Privacy policy

ExoBrain LTD is responsible for personal data we use to run our website, newsletters and secure client and prospect portals. This notice explains what we collect, why we use it, who receives it, how we decide how long to keep it and your rights. It covers portal visitors even where the material they view is a fictional demonstration.

We act as controller for our own account administration, access permissions, communications and security records. Where a client determines how personal data in its reports is used and we handle it on that client’s instructions, we act as processor under our agreement with that client. The client’s own privacy notice also applies to that processing.

• Contact details you choose to provide when you contact us directly.
• Newsletter subscription details, including your email address, subscription status, unsubscribe status and related delivery records.
• Newsletter attribution details, such as UTM parameters, referral codes and the referring site where those are available.
• Newsletter engagement activity captured by Beehiiv, such as deliveries, opens, link clicks, verified clicks, unsubscribe events, spam reports and similar campaign performance signals.
• Website usage and performance information, including pages viewed, approximate location, device type, browser, operating system and Core Web Vitals.
• Portal account information, including your email address, account identifier, email verification status and, where relevant, your organisation or email domain.
• Portal permissions, including the packages you can access, permission expiry dates and records of access restrictions.
• Portal activity records, including access starts, report page deliveries, timestamps and identifiers that can be linked to an authorised recipient. A delivery record does not prove that someone read a page.
• Sign-in and security information processed by our providers, which may include IP address, browser, device, session and authentication events.
• Support correspondence and connection-check results you choose to share with us.
• Technical information needed to run the site, diagnose issues, prevent misuse and keep the service secure.

We do not ask for sensitive personal information through the website. Please do not send confidential client material unless we have agreed a secure route with you.

We receive information directly from you when you contact us, subscribe or sign in, and from your browser when you use our services. A colleague, your organisation or an ExoBrain business contact may provide your work email address so that we can arrange access. Our authentication and hosting providers supply account, delivery and security records.

Access may be granted to a named person or to people with a verified email address at an approved organisation domain. An approved domain does not make the portal public. If you do not provide the email address and verification needed for sign-in, we cannot give you protected access.

• To verify your email, manage portal permissions, deliver authorised reports and support your access.
• To respond to enquiries and manage prospective client conversations.
• To send the ExoBrain newsletter and manage subscriptions, where you have asked to receive it.
• To understand newsletter engagement, including which issues are delivered, opened, clicked, unsubscribed from or reported.
• To understand which pages, newsletters and campaigns are useful to visitors.
• To measure site performance and improve reliability, accessibility and content quality.
• To prevent spam, misuse or fraud and comply with legal requirements.

We do not sell your personal data. We do not pass your details to third parties for unrelated products or services.

We rely on your consent for newsletter marketing and optional attribution where consent is required. We rely on legitimate interests to respond to business enquiries, understand site performance, improve the website and protect it from misuse. We also rely on legitimate interests to provide controlled access to business materials, administer client and prospect relationships, investigate access problems and protect confidential reports. We consider those interests alongside your rights and reasonable expectations. Where processing is necessary for a contract with you personally, we may rely on that contract; a contract with your employer does not automatically provide that basis for your personal data. We may also process information where needed to meet legal obligations.

We use portal access and delivery records to operate the service, investigate problems, protect materials and understand use of the packages we share. These records can be linked to individuals and are separate from aggregate website analytics. Signing in does not subscribe you to our newsletter or constitute consent to marketing. We do not use portal access records to make solely automated decisions that produce legal or similarly significant effects on you.

Our connection checker sends requests to the website, portal and sign-in service to help diagnose connectivity. Its checks do not send your portal sign-in credentials. The results shown in your browser include timing, browser details and technical error identifiers; you can choose to send them to us for support. The services contacted may record ordinary network and security logs, including your IP address. Please do not send passwords or one-time sign-in codes.

Beehiiv is the main service we use for the ExoBrain newsletter. When you subscribe, we send Beehiiv your email address and, where available, attribution details such as UTM source, medium, campaign, term, content, referral code and referring site. Beehiiv uses this information to create or reactivate your subscription, send welcome and newsletter emails, manage unsubscribe requests and report newsletter performance.

Beehiiv also captures email activity so we can understand how the newsletter is performing. This may include whether an email was delivered, opened, clicked, unsubscribed from or reported as spam, as well as which links were clicked and when. Open tracking can depend on a small invisible image in the email, and click tracking can include both raw and filtered or verified click metrics, so these figures are directional rather than perfect.

The signup form may store attribution details in your browser's local storage so that the source of a signup is preserved as you move between pages. You can clear this through your browser settings. You can unsubscribe from newsletter emails using the unsubscribe link included in each email.

We use Google Analytics 4 to understand aggregate website usage. GA4 may use first-party cookies such as _ga and _ga_* to distinguish users and sessions.

We use Vercel Web Analytics to understand page views and referrers. Vercel's Web Analytics is designed to provide aggregated traffic data without third-party cookies.

We use Vercel Speed Insights to measure real-user performance data such as route, URL, device type, browser, network speed, country and Core Web Vitals. Vercel states that Speed Insights data points are anonymous and not tied to an individual visitor or IP address.

Secure portals use authentication and session cookies to keep you signed in, check your permissions and protect access. Blocking these can prevent sign-in or report delivery. Portal analytics filters exclude protected report routes and remove query strings and fragments before sending page-view URLs to Vercel Analytics.

Cookies and browser storage help the site remember settings, understand visits and support newsletter attribution. The site may use first-party analytics cookies, local storage for theme preference, and local storage for newsletter attribution. Third-party scripts from Google, Vercel and Beehiiv may also process technical information when their features are active.

You can block or delete cookies and local storage through your browser settings. Some features may work less smoothly if you do this.

The services supporting our website and portals may process data in the UK, the European Economic Area, the United States or other locations where their infrastructure and subprocessors operate. Clerk hosts data in the United States; selecting UK storage for report files does not mean all portal data stays in the UK. Applicable transfer arrangements can include adequacy decisions, the UK extension to the EU-US Data Privacy Framework for covered transfers, and contractual safeguards such as Standard Contractual Clauses with the UK Addendum. Clerk’s data processing agreement describes its transfer arrangements. You can contact us for information about the safeguards relevant to your data.

We use access restrictions, encrypted connections and private report storage to protect portal information. No online service can guarantee absolute security. Removing access prevents future authorised delivery; it cannot recall copies a recipient has already downloaded.

We share information with service providers only where needed to operate the site, deliver the newsletter, process newsletter subscriptions, measure analytics and performance, or protect the site. These providers include Beehiiv for newsletters, Google Analytics for website analytics, Vercel for hosting, private report storage and performance services, Clerk for portal identity and authentication, and Upstash for portal permissions, sessions and access records. We also use email delivery services, including Resend, for website correspondence. Authorised ExoBrain staff and contractors may handle information where their work requires it. We may also disclose information where the law requires it or where disclosure is needed to prevent fraud or misuse.

Retention depends on the purpose and type of record. We consider whether access or an engagement is still active, whether information is needed to answer a request or investigate an incident, and whether a legal obligation or dispute requires preservation.

• Account and permission records: for the period of authorised access and any continuing administration, security or support need. An expired permission does not automatically delete your account or its records.
• Access and security records: according to their value for investigating faults, misuse and incidents, including any unresolved investigation. We do not currently apply one automatic deletion period across all portal logs.
• Reports and delivery copies: according to the client engagement, the agreed delivery purpose and any contractual or legal retention requirement. Replacing a report does not automatically erase older stored versions.
• Enquiries and support correspondence: while needed to respond, manage the relevant business relationship or resolve an outstanding matter.
• Newsletter records: while you remain subscribed, with limited unsubscribe or suppression records retained where needed to respect your choice and prevent unwanted messages.
• Privacy requests: enough information to handle the request and demonstrate our response, taking account of any complaint or dispute.

Deletion may require separate action in our access store, authentication service, report storage and support records. Provider logs and backups follow their own retention arrangements, so removal from active use does not necessarily mean immediate removal from every backup. We assess deletion requests against these records and explain any information we must retain and why.

Sometimes we link to other sites, but we do not endorse their privacy practices. Check their policies for more information.

You can withdraw consent for marketing at any time. You can also ask us about the personal data we hold on you, ask for it to be corrected or deleted, object to certain uses, restrict processing, or ask for a copy of your data where the law gives you that right.

You can complain to the Information Commissioner’s Office, the UK data protection regulator. You do not have to contact us first, although we welcome the opportunity to resolve concerns.

Contact help@exobrain.co.uk with the email address you use and the service your request concerns. We may ask for proportionate evidence of identity to avoid disclosing or deleting someone else’s data. We normally respond within one month, subject to lawful extensions and exceptions, which we will explain if they apply. Rights depend on the circumstances and are not absolute. Withdrawing consent does not affect processing that was lawful before withdrawal.

If your request concerns information in a report that we process on a client’s instructions, we will help direct it to the responsible client and assist as required. You can object to processing based on legitimate interests, including any direct marketing. You can request portability where its legal conditions apply.

You can read more about the services we use in the Google Privacy Policy, Vercel Privacy Notice and Beehiiv Privacy Policy. Portal services are also described in the Clerk Privacy Policy, Clerk Data Processing Addendum and Upstash Privacy Policy. Website email delivery is described in the Resend Privacy Policy. Clerk acts as our processor for customer data covered by its agreement and as an independent controller for certain account information and its own purposes described in those terms.

We update this notice occasionally, so check this page for the latest version. This page was last updated on 14 October 2026.