Privacy notice

Who we are

Investment Tribe Limited, trading as Tribe Tech, is the controller for our own enquiries, business outreach, account administration, billing, security and service correspondence. When we host or handle your organisation's customer, staff, supplier or audience data on your instructions, you normally remain the controller and we act as your processor under the applicable data-processing agreement. Our company number is SC626291 and our registered office is 25A Thistle Street South West Lane, Edinburgh, EH2 1EW. Privacy questions can be sent to support@tribetech.app.

If we emailed your business

We email some UK companies to offer our website service. If we emailed your business, this section explains what we hold, where it came from, why we use it and how to stop it. Investment Tribe Limited, trading as Tribe Tech, is the controller. We are registered with the Information Commissioner's Office under registration number ZB106072.

Where your details come from. We find companies on Companies House, the public register of UK companies, and find their website through a web search. From Companies House we use the company name and number, registered office, company type, status, business activity codes and, where we address an email to a named person, the names of directors. From your own website we use the business email address and phone number you publish, the name and role of any contact it gives, your services, the areas you cover, your accreditations and, if we prepare a homepage concept for you, your logo, photos and wording. We email limited companies and LLPs at business email addresses only.

What we keep. The details above, notes about your public website, any homepage concept we prepare for you, and a record of the emails we send you and any reply, including a request to stop. We do not track whether you open our emails or click their links. Checkout links in our emails and on your homepage concept say which business they are for: if you start a checkout from one, we record that checkout against your details and, if you pay, mark you as a customer. Following a link without starting a checkout records nothing.

Homepage concepts. We may prepare a homepage concept for your business from your public website, before or after we email you. We publish it at an unlisted address that is not linked from our website and asks search engines not to index it, so that we can send you the link. It is not your live website.

Why we use it. Our lawful basis is legitimate interests: offering our website service to businesses it could help. We use only publicly available business information, send a short series of emails, say in every email who we are and how to stop, and stop when you ask.

Who handles it for us. Instantly sends our emails, checks that an address can receive email before we use it, and records replies, bounces and opt-outs. Google Workspace hosts the mailboxes our emails come from and where replies arrive, including support@tribetech.app. Anthropic and OpenAI provide the AI services that help us review your public website, write our emails, sort replies and prepare homepage concepts. Cloudflare hosts our website, the homepage concepts and the database that holds these records. GitHub stores our source code, including homepage concepts, and runs our automated checks. Some of these providers process information outside the UK, including in the United States; see International transfers below.

How long we keep it. If you never reply, we delete your details, and take down any homepage concept we prepared for you, within 12 months of when we first collected them. If you reply, we keep the conversation for up to 12 months after your last message, unless you become a customer, when the rest of this notice applies. If you ask us to stop, we mark your record do-not-contact so that we never contact you again; after 12 months it holds only your email address, business name and the date you asked.

How to stop our emails. Reply “no” to any of our emails, or email support@tribetech.app. Any reply stops the rest of that series automatically. When you ask us to stop, we add your address to a permanent do-not-contact list, which our email service also blocks.

Your rights. You can ask for a copy of what we hold about you, and ask us to correct it, delete it or restrict how we use it. You can object at any time; an objection to marketing is always upheld, and we stop. Our systems choose which companies to email from public company information, but we make no decision about you that has a legal or similarly significant effect. To use your rights, or to ask for a copy of the safeguards for international transfers, email support@tribetech.app. You can also complain to the Information Commissioner's Office.

Preview requests

If you ask for a homepage preview on our website, this section explains what we hold, why we use it, how long we keep it and how to stop it. Investment Tribe Limited, trading as Tribe Tech, is the controller.

What we collect. Your business name or website, your town or city, your email address, the style you pick, any website you tell us you like, whether you ticked “Just send the preview”, and how you found us: the campaign details in the link you followed and, if you came from a Google ad, the Google click ID in that link. To stop misuse of the form, we also keep a scrambled form of your connection's IP address for up to two hours.

Where your preview comes from. We build it only from your business's own public website: the address you give us or, if you don't give one, the website at your email address's domain. We take your logo, colours, photos and details from that site as they are, and never from Google, Facebook or directories. If we can't find your site, we ask you for it.

Why we use it. To make your homepage preview, email it to you and follow up about it, unless you ticked “Just send the preview”, when we send the preview and don't follow up. We use how you found us to see which of our adverts bring requests.

Our lawful basis. Making and sending your preview are steps you asked us to take before entering into a contract. Following up about it, and seeing which adverts bring requests, are in our legitimate interests. You can object at any time.

Who handles it. Tribe Tech, plus our email and hosting providers: Google Workspace sends approved preview emails from our support mailbox and receives your replies. Instantly handles existing preview campaigns, marketing follow-ups and our global opt-out list. Cloudflare hosts our website, the database that holds your request and your preview. GitHub runs the software that builds your preview, and Anthropic provides the AI service that helps design it. Some of these providers process information outside the UK; see International transfers below.

How long we keep it. 12 months from your request if you don't start a plan, then we delete it. If you start a plan, the rest of this notice applies.

How to stop. Reply “no” to any of our emails, or email support@tribetech.app, and we'll stop. Your rights below apply too.

Client information and your instructions

Our service terms include a client data-processing schedule for orders accepting that version. A separately agreed or existing processing agreement takes priority for the data it covers. The order, enabled features and saved instructions identify the processing. We do not use your private customer records for our advertising or authorise their use to train general-purpose AI models. High-risk or sensitive datasets need a separately agreed scope and safeguards.

If your information is held in one of our clients' websites or workspaces, contact that organisation about its purposes, notices and your rights. We help it respond and can direct a request to it. Our privacy notice does not replace that organisation's own notice.

Information we use

We use the contact and business details you provide, account and security records, project briefs, comments, prompts, uploaded reference files, website versions, activity records, billing status, transaction history and support correspondence. We do not receive or store your full card details.

Why we use it

We process information where it is needed to perform our contract with you, to comply with legal and accounting duties, and for our legitimate interests in securing, operating, supporting and improving the service. We rely on consent for optional advertising measurement and your optional choice to have a voice recording transcribed. Browser microphone permission is a device control, separate from the information and choice we provide about transcription. You may withdraw consent without affecting earlier lawful processing.

Website projects, AI and voice

Project briefs, instructions, comments, prompts, reference files and website versions are used to create, review, host and improve the website you requested. Where an AI-assisted feature or transcription is used, only the material needed for that task is sent to the relevant service. Voice recordings are used to create an editable transcript; you can review and change it before submitting your brief.

Website and Operations Hub creation, revisions, strategy, articles and other AI features may send relevant instructions, reference content and saved drafts to the configured OpenAI or Anthropic commercial service. Supported voice transcription also uses Cloudflare Workers AI. We do not authorise providers to train their general-purpose models on confidential client content. Their service retention and safety-processing rules still apply; zero retention or a specific processing region is not assumed. Do not include passwords, API keys, real customer databases or sensitive records in a build brief.

Uploads, previews and website transfers

Uploaded photographs, including supported HEIC files, and reference documents may be converted, resized or have relevant text extracted for the task you request. Files can contain people's information and embedded metadata; remove anything unnecessary before uploading. Private comments, briefs, chats and reference documents are not public page content merely because they are uploaded. Authorised team members and invited reviewers can access the material their role permits.

Materials selected for a published website become available to its visitors and may be cached or indexed elsewhere. A public staging or preview address should not contain confidential records: asking search engines not to index it is not a password or an access restriction. Keep important originals independently of the service.

For an authorised existing-website transfer, we retrieve public page files and supported assets and keep source copies, checksums, comparison results and draft versions for review and recovery. Private databases and authenticated areas are not downloaded by a public transfer. Direct copying does not send the site through AI generation; an optional AI reconstruction requires your express authorisation.

Social Studio early access

If you join the Social Studio early-access list, we store your email address, signup time and the consent you gave. We use these details to send Social Studio early-access invitations and launch updates. To leave the list or ask us to remove your signup, email support@tribetech.app.

Optional checkout reminders

If you request checkout reminders, we record your choice and use your checkout email to send up to two reminders. These include a link back to checkout and an unsubscribe option. We stop the campaign when payment is confirmed or you opt out. Starting a checkout without requesting reminders does not enrol you.

Your Operations Hub and connected email

If your plan includes a custom Operations Hub business system, we store the customer details, notes, follow-up dates and workspace settings you choose to add. You are responsible for having a lawful basis to use your customers' information and contact them. We process these records to provide your private workspace and carry out your instructions.

Connecting your email is optional. Where available, you can authorise Google or Microsoft, or provide your email provider's secure outgoing-mail settings. We use your mailbox identity to identify the sender and the permission or credentials you provide to send messages you explicitly review and approve. The Google connection requests your verified email address and permission to send email; it does not request access to read, import or delete your inbox.

We retain the connected email address, encrypted authorisation tokens or outgoing-mail credentials, and a private record of messages you prepare in the Operations Hub. That record includes the sender, recipient, subject, encrypted message body, your approval, sending status and the provider's message reference where available. The message is shared with your chosen email provider and intended recipient when you approve sending. Provider acceptance does not confirm delivery or that a recipient has read the message.

Connected-mail data is used to provide this feature and its security and support. We do not sell it, use it for advertising, or use it to train general-purpose AI models. Tribe Tech's handling and transfer of data received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Staff access to such data is restricted to your specific permission or where necessary for security or legal obligations.

You can disconnect a mailbox in your Operations Hub and revoke access through your email provider. Disconnecting removes the saved connection credentials; it does not erase your private message history or recall messages already sent. To request deletion of stored Operations Hub or message records, contact support@tribetech.app. Retention obligations described below may still apply, and your provider and recipients manage their own copies.

Payments

Revolut provides the hosted checkout and processes payment details. We receive the identifiers, amounts, currency, tax, refunds and subscription status needed to administer your plan, answer billing questions and keep accurate records.

Website traffic measurement

We use Cloudflare Web Analytics for aggregate page views, visits, referring websites, countries and device types. It does not use analytics cookies or browser storage to identify individual visitors. Our dashboards exclude private account and Studio pages, detected bots and URL query strings. Aggregate collection is enabled worldwide, including the UK, on supported connected sites. A visit is not an identified person; repeat activity, browser blocking, processing delays and provider definitions affect what is measured. Client dashboards show their own connected sites; authorised Tribe Tech administrators can access the data needed to operate and support the service. This reporting is separate from optional Google Ads and Meta advertising measurement.

Search performance connections

When an organisation connects its own Google Search Console property, its property owner grants our dedicated reader read-only access. We store the selected property, dated search clicks and impressions, query and page statistics, coverage limitations and connection status for that organisation. Search observations are separate from website visits, identified people and enquiry attribution. Selected observations may be used by our configured AI providers to plan that organisation's SEO work; search queries are treated as untrusted data, not instructions or evidence for claims about the business.

Client dashboard performance snapshots are replaced on refresh and expire after 100 days without a successful import. Selected dated observations retained as evidence in SEO work records, together with connection and audit records, follow the project and account retention described below. Disconnecting in Tribe Tech stops new imports and hides the saved results; it does not remove the reader's permission at Google. The property owner can remove that permission in Search Console's Users and permissions screen. Requests to return or delete retained client data follow the organisation's processing agreement and the contact route below.

Optional advertising measurement

Fresh optional consent also permits server-confirmed first-payment measurement through Meta's Conversions API, including when you do not return to our website after paying. Limited connection and advertising identifiers are kept for up to seven days, and deleted earlier after reporting or withdrawal. Minimal transaction/delivery records remain for up to 30 days to prevent duplicate reporting. Older browser-only permission does not enable this server reporting. See the cookie policy for withdrawal, retention and connection-failure details.

With your optional consent, we use Google Ads and Meta to measure ad visits, successfully saved enquiries, homepage previews we send in reply, checkout handoffs and verified purchases and to improve advertising delivery. Measurement uses ad-click identifiers, limited public page and browser information, purchase value and currency, and the selected enquiry service category and a non-secret transaction or enquiry reference. Meta may match these events to activity on Facebook or Instagram. We do not send names, email addresses, card details, private access links, project content or Operations Hub data in conversion events. We do not enable automatic advanced matching or automatic event creation; Google personalised-advertising signals and enhanced conversions remain disabled. Previous Google-only permission does not authorise Meta. You can withdraw consent through “Cookie settings” in the footer. See our cookie policy, Google's privacy information and Meta's privacy policy.

Who processes information for us

We use carefully selected providers where needed to deliver the service, including Cloudflare for hosting, security and platform data; Revolut for payments; Instantly for our business outreach email; GitHub for source control, build workflows and saved job artifacts; Google Workspace for email, including our outreach mailboxes, and collaboration; OpenAI and Anthropic for the configured AI-assisted features; and Cloudflare Workers AI for supported transcription. Your chosen Google, Microsoft or other supported email or software provider receives information needed for an authorised connection or action. Registrars, connected social networks and advertising platforms may process data under their own policies. Professional advisers, regulators or authorities may receive information where required by law.

Provider information is available from Cloudflare, Instantly, GitHub, OpenAI's API data controls and Anthropic's commercial privacy information. These policies do not replace our obligations for data we process for you. Contact us for the providers, locations and safeguards applicable to your order; new or replacement sub-processors are handled under the applicable processing agreement.

International transfers

Some providers use global infrastructure or process information outside the UK or EEA. We do not promise UK-only storage. Where UK adequacy regulations do not apply, we use an appropriate safeguard such as the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, and proportionate technical and organisational measures, together with the required transfer assessment. For data subject to EU GDPR, the relevant adequacy decision or EU standard contractual clauses and required safeguards may apply. Agree any particular residency or transfer requirements before supplying the affected data. Accepting service terms is not consent to unrestricted international transfers. You can ask us for a copy of the safeguards we rely on by emailing support@tribetech.app.

How long we keep it

We keep active account and project records while the service is being delivered. Access sessions expire and are removed on a rolling basis. After the service ends, our own account and support records are retained only for as long as reasonably needed for handover, security, dispute handling and legal claims; billing and tax records are kept for the period required by law. We may retain anonymised statistics that no longer identify anyone. Records about businesses we have researched or emailed follow the limits in If we emailed your business.

Client personal data held on behalf of an organisation is returned or deleted under its processing agreement, with legally required records retained only as permitted. Source copies, uploaded references and saved drafts are retained for the active service and its agreed recovery or handover needs. Client-build artifacts currently have a retention window of up to 90 days in GitHub; that is not a deletion promise for every project record or provider. Retained backup copies awaiting safe deletion are kept beyond ordinary use and removed on the applicable deletion cycle. Contact us to arrange a return or deletion and confirm the relevant timetable.

Disconnecting a mailbox, resolving a comment or deleting a draft does not recall published content, sent messages or another provider's lawful records. Removing public material from our service cannot guarantee immediate removal of search results, caches or recipient copies.

Your rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability or objection, and you may withdraw consent. Contact support@tribetech.app to make a request. We may need to confirm your identity and may retain information where the law requires it.

International users may also have applicable local privacy rights. We do not sell personal information. Optional advertising measurement involves Google and Meta as described above; use the privacy settings to control that choice. A request involving a client's own customers is handled with that client under its instructions and applicable law.

You can complain to the Information Commissioner's Office. We would appreciate the chance to resolve the concern first.

Automated decisions and security

We do not use personal information to make solely automated decisions that produce legal or similarly significant effects. We use access controls, encryption in transit, activity records and service monitoring to protect the platform, but no online service can guarantee absolute security. Keep login and invitation links private and tell us promptly if you suspect misuse.

We use recorded permissions, protected connection credentials, restricted build access and testing to reduce risk. AI assists with drafts, checks and recovery; a build report is not a security or legal certification. If we become aware of a personal-data breach affecting client data, we notify the client without undue delay and cooperate with the response. Required notifications for information we control are handled under the applicable law.