Privacy policy
Last updated: 9th November 2026
INTRODUCTION
This privacy policy is provided by Delphio Ltd, a company registered in England and Wales under company number 17363341, whose registered office is at 66 Paul Street, London EC2A 4NA (Delphio, we, our or us).
Delphio provides a marketing effectiveness platform that uses marketing mix modelling to help businesses understand and plan their marketing investment, together with related consulting services. Our services are for businesses only.
This policy explains how and why we collect, use, share and store information relating to you (your personal data), your rights, and how to contact us or a regulator if you have a complaint. Our use of personal data is regulated by the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where it applies, the EU General Data Protection Regulation (EU GDPR).
For the personal data described in this policy, we are the controller, meaning we decide how and why it is used.
Privacy contact: jeremy.pounder@delphio.ai
ICO registration number: ZC286999
WHAT THIS POLICY COVERS
This policy applies to personal data we collect:
when you visit our website, delphio.ai (Website);
when you hold or use an account on our platform at app.delphio.ai (Platform), usually because your employer or your employer’s agency is our customer;
when you contact us, ask for a demo, sign up to our updates or attend our events; and
in our dealings with business contacts, including customers, prospective customers, partners and suppliers, and job applicants.
Data we process for our customers. This policy does not cover the data our customers upload to the Platform, connect to it from their advertising and sales accounts, or send to us for a consulting project (Customer Data). We process Customer Data on our customers’ behalf as their processor, under a data processing agreement. If Customer Data includes your personal data, the relevant customer is responsible for it and you should contact them. Our services are designed to work with aggregated data, and we ask customers not to send us personal data unless it is needed.
Our Website and Platform may link to third-party websites and services, such as the advertising platforms our customers connect. Those third parties have their own privacy policies, which we do not control.
PERSONAL DATA WE COLLECT
The personal data we collect depends on how you interact with us:
Who
Personal data
Website visitors
IP address, browser and device type, pages visited, referring site and similar usage information
Information collected by cookies and similar technologies – see our Cookie Policy (https://delphio.ai/cookies)
People who contact us or request a demo
Name, work email address, job title, company and phone number
The content of your message and our correspondence
Platform users
Name, work email address, company and role
Log-in credentials (managed by our sign-in provider)
Records of your acceptance of our terms and policies: the version accepted, the date and time, and the IP address and browser used
Platform usage data: features used, actions taken, session times, device and browser information, and error logs
Support requests and feedback
Billing contacts
Name, billing email address, company, billing address and VAT number
Payment card details are collected and processed directly by our payment provider, Stripe; we do not see or store full card numbers
Prospects and business contacts
Name, job title, employer, work email address and phone number, and professional profile information (for example, from LinkedIn or your company website)
Our communications with you and your interactions with our marketing emails (for example, whether you opened an email or clicked a link)
Job applicants
CV, contact details, employment history, qualifications, interview notes and references
Where we get it from. Most of this data comes from you. We may also receive it from your employer (for example, when it sets you up as a Platform user), from your interactions with our Website and Platform, from publicly available sources such as company websites, Companies House and LinkedIn, from business contact data providers, and from people who introduce us.
Sensitive data. We do not ask for, and you should not give us, special category data (such as information about health, ethnicity, religion or sexual orientation) or information about criminal convictions.
If you do not provide data. Where we need personal data to provide the Platform (for example, your name and email address to create an account), we cannot provide access without it.
4. HOW AND WHY WE USE YOUR PERSONAL DATA
We may only use your personal data where we have a lawful basis to do so. The table below explains what we use your personal data for and our lawful basis. Where we rely on legitimate interests, we have balanced our interests against your rights; you can ask us for more information.
What we use it for
Our lawful basis
Responding to enquiries and demo requests
Legitimate interests (to respond to you and develop our business), or taking steps at your request before entering into a contract
Creating and managing Platform accounts, signing you in and providing the Platform
Legitimate interests (to provide the services our customer, your employer, has contracted for), or performance of a contract where you contract with us yourself
Recording acceptance of our terms and policies
Legitimate interests (to keep evidence of what was agreed and when, and to establish or defend legal claims)
Billing, payment and collecting debts
Performance of our contract with our customer; legitimate interests; and compliance with legal obligations (tax and accounting records)
Customer support and service communications, including changes to our terms or the Platform
Legitimate interests (to support our customers and keep users informed); compliance with legal obligations where applicable
Analysing how the Website and Platform are used, and improving them
Legitimate interests (to understand and improve our services). Where this involves non-essential cookies, see our Cookie Policy (https://delphio.ai/cookies)
Keeping our systems and data secure, preventing fraud and misuse
Legitimate interests (to protect our business, customers and users); compliance with legal obligations
Sending business marketing emails about our services, events and insights
Legitimate interests (business-to-business marketing), or your consent where the law requires it (for example, if you signed up to our updates). You can opt out at any time
Researching and contacting prospective customers
Legitimate interests (to develop our business)
Creating anonymised, aggregated data from customers’ models (Benchmark Data), where a customer has opted in
Legitimate interests (to improve our models and methodology). Once anonymised, the data no longer identifies anyone
Complying with law, enforcing our terms, handling complaints and legal claims, and corporate transactions such as a sale of our business
Compliance with legal obligations; legitimate interests (to protect our rights and manage our business)
Assessing job applications
Taking steps at your request before entering into a contract; legitimate interests; compliance with legal obligations such as right-to-work checks
5. USE OF AI TOOLS
We use third-party artificial intelligence services to help us run our business and deliver our services, for example to help with data analysis, model building, coding and drafting reports. We only use these services under business or enterprise terms that prohibit the provider from using our data to train its models. Where personal data is shared with an AI service provider, it is covered by a contract and the safeguards described in this policy.
Automated decisions. We do not make decisions about individuals based solely on automated processing that have legal or similarly significant effects. Our models estimate the effect of marketing activity on a business’s results, not anything about individuals.
6. MARKETING
We may send you emails about our services, events and marketing insights if you work for a business we think may be interested, or if you have signed up to receive them. We comply with the Privacy and Electronic Communications Regulations and, where they apply, the e-marketing rules of other countries, some of which require your prior consent.
You can opt out at any time by clicking the ‘unsubscribe’ link in any marketing email or by emailing jeremy.pounder@delphio.ai. We will keep your email address on a suppression list so that we do not contact you again. We never sell your personal data.
7. WHO WE SHARE YOUR PERSONAL DATA WITH
We share personal data with the following categories of recipients, only as needed for the purposes in this policy:
Service providers acting for us, including Platform hosting and database providers (Render and Supabase), email and file storage (Microsoft 365), our website host (GoDaddy and Framer), website and product analytics (Plausible), and AI service providers (Anthropic). They may only use the data to provide services to us, under written contracts.
Stripe, which processes payments as an independent controller under its own privacy policy.
Your employer or its agency, where it is our customer: account administrators can see who has access to their account and how the Platform is used.
Advertising and sales platforms (for example, Meta, Google and Amazon), when a customer connects its accounts to the Platform. Those platforms process data under their own terms and privacy policies.
Professional advisers, auditors and insurers, who are bound by confidentiality.
Regulators, courts, law enforcement and other authorities, where the law requires or to protect our rights.
Buyers or investors, and their advisers, in connection with a sale, merger, investment or restructuring of our business, under confidentiality obligations.
The sub-processors we use for Customer Data are listed in our Data Processing Agreement [at insert URL].
8. TRANSFERS OUTSIDE THE UK AND EEA
Our Platform data is hosted in the European Union (Frankfurt). The UK recognises the EEA as providing adequate protection for personal data, and the European Commission recognises the UK as providing adequate protection.
Some of our service providers are based in, or access data from, the United States or other countries outside the UK and EEA. Where we transfer personal data to them, we rely on:
adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified; or
appropriate safeguards, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses.
You can ask us for more information about these safeguards using the contact details below.
9. HOW LONG WE KEEP YOUR PERSONAL DATA
We keep personal data only for as long as we need it for the purposes in this policy, including to meet legal, accounting and reporting requirements. Our standard retention periods are:
Personal data
Retention period
Platform account data and acceptance records
For the life of the customer’s subscription and 6 years after it ends (the period in which legal claims may be brought)
Platform usage data and server logs
Server logs: up to 14 days. Product usage data: up to 24 months, then aggregated or deleted
Billing and accounting records
6 years from the end of the financial year to which they relate
Enquiries and demo requests that do not lead to a contract
24 months from our last contact with you
Prospects and business contacts
24 months from our last meaningful interaction with you
Marketing opt-outs
Indefinitely on our suppression list, so we can honour your choice
Support requests
3 years from closure of the request
Job applicants
6 months after the end of the recruitment process, unless you agree to us keeping your details longer
At the end of the relevant period we delete or anonymise the data.
10. YOUR RIGHTS
You generally have the following rights, which you can exercise free of charge:
Right
What it means
Access
To receive a copy of your personal data.
Rectification
To have inaccurate personal data corrected.
Erasure
To have your personal data deleted, in certain circumstances.
Restriction
To restrict our use of your personal data, in certain circumstances (for example, while you contest its accuracy).
Portability
To receive personal data you gave us in a structured, machine-readable format, or have it sent to another organisation, in certain circumstances.
Objection
To object at any time to direct marketing, and to object to processing based on our legitimate interests in certain circumstances.
Withdraw consent
Where we rely on consent, to withdraw it at any time. This does not affect processing before you withdrew it.
To exercise any of these rights, email jeremy.pounder@delphio.ai with enough information to identify you and the right you want to exercise. We may need to verify your identity. We will respond within one month, or tell you if we need longer for a complex request.
Deleting your Platform account. To have your Platform account deleted, email jeremy.pounder@delphio.ai. If your account is part of a customer’s subscription, we may need to involve the customer’s account administrator.
KEEPING YOUR PERSONAL DATA SECURE
We use appropriate technical and organisational measures to protect personal data, including encrypted connections, access controls, and hosting with reputable providers. We limit access to those who need it. No system is completely secure, but we have procedures to deal with any suspected data breach and will notify you and the regulator where the law requires.
CHILDREN
Our Website and Platform are for businesses and are not intended for anyone under 18. We do not knowingly collect personal data from children.
HOW TO COMPLAIN
If you have a concern about how we use your personal data, please contact us first at jeremy.pounder@delphio.ai. We will acknowledge your complaint within 30 days and respond without undue delay.
You also have the right to complain to the Information Commissioner’s Office (ICO) at https://ico.org.uk/make-a-complaint or on 0303 123 1113. If you are in the European Economic Area, you may complain to the data protection authority in the country where you live or work (in Ireland, the Data Protection Commission).
CHANGES TO THIS POLICY
We may update this policy from time to time. Each version has a version number and date. If we make significant changes, we will tell Platform users through the Platform or by email.
HOW TO CONTACT US
If you have any questions about this policy or your personal data, contact us at:
Email: jeremy.pounder@delphio.ai
Post: Delphio Ltd, 66 Paul Street, London EC2A 4NA
