Last updated: 24 March 2026
This Privacy Policy explains how Horizon Creatives Studio Ltd ("Company", "we", "us", "our") collects, uses, stores, and protects your personal data when you use the Sellkora platform ("Service").
We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and other applicable data protection laws.
The data controller for personal data collected through the Service is:
We collect personal data in the following categories:
| Data | Purpose |
|---|---|
| Full name | Account identification, personalisation |
| Email address | Account login, communications, notifications |
| Phone number | Account security, 2FA, optional contact |
| Password (hashed) | Account authentication |
| Company name | Business profile, outreach personalisation |
| Company website | Business verification, AI content generation |
| Data | Purpose |
|---|---|
| Google OAuth tokens | Social login authentication |
| Two-factor authentication data | Account security verification |
When you sign in with Google, we receive your name, email address, and profile picture from Google. We do not receive or store your Google password.
| Data | Purpose |
|---|---|
| Services offered, pricing, target audience | AI personalisation of outreach |
| Sales materials, custom instructions | AI agent configuration |
| Agent identity (name, role, style) | AI personality for communications |
| SMTP credentials (email host, username, password) | Sending emails on your behalf |
| LinkedIn session cookies | LinkedIn automation on your behalf |
SMTP credentials and LinkedIn session data are stored encrypted at rest and are used solely for the purpose of operating the Service on your behalf.
| Data | Purpose |
|---|---|
| Business names, addresses, phone numbers | Lead identification and outreach |
| Business email addresses | Outreach communication |
| Website URLs, social media links | Lead research and verification |
| LinkedIn profile data (name, headline, experience) | LinkedIn outreach and personalisation |
Lead data is sourced from publicly available information: Google Places (business directories), publicly accessible company websites, and public LinkedIn profiles. We do not purchase personal data from third-party data brokers.
| Data | Purpose |
|---|---|
| Outbound emails (content, recipients, timestamps) | Service delivery, tracking, follow-up |
| Inbound emails (sender, subject, body) | Inbox management, reply tracking |
| LinkedIn messages (sent and received) | LinkedIn outreach management |
| Voice call recordings and transcripts | AI call analysis, quality assurance |
| Data | Purpose |
|---|---|
| IP address | Security, fraud prevention, analytics |
| User agent (browser, OS) | Compatibility, security monitoring |
| Feature usage (searches, emails sent, AI credits used) | Usage tracking, plan enforcement |
| Timestamps of actions | Activity logging, billing |
| Error logs | Debugging, service improvement |
Payments are processed by Stripe. We do not store your credit card number, CVV, or full payment details on our servers. Stripe provides us with a limited set of information (last 4 digits, card brand, billing email, country) for billing management. See Stripe's Privacy Policy.
We process your personal data for the following purposes:
We process your data under the following legal bases:
| Purpose | Legal Basis |
|---|---|
| Service delivery, account management | Contract — necessary to perform the contract between you and us (Article 6(1)(b)) |
| Billing and payments | Contract — necessary to perform the contract (Article 6(1)(b)) |
| Security monitoring, fraud prevention | Legitimate interest — protecting the Service and our users (Article 6(1)(f)) |
| Prohibited activity monitoring | Legal obligation — compliance with UK law (Article 6(1)(c)) and legitimate interest (Article 6(1)(f)) |
| Service improvement, analytics | Legitimate interest — improving our product (Article 6(1)(f)) |
| Marketing communications | Consent — you can opt out at any time (Article 6(1)(a)) |
| Cookie usage | Consent — via cookie consent banner (Article 6(1)(a)) |
When you use Sellkora to find leads and send outreach, you are the data controller for the personal data of the individuals and businesses you contact. We act as a data processor on your behalf.
This means:
We will assist you in responding to DSARs to the extent technically feasible.
We share your data with the following categories of third-party service providers, strictly for the purpose of delivering the Service:
| Provider | Purpose | Data Shared |
|---|---|---|
| Google (Gemini AI) | AI lead analysis, content generation (all plans) | Lead data, business context, prompts |
| Anthropic (Claude AI) | AI communications, agent features (Agent plans+) | Lead data, business context, conversation history |
| Google (Places API) | Lead discovery | Search queries (business type + location) |
| Stripe | Payment processing | Billing email, payment method details |
| Your SMTP provider | Email delivery | Email content, sender/recipient addresses |
| LinkedIn automation (via your credentials) | Actions performed under your LinkedIn account | |
| Telephony provider (Twilio) | AI voice calls (where applicable) | Phone numbers, call audio |
We do not sell, rent, or trade your personal data to third parties for marketing purposes. We do not share your data with data brokers.
| Data Type | Retention Period |
|---|---|
| Account data | Duration of account + 90 days after deletion |
| Lead data and outreach history | Duration of account + 90 days after deletion |
| Communication data (emails, messages) | Duration of account + 90 days after deletion |
| Voice call recordings | 90 days from call date, or duration of account (whichever is shorter) |
| Payment records | 7 years (UK legal requirement for financial records) |
| Usage logs | 24 months |
| Security logs (IP, user agent) | 24 months |
| Prohibited activity logs | Indefinitely (for law enforcement purposes) |
After the retention period, data is permanently deleted or anonymised.
We use cookies and similar technologies on our website and platform. A cookie consent banner is displayed on your first visit, allowing you to accept or reject non-essential cookies.
Required for the Service to function. These cannot be disabled.
Used to understand how visitors interact with our website. Only set with your consent.
Used for remarketing and advertising. Only set with your consent. We currently do not use marketing cookies, but reserve the right to introduce them with appropriate consent mechanisms.
Under the UK GDPR and EU GDPR, you have the following rights regarding your personal data:
To exercise any of these rights, contact us at privacy@sellkora.com. We will respond within 30 days.
Some of our third-party processors (Google, Anthropic, Stripe, Twilio) are based in the United States. Where personal data is transferred outside the UK/EEA, we ensure appropriate safeguards are in place:
The Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a minor, we will delete it immediately.
We may update this Privacy Policy from time to time. Material changes will be communicated to registered users via email at least 14 days before they take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.
For privacy-related questions, data requests, or complaints:
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):