-state cookies | No - always on |
| Functional | Enabling embedded media and remembering preferences | YouTube / Vimeo embeds | Yes |
| Analytics | Understanding how visitors use the site so we can improve it | Google Analytics (e.g. _ga, _gid) | Yes |
| Advertisement | Categorising any advertising or retargeting cookies | Not currently in active use | Yes |
Analytics and functional cookies are set only where you have consented. We do not currently use advertising or retargeting cookies; the Advertisement category appears in our consent tool but holds no active cookies at present. Our consent tool may also list an "Uncategorised" group for any cookies it has not yet classified.
Embedded content (e.g. videos from YouTube or Vimeo) may set its own cookies and behaves as if you had visited the third-party site; it is governed by that third party's privacy policy.
Email tracking uses pixels and tracked links within emails rather than website cookies - see Section 11.
Separately from cookies, our web server keeps a short-lived visit log so we can see how many people are on the website and which pages are busy. For each page view by a visitor who is not signed in it records a keyed hash of the IP address (the raw address is not stored and the hash cannot be reversed without our secret key), the page path (not the query string), the browser user-agent string and the time. No cookie is set on your device and nothing is placed on it. The one cookie connected with this log is set only on our own staff's browsers, by them, from inside our admin area, so that their own visits stay out of the log; it holds no identifier and is never set on a visitor's device. The log is visible only to our platform operator, is used to spot returning visitors and busy pages, and may indicate that a visit could be from a business contact who previously clicked a tracked link or made a booking from the same address - a possibility rather than an identification, and never for a contact who has opted out of tracking. We rely on legitimate interests (understanding use of our website) for this, and the log is deleted after 30 days.
You can also control or delete cookies through your browser settings, though blocking strictly necessary cookies may affect how the website works.
13. How Long We Keep Data (Retention)
We keep personal data only as long as necessary for the purposes set out in this Policy, then delete or anonymise it. Our indicative retention periods are:
| Data | Indicative retention |
|---|---|
| Account data | For the life of the account, then up to 6 years |
| Billing / accounting records | 6 years (HMRC requirement) |
| Enquiries / support correspondence | Up to 24 months |
| Marketing contacts | Until you object/unsubscribe, reviewed periodically |
| Suppression / opt-out records | Retained as long as needed to honour the opt-out |
| Client platform data (as processor) | Kept for as long as the client's account is open, because the client decides what to keep and for how long. There is no automatic expiry, and no setting in the platform that applies one. A client can ask us to delete specific records, a specific individual's data, or a date range at any time, and we carry that out; we also act on any retention instruction a client gives us. On termination the data is available for export or return for up to 30 days and is then deleted (see Terms). Export is provided on request rather than self-serve. |
| AI Coach inputs/outputs (provider side) | A limited period for abuse monitoring (often up to ~30 days). Reference material we upload for an assistant to search persists until we remove it, and may be a particular client's own material where an assistant is set up for them. A file you attach to a message remains in the provider's file storage after the request; we do not currently delete it (see Section 6) |
| Connected inbox and calendar data (provider side) | For a mailbox connected by IMAP rather than Google or Microsoft, our email and calendar provider (Nylas) keeps a rolling copy of the most recent 90 days of messages. Its database backups are kept for 7 days. |
| Meeting recordings and transcripts (Section 6A) | No fixed statutory period applies; we keep them no longer than necessary. Audio is held by our meeting provider behind time-limited links and is not retained by us; the provider deletes its copy of the recording and transcript after 14 days, and its own backups are kept for 7 days. The transcript we store is kept for the life of the associated meeting record and then deleted. As client platform data, it follows the export/deletion position in this table and in our Terms. |
| Call recordings and transcripts (Section 6B) | No fixed statutory period applies; we keep them no longer than necessary. The audio is held by our telephony provider; the transcript is kept for the life of the associated call record and then deleted. As client platform data, it follows the export/deletion position in this table and in our Terms. |
| Website/usage analytics | Typically 14-26 months |
| Server-side visit log (hashed IP, Section 12) | 30 days |
| Security/access logs | Typically up to 12 months |
We may keep data longer where required to comply with law or to establish, exercise, or defend legal claims.
14. Your Rights
Under UK data protection law you have the right to:
- Access the personal data we hold about you;
- Request rectification of inaccurate or incomplete data;
- Request erasure ("right to be forgotten") in certain circumstances;
- Request restriction of processing;
- Object to processing based on legitimate interests, and to direct marketing at any time;
- Request data portability for data you provided, where applicable;
- Withdraw consent at any time where we rely on consent;
- Not be subject to solely automated decisions producing legal or similarly significant effects (we do not currently make such decisions).
To exercise any right, contact us using the details in Section 1. We will respond within one month (extendable for complex requests). There is normally no charge. We may need to verify your identity.
Where the data is held by us as a processor on a client's behalf, we will refer your request to that client (the controller) and assist them in responding.
Complaints. You can complain to us first, and we will try to resolve it. You also have the right to complain to the UK Information Commissioner's Office (ICO) at https://ico.org.uk or 0303 123 1113.
15. Security
We implement reasonable technical and organisational measures to protect personal data, including access controls, multi-factor authentication, encryption in transit, hashed passwords, encryption at rest for stored API credentials, integration secrets and mailbox tokens, tested backups, and the use of reputable infrastructure providers. Our current security posture, including both the controls that are in place and the ones we have not yet built, is described on our Security and Transparency pages. No system can be guaranteed completely secure, and we cannot warrant that the Services will be free from unauthorised access or breach. We maintain procedures to detect, report, and respond to personal data breaches as required by law.
16. Children
The Services are intended for business and professional users and are not directed at children under 18. We do not knowingly collect data from children.
17. Changes to This Policy
We may update this Policy from time to time. We will post the updated version here with a revised "Last updated" date and, where changes are significant, take reasonable steps to notify you.
18. Contact
For any privacy question or to exercise your rights, contact:
Tech Brand Limited t/a Sales Triage - paul@salestriage.co.uk Suite 525, 5 The High St, Maidenhead, SL6 1JN, United Kingdom
Copyright Tech Brand Limited t/a Sales Triage. All rights reserved. VAT Registration Number: 505 5342 16.
