Privacy Policy

Telepath Pro
Last updated: 26 October 2026

1. Who We Are

Telepath Pro is operated as a sole trader business by Tom Pople trading as Telepath Pro, with a registered address at 1 Bolsover Road, Hove, BN3 5HQ, United Kingdom.

We are registered with the Information Commissioner's Office (ICO) under registration number ZC101774.

For any privacy-related questions or requests, please contact us at: privacy@telepath.pro

2. What This Policy Covers

This Privacy Policy explains how Telepath Pro collects, uses, stores, and protects your personal data when you:

• Visit telepath.pro
• Use our free ICP report generation tool
• Sign up for a paid subscription
• Upload pipeline or CRM data to our platform
• Communicate with us by email

We are committed to protecting your personal data and operating in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

3. What Data We Collect

3.1 Data you provide directly

• Name and email address — when you request a free ICP report or create an account
• Payment information — billing name, address, and card details when you subscribe to a paid plan (processed and stored by Stripe — we never see or store your full card details)
• Company and deal data — when you upload a CSV of won deals or pipeline opportunities for analysis

3.2 Data we collect automatically

• IP address — collected for security purposes, rate limiting, and fraud prevention
• Usage data: pages visited, features used, and interactions with the platform (collected by our own cookieless page counter and, if you accept analytics cookies, by PostHog and Google Analytics, and Apollo.io for company-level identification; see Section 9)
• Cookies — see Section 9 for full details
• Where your visit came from: when you arrive on our website, it notes the campaign labels in the link you followed, if it has any (utm_source, utm_medium and utm_campaign), and the host name of the site that referred you, if any (for example linkedin.com: the host only, never the full address of the page). It keeps this first touch in the page's memory while you move between our pages, without setting a cookie or using your browser's storage, and it is gone when you reload the page or close the tab. If you then request a free report, the campaign labels (and utm_content, if the link has one) and the referring host are stored with your named report. If you create an account, the campaign labels and the referring host are also stored on your account, where we have switched on campaign tracking for sign-ups. We use them only to see which campaigns and websites bring people to Telepath Pro. When a free report is deleted after 30 days (Section 7), its campaign labels and referring host are kept on the anonymised record of the report, which does not identify you.

3.3 Data we do NOT collect

We have specifically designed Telepath Pro to minimise personal data collection. When you upload CRM or pipeline data:

• We do not store contact names or personal details of your prospects or customers
• We do not store contact email addresses or phone numbers from your uploaded data
• We do not store free-text notes fields from your CRM
• We analyse and process company-level and deal-level data only

Your sales representatives' names and email addresses may be stored as part of deal attribution data where provided. This is covered under our legitimate interest in providing accurate ICP analysis.

4. How We Use Your Data

We process your personal data for the following purposes:

5. Who We Share Your Data With

We use the following third-party service providers (sub-processors) to deliver our service. Each is bound by appropriate data processing agreements and operates under privacy standards consistent with UK GDPR:

Companies House data. Contains public sector information licensed under the Open Government Licence v3.0.

Place names: adapted from GeoNames (geonames.org), CC BY 4.0 (UK places only, names normalised).

We do not sell your personal data to any third party. We do not share your data with advertisers.

6. Data Uploaded to Our Platform

When you upload CRM or pipeline data to Telepath Pro — whether as a free report user or a paid subscriber — you remain the data controller for that data. Telepath Pro acts as a data processor on your behalf.

Free report users: your data is used only to generate your ICP report, plus anonymised statistics about how the service performs (clause 10.6 of our Terms of Service), from which you and your company cannot be identified. We automatically delete the deal data you upload or connect, and the report built from it (including the name, job title, company and email on it), 30 days after the report is created. Your report link stops working at the same time; the PDF we email you is yours to keep. Copies in our database provider's backups are removed as those backups are overwritten on its rolling schedule. To have your data deleted sooner, email privacy@telepath.pro, quoting the email address you used. We keep a record that a report was run (its date, number of deals, cost and delivery status, with no name, email, company or deal data) to operate the service. No account or subscription is required.

Paid subscribers: processing is governed by our full Data Processing Agreement at telepath.pro/data-processing-agreement, which is automatically incorporated into your subscription.

We process uploaded data solely for the purpose of providing ICP analysis and pipeline scoring. This includes using your own closed-lost deals to compute your own rankings, in our code and for your account only. We do not use your uploaded business data to train AI models, share it with other customers, or use it for any purpose beyond delivering your requested analysis. There are two exceptions. First, we may create anonymised statistics about how the service performs, to improve Telepath Pro (clause 10.6 of our Terms of Service). Second, benchmark contribution, which is off unless you turn it on (clause 10.5).

When you connect your CRM, Telepath Pro writes its own properties, prefixed telepath_: the T-Score on deal records and, only if you choose Write scores to HubSpot, a fit verdict on company records. We never modify or delete your existing CRM data. For HubSpot, this requires Starter, Professional, or Enterprise.

Our Data Processing Agreement (DPA) is published at telepath.pro/data-processing-agreement and is automatically incorporated into our Terms of Service for all paid subscribers. Enterprise customers requiring a countersigned copy can request one at privacy@telepath.pro.

7. Data Retention

We retain your personal data as follows:

Free report data is deleted automatically after 30 days (see the table above). For accounts, we do not currently run automated retention purges. Deleting your account (from Settings, or at telepath.pro/account/delete, which works whether or not you have a paid plan), or using the erase control, takes effect immediately and irreversibly in our production systems. Deletion requests by email are completed within 30 days of verification. Sub-processors delete their copies on their own documented schedules.

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right of access — You can request a copy of all personal data we hold about you.

Right to rectification — You can ask us to correct inaccurate or incomplete personal data.

Right to erasure — You can ask us to delete your personal data. You can also delete your account yourself at any time, whether or not you have a paid plan: from your account Settings page, or at telepath.pro/account/delete.

Right to restriction — You can ask us to restrict processing of your data in certain circumstances.

Right to data portability — You can request your data in a machine-readable format.

Right to object — You can object to processing based on legitimate interests, including for direct marketing.

Rights related to automated decision-making — Our ICP scoring involves automated analysis. You have the right to request human review of any automated decisions that significantly affect you.

To exercise any of these rights, please email privacy@telepath.pro. We will respond within 30 days. We may need to verify your identity before processing your request.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk/concerns.

9. Cookies

Strictly necessary cookies

• Session authentication cookie — keeps you logged in (7 days, httpOnly, secure)
• telepath_cookie_consent — remembers your analytics preference (1 year)

Analytics cookies (optional — only set if you consent)

• Google Analytics cookies (_ga, _gid) via Google Tag Manager — consent-gated, only loads if you accept cookies via our cookie banner. Google Analytics receives the address of each page you view, basic browser and device details and, as with any request your browser makes, your IP address. We do not send it your name, email address or report contents. You can withdraw consent at any time by clicking “Cookie Settings” in the footer, or opt out globally at tools.google.com/dlpage/gaoptout
• PostHog cookie (ph_<project key>_posthog), with a matching entry in your browser's local storage, for product analytics. Set only if you accept cookies via our cookie banner, and kept for 1 year. PostHog then records page views and page exits. Each event carries the page address, the referring page and basic browser and device details, and is sent to PostHog's EU servers, which, like any web server, receive your IP address with the request. Session recording is off, and automatic click capture is configured to match no page elements.
• Apollo.io (optional, only if you choose “Accept all”): identifies which company a visit comes from, using your IP address, so we can see which organisations are interested in Telepath Pro. We use company-level identification only; contact-level identification is switched off. Apollo stores a random visitor ID and a short queue of page visits in your browser's local storage (apolloAnonId, <id>_eventQueue, <id>_canTrack), and Apollo's content delivery network sets a short-lived security cookie (__cf_bm, about 30 minutes) on apollo.io. Each page view sends the page address to Apollo.

Cookieless analytics (nothing stored on your device)

• PostHog: nothing is loaded from or sent to PostHog before you make a choice, and nothing ever is if you choose “Essential only”.
• Our own page counter: for each page you view, our servers store the page path, the referring page, your browser's user agent and a salted, truncated SHA-256 hash of your IP address. It sets no cookie and runs whether or not you accept analytics cookies.
• Where your visit came from: the campaign labels and referring host described in Section 3.2 are held only in the page's memory until you submit a form. Nothing is written to your device.
• Vercel Speed Insights: on our public marketing pages, your browser reports how fast the page loaded (for example load time and layout shift) to Vercel, our hosting provider. It sets no cookie and stores nothing on your device. Each measurement carries the page path without any query string, your browser, device type and operating system, a connection-speed band and your country, and is not linked to you or your IP address. It is not sent from report, account or sign-in pages.

No tracking cookies or tracking storage are set until you explicitly consent. If you choose “Essential only”, or later withdraw consent via Cookie Settings, the Google Analytics and PostHog cookies, and PostHog's and Apollo's local storage entries, are deleted and Apollo is not loaded again. You can change your preference at any time via the Cookie Settings link in the footer. Disabling analytics cookies will not affect the functionality of the service.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data:

• All data transmitted to and from telepath.pro is encrypted using TLS 1.2 or higher (HTTPS)
• Database data is encrypted at rest using AES-256 on SOC 2 Type II certified infrastructure (Supabase Cloud, EU West Ireland)
• API tokens and authentication credentials are encrypted using industry-standard algorithms
• Access to production systems is restricted and requires SSH key-based authentication (password authentication disabled)
• Compute processing hosted on Hostinger VPS, United Kingdom (ISO/IEC 27001:2022 certified)
• Dual-layer firewall: network-level firewall plus OS-level firewall, deny-all default policy
• All application traffic routed through Traefik reverse proxy for TLS termination
• No application ports directly exposed to the internet
• We conduct regular security reviews of our codebase and infrastructure
• All sub-processors are required to maintain appropriate security standards

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and will notify affected individuals without undue delay.

11. International Data Transfers

Some of our sub-processors are located outside the UK. Where a transfer needs a safeguard under UK data protection law, the one we rely on is named below or in Section 5. Where a safeguard is still being confirmed, we say so.

• EU-US Data Privacy Framework: for US-based providers certified under this framework (Stripe, Google Analytics, Apollo.io, Sentry, PostHog, Upstash)
• Standard Contractual Clauses with the UK Addendum: for UptimeRobot, and as the fallback for Apollo.io, PostHog and Upstash
• Standard Contractual Clauses (SCCs): for other US-based providers (OpenAI, Anthropic, Vercel, Resend, Google (Gemini), Axiom, Cloudflare (Turnstile))
• A web research provider (USA) for company signals: company names, domains and company-level search criteria only, no personal data. The safeguard for this transfer is being confirmed.
• Sentry (error monitoring): data region EU (our organisation is on Sentry's EU region). Safeguard for any US access: EU-US Data Privacy Framework with the UK Extension (DPA accepted 26 October 2026).
• PostHog (product analytics): our website sends analytics only to PostHog's EU servers, and the UK treats the EU as adequate. PostHog may also process data in the USA and elsewhere, as set out in its subprocessor list; this is covered by the EU-US Data Privacy Framework (UK Extension) and Standard Contractual Clauses with the UK Addendum (DPA countersigned 25 October 2026).
• Upstash (rate limiting): data region UK (London, eu-west-2). Safeguard: Upstash, Inc. is a US company; any US access is covered by the EU-US Data Privacy Framework (UK Extension), with Standard Contractual Clauses and the UK Addendum as fallback.
• Apollo.io: EU-US Data Privacy Framework with the UK Extension; Standard Contractual Clauses with the UK Addendum where the Framework does not apply
• Adequacy decisions — for transfers to countries deemed adequate by the UK government
• Domestic (UK) — Hostinger and Companies House API are UK-based and do not require international transfer safeguards

12. Children's Privacy

Telepath Pro is a business-to-business service intended for use by professionals aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and update the “Last updated” date at the top of this page. Your continued use of the service after notification constitutes acceptance of the updated policy.

14. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or your personal data:

Email: privacy@telepath.pro
Post: Telepath Pro, 1 Bolsover Road, Hove, BN3 5HQ, United Kingdom
ICO Registration: ZC101774

We aim to respond to all privacy enquiries within 5 business days.