Privacy Policy
Version 5.1 — Effective: 9 November 2026
The parts of this version about how we handle enquiries and demo requests apply from 5 October 2026, the date we published it.
What's changed in version 5.1
Published 5 October 2026. Takes effect on 9 November 2026. The changes about your enquiries apply from 5 October 2026, the date we published it.
- Upgrade prompts. Inside Opagio Intangibles we will record, for each organisation, which of our upgrade prompts it was shown or selected, and whether it then upgraded. We do not record which person saw or selected a prompt, and we look at these records only in totals across all organisations. Each date is kept for 13 months.
- Changing plan. When you or a colleague change your organisation's plan, we will record who asked for the change and the plans involved. For a move to a lower plan, we will also record the reason given, and we may contact the person about it. Any comment added is deleted after 12 months.
- Your welcome email. When you create an account, we will record which goal link you click in your welcome email, such as raising capital, and the goal the page you signed up from points to. We use it to pre-select that goal when you set up your account, and to tailor the academy emails if you have agreed to receive them. Link records are deleted after 90 days; the goal you choose is kept with your account.
- Our marketing emails. Our marketing emails are sent from updates.opag.io and news.opag.io. We will record which links you click in them, and, if you agreed to it, when you open them, so that we can see which content is useful. Our records do not include your email address, and we keep them for 13 months. Our email provider, Resend, keeps its own record of each click or open, including your IP address, browser details and possibly an approximate location derived from your IP address, for 30 days; we do not keep the location ourselves. If an email bounces permanently or is reported as spam, we stop sending marketing emails to that address and keep a note of it so that we do not email it again.
- Your enquiries. If you contact us or request a demo, our customer relationship management provider, Attio, may add publicly available business information about you and your company to our record of your enquiry. We also use Anthropic, an AI provider, to help us sort enquiries, decide the order in which we reply and prepare draft replies. We keep enquiry records for 2 years from our last contact. We have corrected where Attio holds data: in the European Union, not the United Kingdom.
- Your choices. We rely on our legitimate interests for these uses, and on your consent for recording when you open our emails. You can object at any time by writing to privacy@opag.io. Unsubscribing from our marketing emails also stops the recording of clicks and opens.
1. Introduction
Opagio Ltd ("Opagio", "we", "us", or "our") is committed to protecting your privacy and handling your personal data in compliance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, and the Data (Use and Access) Act 2025.
This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website opag.io, use Opagio Intangibles, or interact with us.
Data Controller: Opagio Ltd, registered in England & Wales (company number 13050381). Our contact email for privacy matters is privacy@opag.io.
2. Information We Collect
We collect the following categories of personal data:
Contact Information: Name, email address, telephone number, company name, and job title — provided when you contact us, subscribe to our newsletter, request a demo, or register for the platform. If you contact us or request a demo, our customer relationship management provider may add publicly available business information about you and your company to our record of your enquiry, such as your job title, location, photo, company details and public profile links.
Tier Eligibility Data: Where you apply for a subscription tier that carries published eligibility conditions (such as the Founder tier), we collect your name and role, your company name and website, the jurisdiction and incorporation date of the company, the amount of external investment it has raised, and the declaration you make. We also record the file names of any supporting documents you provide — the documents themselves are checked in memory and are not stored.
Account Data: Login credentials and authentication information when you create a platform account.
Subscription Records: When you or a colleague change your organisation's plan, we record who requested it, the plans involved and when the change takes effect. For a move to a lower plan, we also record the reason selected and any comment added.
Usage Data: Information about how you interact with our website and platform, including pages viewed, features used, session duration, and referring URLs. It also includes which links you click in the welcome email we send when you create an account (see Section 3). For our marketing emails, it includes which links you click and, where you agreed to it, when you open them (see Section 3).
Technical Data: IP address, browser type and version, device information, and operating system.
Marketing Attribution Data: When you first visit our website via a marketing campaign or referral link, we may store campaign attribution data (such as UTM parameters and referring website URL) in a cookie on your device. This data is used solely to understand which marketing channels led to your registration and is cleared upon registration. This processing requires your consent via our cookie banner (Analytics category). See our Cookie Policy for details.
Business Prospect Data: If you are a senior decision-maker at a company that matches the businesses we serve, we may hold your name, job title, and work email address (and, for LinkedIn outreach, your public LinkedIn profile URL) even though you have not given them to us. This data is sourced from third-party business-contact providers (currently Apollo.io) that compile publicly listed professional information, and is used solely to send you relevant business-to-business communications at your corporate email address or on LinkedIn. We tell you this at our first contact, every such email carries a working one-click unsubscribe, and you have an absolute right to object (see Section 3 and Section 11).
Company Research Data: When you ask us to research a company — during onboarding, when you rescan, or when you add a portfolio company — we collect public information about it from company registries, patent and trade-mark registers, the company's website and news sources. This includes the names, roles and appointment dates of its current officers, and patents that name them. We send an extract of this information to an AI sub-processor (Section 5) to draft the company's profile. This data is not collected from the officers themselves. Where you research a company on behalf of your organisation, we process it as your processor (see our Data Processing Agreement).
Platform Data: Financial, operational, and workforce data that you upload to Opagio Intangibles for analysis. Where you are a business client, we process this data as a data processor on your behalf — see our Data Processing Agreement for details.
3. Lawful Bases for Processing
Under Article 6 of the UK GDPR, we rely on the following lawful bases:
| Processing Activity | Lawful Basis |
|---|---|
| Responding to enquiries and demo requests | Legitimate interests (responding to prospective clients) |
| Providing Opagio Intangibles | Contract performance |
| Assessing and periodically re-confirming your eligibility for a tier with published eligibility conditions, and applying the resulting entitlement to your organisation's account | Performance of a contract, or steps taken at your request before entering one (Article 6(1)(b)) |
| Sending marketing emails and newsletters. Our marketing emails are sent from updates.opag.io and news.opag.io. When you click a link in any of them, our email provider (Resend) records the click so that we can see which content is useful. We keep which email it was, when you clicked and the web page the link led to, but not your email address, IP address or browser details; Resend's own record of the click or open includes those, and Resend keeps it for 30 days. If you agreed to emails that also tell us when they are opened, we send them from news.opag.io and also record when you open them. We keep our records of clicks and opens for 13 months. If an email to you bounces permanently or is reported as spam, we stop sending you marketing emails and keep a coded note of your address so that we do not email it again. To object, unsubscribe using the link in any of our marketing emails, or email privacy@opag.io: we will stop sending you marketing emails, and with them the recording of clicks and opens. | Consent (withdrawable at any time), for the emails and, where you agreed to it, for recording opens. Legitimate interests (Article 6(1)(f)), for recording clicks and acting on bounces and spam reports: seeing which content is useful, and keeping our emails deliverable. A Legitimate Interests Assessment is available on request. |
| Business-to-business marketing to prospective clients. We may contact senior decision-makers at companies that match the businesses we serve, at their corporate work email address or on LinkedIn, about Opagio services relevant to their professional role. Contact details (name, job title, work email) are sourced from third-party business-contact providers (currently Apollo.io) that compile publicly listed professional information — we tell you this in our first message. This applies to corporate subscribers only (companies and LLPs), never to sole traders or consumers. Every email includes a working one-click unsubscribe; an unsubscribe or objection stops all such contact permanently (we keep only your email address on our suppression list to make sure we don't contact you again). Your right to object to direct marketing (Article 21(2)) is absolute — exercise it via any message we send or at privacy@opag.io. A Legitimate Interests Assessment is available on request. | Legitimate interests (Article 6(1)(f)) — direct marketing of relevant business services to business contacts (Recital 47) |
| Website analytics and improvement | Legitimate interests (improving our services) |
| Measuring conversion through our go-to-market funnel (which marketing or referral channel led to an enquiry, demo, trial, or subscription), and which of our in-product upgrade prompts an organisation was shown or selected, and whether it then upgraded its plan. This uses first-party behavioural events. Where you have accepted Analytics cookies, these events carry a pseudonymous session and account identifier; where you have not, they are recorded without any session or account identifier, but they keep a reference to your organisation's account where the event relates to it (for example, when you are signed in, or when your organisation's subscription changes). Upgrade-prompt records are kept at organisation level only: which prompts, and when (to the hour); the plan the organisation was on when it first saw each prompt; and, for any upgrade that followed, the day it was made, the plans it moved from and to, the prompt it is credited to, and a reference to the subscription it was made under. They never record which individual user saw or selected a prompt, they are kept whether or not you accept Analytics cookies, and we report them only as totals across organisations, never per organisation. We do not use them to change the prompts, offers or prices any organisation sees. Where you are the only member of your organisation's account this is information about you. Any member of the organisation may object at any time via privacy@opag.io; we then stop recording upgrade prompts for that organisation and delete those already recorded. We do not use this data for advertising, profiling with legal or similarly significant effects, or automated decisions about you. A Legitimate Interests Assessment is available on request. | Legitimate interests (Article 6(1)(f)) — measuring and improving our marketing and sales effectiveness |
| First-party visitor counting (cookie-free). We keep an aggregate count of visits to our public web pages so we can measure how many people reach the site and through which channel (for example organic search, social, or referral). This count runs regardless of whether you accepted analytics cookies. It is cookieless and stores nothing on your device. We do not store your IP address, your browser's user-agent, the full page URL, or any identifier: your IP address and user-agent are used only fleetingly, in memory, to derive an anonymous daily counter and to exclude automated bots, and are then discarded. The daily counter changes every day and cannot be linked to you across days. You can opt out at any time, without an account: enable Global Privacy Control (GPC) or Do-Not-Track (DNT) in your browser and your visits will not be counted — this takes effect immediately, and nothing is stored either way. You also retain your right to object (Article 21) via privacy@opag.io. A Legitimate Interests Assessment is available on request. | Legitimate interests (Article 6(1)(f)) — measuring our own audience with a first-party, anonymous, aggregate count |
| Processing payments and billing | Contract performance |
| Understanding why customers move to a lower plan, and contacting the person who requested the change about it | Legitimate interests (understanding and responding to our customers' needs) |
| Fraud prevention and security | Legitimate interests (protecting our business and users) |
| Tax and regulatory compliance | Legal obligation |
| Generating aggregated benchmarks and industry analytics (using Aggregated Data only, as defined in our Terms of Service; as a safeguard, workforce-derived groupings of fewer than three individuals are suppressed from these outputs) | Legitimate interests (improving services and generating market insights) |
| Training and improving machine learning models (using Aggregated Data only) | Legitimate interests (improving service accuracy and analytical capabilities) |
| Automated classification of your financial data (Classification Engine). We process your uploaded financial data through our Classification Engine to categorise transactions, identify patterns, and generate analytical outputs. The majority of this processing occurs within our own infrastructure using rule-based algorithms and proprietary models. For tasks that require large language model capabilities (e.g. summarisation, semantic search, extraction from unstructured client materials, natural-language interpretation), we transmit limited, task-specific extracts of your data to vetted AI sub-processors listed in our Data Processing Agreement. Those sub-processors are contractually prohibited from using your data to train their general-purpose models; they keep it for a limited period, principally to detect and prevent misuse, and Google may use content flagged as potential misuse to improve its abuse-detection systems (see Section 5). You can request human review of any automated classification via support@opag.io. A Legitimate Interests Assessment is available on request. | Legitimate interests (Article 6(1)(f)) — providing the core Platform service |
| Corporate group entity discovery. Where you use the Platform for a corporate group, we process publicly available corporate registry data (including from the Global Legal Entity Identifier Foundation — GLEIF) to identify related entities within your group structure. This data is publicly available and does not involve processing private personal data. | Legitimate interests (Article 6(1)(f)) — assisting with accurate group setup |
| Researching a company you name, drafting its profile and suggested intangible assets, and suggesting which of our customer segments you are likely to fit | Legitimate interests (Article 6(1)(f)) — setting up your account accurately with less manual entry |
| Setting up your account around your goal. When you create an account, the links in your welcome email are personal to you. When you click one, we record the click and when it happened. If the link names a goal, such as raising capital or preparing to sell, we also record that goal. We also note the goal, if any, that the page you signed up from points to. We use this to: pre-select that goal when you set up your account (you can always choose a different one); and tailor the goal-related content of the academy emails, if you have agreed to receive them. This happens whether or not you accepted Analytics cookies, because it comes from your welcome email, not from cookies. It is separate from the funnel measurement described above. We do not keep your IP address or device details in these records, and nothing is stored on your device. This is a limited form of profiling. It has no legal or similarly significant effect on you, and it never changes a price, an offer or your access. You can object at any time at privacy@opag.io. We will then delete these records, and your welcome-email links will keep working without recording anything. Unsubscribing from the academy emails stops their use there. A Legitimate Interests Assessment is available on request. | Legitimate interests (Article 6(1)(f)) — setting up your account around your goal, and making the emails you receive relevant to it |
Where we rely on legitimate interests as a lawful basis, we have conducted a Legitimate Interest Assessment (LIA) balancing our interests against your rights and freedoms. You may request a copy of any LIA by contacting privacy@opag.io.
4. How We Use Your Information
We use the information we collect to:
- Respond to your enquiries and provide customer support
- Deliver, maintain, and improve Opagio Intangibles
- Tailor your account set-up, and the emails you have agreed to receive, to the goal you have told us about
- Send marketing communications (only with your consent)
- Process payments and manage your subscription
- Understand why you change your plan and contact you about the change
- Analyse website usage to improve our services
- Comply with legal and regulatory obligations
5. Data Sharing and Sub-Processors
We do not sell your personal data. We share your information only with trusted third-party service providers who process data on our behalf under appropriate contractual and security obligations:
| Provider | Purpose | Location |
|---|---|---|
| Google Cloud Platform (Firebase) | Cloud hosting, database, authentication | Europe (eur3 multi-region: Belgium and the Netherlands, with a replication witness in Finland) |
| Supabase | User authentication and identity | United States |
| Stripe | Payment processing and billing | United States |
| Resend | Transactional and marketing email | United States |
| ATTIO Ltd | Customer relationship management (contact name, email, company, interaction history, publicly available business information it adds about you and your company, and our notes on your enquiry, including the type of customer and the reply priority we assign) | European Union |
| Google LLC (Google Analytics 4) | Website and conversion analytics. Used only where you accept Analytics cookies; no data is sent if you decline. | United States |
| Google LLC | LLM processing via the paid tier of the Gemini API for narrow Platform tasks, currently drafting company profiles and identifying and provisionally classifying a company's intangible assets from company research data. Task-specific extracts only — not bulk client data. Google does not use submitted prompts or responses to improve its products or train its general-purpose models. It keeps them for a limited period (currently up to 55 days) principally to detect and prevent misuse of its services, and as required by law; during that period its authorised staff may review content or activity flagged as potential misuse, and flagged content may be used to improve Google's abuse-detection systems. | United States and other countries where the provider operates, under its data-processing terms |
| Anthropic, PBC | LLM processing for the same narrow Platform tasks, used only if we switch the Platform over to it (for example, if the Gemini API is unavailable for a sustained period). Switching is a manual configuration change, not an automatic failover. Task-specific extracts only — not bulk client data. We also use Anthropic, PBC to help us handle enquiries and demo requests you send us: sorting them by the service and the type of customer they relate to, deciding the order in which we reply, and preparing draft replies. This uses the details and message you send us. Anthropic does not train its models on the content we submit. It deletes inputs and outputs within 30 days, except where content is flagged as potentially breaching its usage policy (kept for up to 2 years) or where the law requires it to keep them. | United States and other countries where the provider operates, under its data-processing terms |
A complete sub-processor list is also available in our Data Processing Agreement.
6. International Data Transfers
Our primary database and core platform infrastructure are hosted on Google Cloud Platform in Europe. The database is in the eur3 multi-region, which stores data in Belgium and the Netherlands, with a replication witness in Finland. The data we hold on our own platform is stored at rest within the European Economic Area (EEA). No international transfers outside the EEA are required for core platform operations.
Certain sub-processors process limited categories of data outside the EEA and the United Kingdom: Supabase, Stripe and Resend in the United States, for authentication, payment processing and email delivery respectively (Resend also records clicks on our marketing emails and, where you agreed to it, when you open them); Google LLC (Google Analytics 4) in the United States, for website analytics, only where you accept Analytics cookies; and our AI sub-processors, Google LLC (Gemini API) and Anthropic, PBC, in the United States and other countries where they operate, for large language model processing of task-specific extracts and, for Anthropic, PBC, help with handling the enquiries and demo requests you send us (Section 5). These providers keep the data they process under their own terms. For the AI sub-processors this means the limited retention periods described in Section 5. The statement above about data at rest therefore covers the data held on our own platform, not the copies a sub-processor keeps for those periods.
Where personal data is transferred outside the United Kingdom, we ensure appropriate safeguards are in place under Chapter V of the UK GDPR, including UK adequacy decisions, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses.
7. Data Retention
We retain your personal data only for as long as necessary. Our specific retention periods are:
| Data Category | Retention Period |
|---|---|
| Contact form submissions and demo requests | 2 years from submission |
| Enquiry records in our customer relationship management system (including information added about you and our notes on your enquiry) | 2 years from our last contact with you |
| Newsletter subscriber data | Until unsubscribe, plus 6 months |
| Marketing email click and open records (which email, when, and the page the link led to) | 13 months from the click or open. A note that an email to your address bounced or was reported as spam is kept for as long as we need it to avoid emailing you again. |
| Platform account and usage data | Duration of subscription, plus 30 days |
| Welcome-email link records (which goal link you clicked, and when) | 90 days from when the email was sent. The goal you chose is kept with your account and deleted with it, or sooner if you object |
| Tier eligibility applications and review records | Duration of the subscription they support, plus 12 months; 2 years from submission where no account followed |
| Payment and billing records | 7 years (UK tax obligations) |
| Plan-change records | Duration of subscription, plus 30 days. Any comment added to a reason for moving to a lower plan is deleted 12 months after the change takes effect or is cancelled. |
| Website analytics data (Google Analytics 4) | 14 months from collection (applies to both event data and user data) |
| Business prospect data (name, job title, work email — sourced from third-party business-contact providers) | 6 months from our last contact, and no more than 12 months from acquisition, unless you respond or register (your suppression request, if you make one, is kept indefinitely so we never contact you again) |
| Go-to-market funnel events (pseudonymous, where consented) | 13 months from collection (de-identified aggregates: 26 months) |
| In-product upgrade-prompt records (organisation level) | Each date 13 months from when it was recorded, including after a subscription ends; deleted when your organisation's account is deleted. This period applies to these records in place of the "Platform account and usage data" period above. If you object, we keep only a note of your objection, for as long as your organisation's account exists, so that we can honour it. |
| First-party visit counts (anonymous daily counter; no IP, user-agent, or identifier stored) | 13 months from collection (de-identified aggregates: 26 months) |
| Company research results (the stored record of each research run) | 90 days from the research run |
| Company research results saved to your organisation's profile or a portfolio company's profile (including the names, roles and appointment dates of the company's officers) | Kept with your account for the duration of your subscription, plus 30 days, and deleted when your organisation is deleted |
| Database backups (daily automated + point-in-time recovery) | 7 days rolling retention |
8. What We Do Not Do
- We never sell your personal data to third parties.
- We never share your data for advertising or marketing purposes with third parties.
- We never use your data for targeted advertising or to build cross-site advertising profiles, and we make no automated decisions about you that produce legal or similarly significant effects (no Article 22 decision-making). We do measure our own marketing and sales funnel using first-party analytics (which marketing channel and segment led to a conversion) — see the lawful basis table above.
- We never display third-party advertisements on the Platform.
- We never track your location without explicit consent. One qualification: when you click a link in one of our marketing emails or, where you agreed to it, open one, our email provider Resend's record of that click or open may include an approximate location derived from your IP address. Resend keeps that record for 30 days, and we do not keep the location ourselves (see Section 3).
9. Automated Decision-Making and AI Transparency
The Platform includes automated processing tools that analyse your data and produce outputs:
(a) Classification Engine. The Platform's Classification Engine automatically categorises financial data (such as general ledger entries) using rule-based algorithms and, where deployed, proprietary machine learning models. This processing is automated but produces decision-support outputs only — no decisions with legal or similarly significant effects are made solely by automated means. Where you apply for a subscription tier with published eligibility conditions, an application that does not pass our automated eligibility checks is never refused automatically — it is routed to a person for review.
(b) Limited Use of AI Sub-Processors. Most automated processing occurs within Opagio's own infrastructure using rule-based algorithms and proprietary models. For specific tasks that require large language model capabilities — such as summarisation, semantic search, structured extraction from unstructured materials, natural-language interpretation, and identifying and provisionally classifying a company's intangible assets from company research data — we transmit limited, task-specific extracts of your data to vetted AI sub-processors, as listed in Section 5 and our Data Processing Agreement. We currently use Google LLC for these Platform tasks; Anthropic, PBC is configured as an alternative that we can switch to manually. Separately, we use Anthropic, PBC to help us handle enquiries and demo requests (Section 5). If the AI sub-processor cannot complete a request, the Platform completes the task with our own rule-based processing and does not send it to another provider. We do not transmit bulk client data or full general ledgers to these providers. They are bound by paid-tier or enterprise terms under which the provider does not use your data to train its general-purpose models. Each provider keeps submitted data for a limited period, principally to detect and prevent misuse of its service and as required by law — currently up to 55 days for Google, and up to 30 days for Anthropic or up to 2 years where content is flagged as potential misuse — and its authorised staff may review content flagged as potential misuse; Google may also use flagged content to improve its abuse-detection systems. We do not send your data to consumer AI services — the free, publicly available chat products such as the consumer ChatGPT or Gemini apps, whose terms permit the provider to use submitted content for model training and human review. Any future training of our own models uses only anonymised and aggregated data, as described in Section 3.
(c) Human Review. You have the right to request human review of any automated output by contacting support@opag.io. We will review the relevant classification or output and provide an explanation of how it was generated.
(d) EU AI Act Compliance. Under the EU AI Act, the Platform operates as a decision-support tool, not an autonomous decision-making system. Opagio does not make or recommend financial decisions on your behalf. All outputs require your independent professional review before use. Platform outputs should not be treated as professional valuations or financial advice — see our Terms of Service for important limitations.
9A. Corporate Group Data Controller Relationships
Where you use the Platform for a corporate group comprising multiple legal entities:
(a) The Group Administrator's entity is the data controller for Platform account data (user credentials, subscription details, billing information).
(b) Each individual entity within the group is the data controller for its own financial and operational data uploaded to the Platform. Opagio processes this data as a processor under the terms of the Data Processing Agreement.
(c) The Group Administrator may grant cross-entity access to designated users. When a user accesses data from multiple entities, each entity remains the controller for its own data, and the Group Administrator is responsible for ensuring appropriate authorisation.
10. Cookies and Tracking Technologies
We use cookies and similar technologies to improve your experience. For details, see our Cookie Policy.
11. Your Rights Under UK GDPR
Under the UK GDPR, you have the following rights:
- Right of access — request a copy of your personal data.
- Right to rectification — correct inaccurate or incomplete data.
- Right to erasure — request deletion in certain circumstances.
- Right to restriction — restrict processing of your data.
- Right to data portability — receive data in a machine-readable format.
- Right to object — object to processing based on legitimate interests or direct marketing.
- Right to withdraw consent — withdraw consent at any time.
To exercise any of these rights, email privacy@opag.io. We will respond within one month, extendable by up to two further months for complex cases.
12. Right to Complain
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk/make-a-complaint
13. Children's Privacy
Our services are directed at businesses and professionals and are not intended for individuals under 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately at privacy@opag.io.
14. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. For material changes, we will notify you by email or through a notice on our website.
15. Contact Us
Privacy matters: privacy@opag.io
Data Protection Officer enquiries: dpo@opag.io
General enquiries: hello@opag.io
Opagio Ltd, registered in England & Wales, company number 13050381. Our Privacy Lead is Tony Hillier; both privacy@opag.io and dpo@opag.io route to the Privacy Lead.