Privacy
Privacy policy
This policy explains what personal data Partnertron collects, why, how long we keep it and the rights you have over it.
Who we are
Partnertron is operated by Metahead Ltd, registered in England and Wales under company number 12590422, registered office Soloman House, Belgrave Court, Fulwood, Preston, England, PR2 9PL. Metahead Ltd is the data controller for the personal data described here and is registered with the Information Commissioner’s Office under number ZC134751. Imagicana is part of Metahead Ltd. For any privacy question or request, email chris@metaheadconsultancy.com.
What we collect and why
Account and access. Your name, email and organisation when we issue you an access code, and a record of each access attempt (outcome, a salted hash of your IP address and your browser type). Lawful basis: legitimate interests in running the service securely, and performing our contract with you.
Briefs and outputs. The briefs you submit, any images you upload, and what the engine generates from them. Briefs are about brands and audiences; please do not include personal data about individuals that the brief does not need. Lawful basis: performing our contract with you.
Payments. When you pay, our payment provider Stripe collects your card details directly; we never see or store your full card number. We receive your name, email, billing address, any VAT number you give and a record of the payment. Lawful basis: performing our contract, and our legal obligation to keep tax records.
The IP Network. When an organisation applies to join, we collect the contact’s name, email and role, the organisation’s details and a record of the consent given, including the exact wording and the date. If you use the AI pre-fill, we look up public information about the organisation you name (its website and public social posts) to suggest a profile for you to check; that lookup is not stored unless you submit the application. Lawful basis: consent for contacting you and, if you opt in, for letting matched brands approach you; legitimate interests for reviewing applications.
Introductions. If you ask us to introduce you to a partner, or ask Imagicana to manage a partnership, we keep the request and our correspondence about it. Lawful basis: performing our contract with you, and legitimate interests in administering introductions and any fees due.
People named in public sources. To ground its recommendations, the engine draws on public information such as published partnership case studies and public social media posts. A run can therefore mention people in a professional capacity, for example a commentator quoted as a cultural signal, or a public route to reach an organisation. We use only information they have made public, for this limited business purpose. Lawful basis: legitimate interests in providing partnership research. If you are mentioned and would like us to stop, email us and we will exclude you.
Waitlist and enquiries. Your email and message, to reply and to send you news about Partnertron if you asked for it. Lawful basis: consent, which you can withdraw at any time.
How we use AI
Partnertron uses AI models from the providers listed below to generate its analysis, concepts and images. Every output is labelled as AI-generated and is intended for human review. We do not use your data to make decisions about you that have legal or similarly significant effects, and we do not allow our AI providers to train their models on your briefs or outputs under our agreements with them.
Who we share data with
We use these providers to run Partnertron. Each processes data on our instructions under a data processing agreement:
- Vercel, Inc. (United States): hosting
- Supabase, Inc. (United States): database and file storage
- Stripe Payments UK, Ltd and Stripe, Inc. (United Kingdom / United States): payments and invoicing
- Anthropic and OpenAI (United States): AI model inference, when a run is processed
- xAI (United States): live public social signal and backup model inference
- Google (Ireland / United States): image generation, search trends and fonts
- Resend (United States): transactional email
- Notion Labs, Inc. (United States): our internal partnership precedent library
- Calendly (United States): call scheduling, when you book through the site
We do not sell personal data. We share it with a prospective partner only when you ask us to make an introduction, and with professional advisers or authorities where the law requires.
International transfers
Some providers are in the United States. Transfers rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, and otherwise on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
Cookies
We use only cookies needed for the service, so no consent banner is required:
- partnertron_access: remembers a valid access code, for seven days
- partnertron_unlock: remembers an administrator sign-in, for eight hours
- pt_theme: remembers whether you chose light or dark mode, for a year
We do not use analytics, advertising or tracking cookies. Stripe’s checkout page and Calendly’s booking widget set their own cookies when you use them, under their own policies.
How we protect your data
Briefs and outputs are readable only by the account that created them, and access is checked on every request. Uploaded and generated images are held in private storage and served through links that expire after one hour. Traffic is encrypted in transit, and sessions are held in HTTP-only cookies.
How long we keep it
- Briefs, outputs and images: twelve months from submission, then deleted automatically
- Access logs: thirty days
- Payment and invoice records: six years, as UK tax law requires
- IP Network members: while you are a member. If you ask to leave, we delete your details within one month, except the record of your consent, which we keep for six years
- Introduction requests: for the life of the relationship and six years after, so fees can be administered
- Waitlist: until you ask us to remove you, or the waitlist closes
Your rights
Under UK data protection law you can ask us to:
- Give you a copy of your personal data
- Correct data that is inaccurate
- Delete your data, subject to legal retention duties
- Restrict or object to how we use it, including use based on legitimate interests
- Give you your data in a portable format
- Withdraw any consent you have given
You can delete a brief, its outputs and its images yourself in the product. For anything else, email chris@metaheadconsultancy.com. We will respond within one month.
Complaints
If you are unhappy with how we have handled your data, email chris@metaheadconsultancy.com with “Data complaint” in the subject. We will acknowledge it within thirty days, investigate, and tell you the outcome without undue delay. You can also complain to the Information Commissioner’s Office at ico.org.uk.
If something goes wrong
If a personal data breach occurs we will investigate immediately and, where it is likely to risk people’s rights, report it to the ICO within 72 hours. Where the risk to you is high, we will tell you directly and without undue delay.
Changes to this policy
We will update the date at the top when this policy changes, and tell active customers about significant changes by email.