Connor — Privacy Notice
Zindex Limited trading as Connor · Version 1.3 · Effective 23 October 2026
This notice explains how we collect and use personal data when you visit runconnor.com, contact us or use the Connor Financial Promotions platform. Its product-specific provisions cover Financial Promotions, including agreed scheduled promotion monitoring; they do not describe processing through the separate AI Monitoring product or other services.
1. Who we are
Connor is a trading name of Zindex Limited, registered in England and Wales, company number 09390031, registered office 28 St. Georges Terrace, Herne Bay, England, CT6 8RH.
For privacy questions or requests, email support@runconnor.com with the subject "Privacy", or write to our registered office.
James Zhao is responsible for handling privacy enquiries. This contact role is not a formal Data Protection Officer appointment.
2. Our role
We are the controller of personal data we use to run our business: website enquiries, customer contacts, account administration, billing and security.
We are a processor for promotional material and review records that our customers submit to the platform. The customer decides what is submitted and how long it is kept, and our Data Processing Agreement governs that processing. If your information appears in a customer's material, please contact that customer. We will help them respond.
You may also contact us and we will route the request appropriately. Customer workspace activity recorded on instructions remains processor data; the same work email may separately be used for our own contract administration.
3. Information we collect
| Category | Examples | Source |
|---|---|---|
| Contact details | Name, work email, job title, organisation | You, your organisation or public business sources |
| Enquiries | Messages, review requests and uploaded files | You |
| Account information | User ID, role, sign-in events | You, your organisation and our authentication provider |
| Technical data | IP address, browser and device information, access times | Your device when you use the website or platform |
| Deck access | Email address, page opened and time | You, when you open a shared deck |
| Contract and billing | Signatory details, invoices, payment status | Your organisation |
Customer-controlled material may also include images, voices, social handles, extracted text, transcripts, comments, findings and review decisions. Supported links may retrieve the specified promotion and necessary page or post context. Where a customer selects scheduled monitoring, we also retrieve promotional material and necessary context from agreed websites and social channels, at frequencies up to once daily, to identify potential compliance issues and maintain review records on the customer’s instructions. This may include personal data about people appearing in those sources. The product does not include employee AI monitoring or endpoint scanning.
Work identity and access information are needed for a platform account; without them we cannot provide access. Other mandatory fields are identified when collected. Where we receive information indirectly, we provide the required privacy information within the applicable period, normally within one month or earlier at first contact or disclosure, unless a lawful exception applies.
4. How we use it
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and review requests, arranging demonstrations and managing customer relationships | Legitimate interests in running and growing our business |
| Providing, administering and supporting platform accounts | Legitimate interests in providing the service to our customers |
| Administering contracts, invoicing and keeping business records | Legitimate interests; legal obligation for accounting and tax records |
| Keeping the website and platform secure and preventing misuse | Legitimate interests in protecting our services and users |
| Counting website visits and actions such as demo requests, to improve the website | Legitimate interests in understanding how the website is used. You can object at any time (section 8) |
| Recording access to a shared deck and following up the business discussion | Legitimate interests in administering restricted access and responding to prospective customers |
| Sending business updates you have asked for or that we are allowed to send | Consent where required, otherwise legitimate interests. You can unsubscribe at any time |
| Handling privacy requests and complaints, and dealing with legal claims | Legal obligation; legitimate interests |
Making an enquiry or opening a deck does not sign you up for marketing.
If you personally enter a contract, necessary processing to perform it or take steps you request beforehand may instead rely on contract. We assess our legitimate interests against your rights; you can ask about that assessment and object. Customer content supplied for a review or support issue is processed on customer instructions.
We do not make decisions about individuals based solely on automated processing that have legal or similarly significant effects.
5. Who we share it with
We use the following service providers:
- Vercel: website and platform hosting, file storage and website visit statistics
- Supabase: platform database
- Clerk: platform sign-in
- Anthropic and OpenAI: AI-assisted review and audio transcription
- Resend: delivery of enquiries and platform notifications
- Google Workspace: business email
- Cal.com: booking a demonstration, when you choose a time
Provider details are included in the Sub-processors section of our Data Processing Agreement.
Selected link retrieval may also use Apify or an authorised proxy provider, identified in the customer's deployment schedule before use. Website requests are delivered through Resend to our Google Workspace email; the form endpoints do not create a separate contact database. Selected creative content passes to approved AI or transcription services. Notifications may include promotion titles and comment excerpts where enabled. We do not use customer material to train shared AI models; provider security retention is separate and is recorded in the agreed schedule.
We may also share information with professional advisers, insurers, banks, regulators and law enforcement where necessary, and with a buyer or successor if our business is sold, subject to confidentiality.
We do not sell personal data or share it with advertising networks.
6. International transfers
Some providers and their authorised personnel may process data outside the UK, including in the EEA or United States. Restricted transfers require an applicable adequacy decision or regulations, or safeguards such as the UK International Data Transfer Agreement or EU Standard Contractual Clauses with the UK Addendum where appropriate, together with any required assessment and additional measures. A data privacy framework is available only where the recipient and service are actually covered. Storage location alone does not establish all processing or access locations. Contact us for the applicable safeguards and a copy or meaningful account of them; confidential details may be redacted.
7. How long we keep it
| Information | Retention |
|---|---|
| Enquiries that do not lead to a contract | Up to 24 months after the last substantive contact, subject to an earlier valid deletion request |
| Files uploaded through the public review-request form | Deleted from our mailbox within 30 days after the request is closed |
| Customer contracts, invoices and business correspondence | Six years after the contract ends |
| Website visit statistics | Kept in aggregate in Vercel for the reporting period of our plan; the value Vercel uses to count a visitor is discarded after 24 hours |
| Account and security records | While needed to administer access, investigate a recorded incident, resolve an issue or meet a specific legal obligation; reviewed when access ends and when the issue closes |
| Marketing preferences | Until you unsubscribe; we keep a minimal record so we do not contact you again |
| Customer material on the platform | As agreed with the customer in its DPA |
| Privacy requests and complaints | While needed to resolve the request, demonstrate the response and address related legal claims; verification evidence is removed when no longer necessary |
A separate agreed review arrangement or specific legal hold may require retaining an attachment longer; the reason and review date are recorded. Mailbox deletion does not immediately erase provider backups or delivery logs. Customer backup and provider-copy expiry periods are recorded in the deployment schedule. Retained copies remain restricted, and we remove data no longer needed for its recorded purpose.
8. Cookies and visit statistics
The website and platform use storage for sign-in sessions, access to shared pages and preferences, including your choice about visit statistics. Blocking necessary storage may prevent access.
We count visits to runconnor.com with Vercel Web Analytics so we can see which pages are useful and improve the website. For each page view, Vercel records the page address, the referring site, filtered campaign parameters in the link, your approximate location (country, region and city), browser, operating system, device type and the time. We also count these actions, each with the page it happened on:
- a click on Book a demo, with which button it was: in the header, in the page or in its closing section;
- a completed demo booking, with the button that opened it but none of the booking's details;
- a click on one of our email addresses, with the address;
- opening one of our frequently asked questions, with the question;
- reaching the end of a guide or comparison;
- starting a review request, with whether it uses our sample or your own file, and submitting one;
- a sent contact form.
We never send what you type into a form.
Vercel sets no cookies for this and stores nothing on your device. It counts a visitor using a value derived from the request, which it discards after 24 hours, so the statistics do not identify you or follow you from one day to the next or across other websites. Vercel processes this information on our behalf, only to produce the statistics. We use the statistics, in aggregate, only to improve the website. We do not use them for advertising or profiling, and we do not combine them with information you send us.
Visit statistics rely on the exception for website statistics in the Privacy and Electronic Communications (EC Directive) Regulations 2003 (Schedule A1, paragraph 5), so they start when you open the website. You can object at any time, free of charge: choose Turn off in the notice shown on your first visit, or Turn off analytics at the foot of any page. We then stop collecting statistics from your browser and remember the choice on your device; you can turn statistics back on the same way. We also treat a Global Privacy Control signal from your browser as an objection.
The website uses no advertising cookies. Necessary authentication is separate from visit statistics.
9. Your rights
Depending on the processing and applicable law, you have the right to:
- access your personal data;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to our processing, including direct marketing at any time;
- receive your data in a portable format;
- withdraw consent where we rely on it.
Portability generally applies to eligible automated processing based on consent or your contract. The right to object to direct marketing is absolute. Withdrawing consent does not affect earlier lawful processing.
To exercise a right, email support@runconnor.com. We normally respond without undue delay and within one month. We may request proportionate identity evidence or clarification; any legally permitted extension or pause will be explained. Requests are normally free. Any lawful refusal or permitted fee will be explained with the available challenge routes.
10. Complaints
If you have a concern, you may contact us without using a special form. We will acknowledge a complaint within 30 days, investigate without undue delay, keep you informed and explain the outcome. This does not replace the separate rights-request deadline.
You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.
You do not have to contact us first and may approach another competent supervisory authority or seek a judicial remedy where applicable.
11. Security
Our security arrangements include application access controls and private file storage. The security provisions of our Data Processing Agreement set out the measures required for customer processing. Deployment-specific security information is available on request.
12. Changes
We may update this notice. We will post the new version here with its effective date and tell you directly about material changes where appropriate.