Privacy Policy

Last updated: 5 March 2026

1. Who we are

Continually is a trading name of THORT AI Ltd, a company registered in England and Wales. We are the data controller for the personal data described in this policy.

Contact: [email protected]

2. What data we collect

• Lead data — name, email address, job title, organisation name, postal address. Sourced from public registers.
• Enrichment data — sector, SIC codes, company number, website technology headers, attack surface indicators.
• Engagement data — email reply content, classification (interested, declined, out-of-office, etc.), timestamps.
• Booking data — meeting date/time, attendee name and email, provided via Cal.com webhooks.
• Client account data — email address and password hash for dashboard access.

3. How we collect it

• Public registers — ICO Data Protection Register, Companies House API.
• Public website probing — HTTP response headers (server, technology stack). No authenticated access.
• Direct correspondence — replies to our outreach emails.
• Webhooks — Cal.com booking events, HubSpot contact events (where connected by client).
• Client signup — provided directly during account creation.

4. Lawful basis for processing

Our outreach targets corporate subscribers (businesses, not individuals). Under the Privacy and Electronic Communications Regulations 2003 (PECR), Regulation 22 permits unsolicited B2B email to corporate subscribers without prior consent. We additionally rely on legitimate interest under UK GDPR Article 6(1)(f) for processing business contact data for the purpose of offering relevant commercial services.

For client accounts, we process data under Article 6(1)(b) — performance of a contract.

Theme preference (light/dark mode) is stored in your browser's localStorage only and is not personal data.

5. Data retention

• Lead data — 12 months from last contact, then deleted.
• Suppression list — retained indefinitely to prevent re-contact. Contains email address only.
• Booking data — 12 months from meeting date.
• Client accounts — duration of contract plus 6 months, then deleted.

6. Third-party processors

We share personal data with the following processors, solely for the purposes described:

7. Your rights

Under UK GDPR, you have the right to:

• Access — request a copy of the data we hold about you (DSAR).
• Erasure — request deletion of your data.
• Objection — object to processing based on legitimate interest.
• Rectification — correct inaccurate data.

To exercise any right, email [email protected] or reply to any of our emails with “unsubscribe”. We will respond within 30 calendar days. Unsubscribe requests are processed automatically and immediately.

8. Cookies and tracking

This website uses zero cookies, zero analytics scripts, and zero tracking pixels. The only client-side storage is a theme preference in localStorage, which never leaves your browser and is not personal data.

9. International transfers

Some of our processors (see section 6) are based in the United States. Where data is transferred outside the UK, we rely on UK adequacy regulations or standard contractual clauses (SCCs) as appropriate. Lead data and campaign databases are hosted on UK infrastructure.

10. Changes to this policy

We may update this policy from time to time. Significant changes will be noted with a revised “last updated” date at the top of this page. Where changes materially affect how we process your data, we will make reasonable efforts to notify affected individuals.

11. Complaints

If you are unhappy with how we handle your data, please contact us first at [email protected]. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.