Privacy Policy

1. Who we are

Folio is a business-admin tool for content creators — rate cards, media kits, deal tracking, contracts, invoices, and an AI assistant called Kit. This notice covers the Folio website at www.folioandkit.com and the Folio application.

The data controller is Froli Ltd (company number 17409426), trading as Folio, registered at 5 Percy Drive, St. Albans, United Kingdom, AL2 3FU.

For anything in this notice, write to privacy@folioandkit.com. A named person reads that inbox.

2. What we collect

Data you give us

Data we collect automatically

• Usage analytics. Page views and basic performance data via Vercel Analytics. This is aggregated and does not use cookies or build a profile of you.
• Technical logs. IP address, browser type and timestamps in server logs, kept short-term for security and debugging.
• Essential cookies. A session cookie from Clerk so you stay signed in, and a small preference cookie for your theme. See §12.

Data we do not collect

• Card details.Payments run through Stripe. Your card number never reaches Folio's servers. We hold a Stripe customer reference and your plan status, nothing more.
• Special category data. We do not ask for health, political, religious, biometric or similar data, and you should not put it into Folio.
• Your social account passwords. Platform stats are entered by you.

3. Why we use it, and our lawful basis

Under UK GDPR we need a lawful basis for every use. Here is ours, in full.

Where we rely on legitimate interests, we have weighed our interest against your rights and privacy. You can object at any time — see §10.

4. How Kit AI uses your data

Kit is the assistant built into Folio. When you ask Kit something, or use a Kit feature like the rate analyser or the contract scanner, we send the relevant parts of your data to a large language model provider so it can produce an answer.

What gets sent

Only what the specific request needs: your creator profile and platform stats, your rate card, and the deal, contract or invoice you are looking at. For chat, we also send recent turns of that conversation so Kit keeps context. We do not send your billing details, your password, or data belonging to other users.

Who processes it

Depending on configuration, either Anthropic (Claude models) or OpenAI (GPT models). Both act as our processors under contract.

Training

Neither provider uses data submitted through our API to train their models. That is the standard commercial API position for both, and it is a term of our agreement with them. We also do not train any model of our own on your data.

Retention at the provider

Providers may retain API inputs and outputs for a limited period for abuse monitoring — typically up to 30 days — after which they are deleted.

Kit is not a professional adviser

Kit produces suggestions, drafts and analysis. It is not legal, financial, tax or regulatory advice, it can be wrong, and you are responsible for anything you send or sign. See the Terms, §8.

5. Data about other people

Folio is a tool for managing relationships with brands, so your account will end up containing personal data about people who are not you — a marketing manager's name and email on a brief, a signatory on a contract, a billing contact on an invoice.

For that data, you are the controller and we are your processor: we hold and process it on your instructions, to provide Folio to you. You are responsible for having a proper basis to put it into Folio in the first place, and for telling those people how you handle their data if you need to.

We only use that data to deliver the service to you — for example, sending an invoice to the address you specify. We do not use it for our own purposes, and we delete it when you delete the record or your account.

Practical advice: you rarely need a brand contact's name in Folio to get value from it. Where you can leave it out, leave it out.

6. Who we share data with

We do not sell your data, rent it, or share it for anyone else's advertising. We use a small number of service providers, each under contract and each processing only what they need.

We will also disclose data where we are legally required to, and no further than required.

If Folio is ever acquired or merged, your data may transfer to the buyer. We would tell you before that happened and this notice would continue to apply until you were told otherwise.

7. International transfers

We are a UK business and we prefer UK and EU hosting. Some of our providers — including our AI providers — process data in the United States.

Where data leaves the UK, it is protected by one of: a UK adequacy decision; the UK Extension to the EU–US Data Privacy Framework; or International Data Transfer Agreements / the UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment where needed.

You can ask us for the specifics for any provider at privacy@folioandkit.com.

8. How long we keep it

9. Security

• Everything is encrypted in transit (TLS) and at rest.
• Authentication is handled by Clerk. We never see or store your password.
• Every database read and write is checked against the signed-in user's ID before it runs, so you cannot see another user's records and they cannot see yours.
• Access to production data is limited to people who need it, and it is a very short list.
• Payment card data never touches our infrastructure.

No system is perfectly secure. If a breach occurs that is likely to risk your rights and freedoms, we will notify the ICO within 72 hours and tell you without undue delay.

10. Your rights

Under UK GDPR you have the right to:

Exercising any of these is free. We respond within one calendar month, and usually much faster. We may ask you to confirm your identity from the email address on the account before we act on a request.

11. Deleting your data

You can delete your Folio account and everything in it. There are three ways to do it and you do not need to give a reason for any of them.

Option 1 — delete it yourself (fastest)

1. Sign in to Folio.
2. Go to Settings → Profile and scroll to Danger Zone.
3. Click Delete my account.
4. Type DELETE to confirm. This step exists because the action is irreversible.

Deletion begins immediately. Your account, profile, platforms, rate cards, deals, contracts, invoices, media kits, pitches, uploaded files and Kit conversations are removed from our live systems within 24 hours, and from encrypted backups within 30 days as those backups roll over. Any active subscription is cancelled at the same time.

Tip: use Export my data in the same panel first if you want a copy. Once deletion runs, we cannot recover anything.

Option 2 — email us

Send an email from the address on your Folio account to privacy@folioandkit.com with the subject “Data deletion request”. Tell us whether you want:

• Full deletion — your account and all content, or
• Partial deletion — specific records, for example all Kit conversations, or one particular deal and its files.

We will acknowledge within 3 working days and complete within 30 days, which is the statutory maximum. If the request is complex and we need the permitted extension, we will tell you why before the month is up. If your email address has changed and you can no longer send from the one on file, we will ask you a few questions to verify you are the account holder — we would rather annoy you briefly than delete someone's business records for an impostor.

Option 3 — by post

Write to the Data Protection Contact, Froli Ltd, 5 Percy Drive, St. Albans, United Kingdom, AL2 3FU. Include the email address on your account so we can find it.

What we keep after deletion, and why

Erasure is not absolute in law, and we would rather be specific than promise something untrue. After deletion we retain:

A contract that was signed by a brand through Folio is also a record they may have rights over. If a signed contract is deleted from your account, we retain the minimum signature audit record for that document only where we are legally required to, and we will tell you if that applies.

Deleting individual things without deleting your account

You do not have to go nuclear. Inside the app you can delete a single deal, contract, invoice, media kit, or Kit conversation at any time from that item's own screen. Deleting a record deletes its uploaded files with it.

12. Cookies

We use very few, and none for advertising.

Strictly necessary cookies do not require consent under PECR, which is why you are not being nagged by a banner. Our analytics (Vercel Analytics) is cookieless and does not track you across sites. If we ever add advertising or non-essential tracking, we will ask for your consent first and this section will change.

13. Children

Folio is a business tool and is not for under-18s. We do not knowingly collect data from children. If you believe a child has an account, email privacy@folioandkit.com and we will delete it.

14. Changes to this notice

We will update this page when what we do changes. The “last updated” date at the top always reflects the current version. If a change materially affects your rights — a new category of data, a new purpose, a new processor with real access — we will email you at least 14 days before it takes effect.

15. Complaints

Come to us first — privacy@folioandkit.com — and we will try to sort it out.

You also have the right to complain to the UK Information Commissioner's Office at any time:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113 · ico.org.uk/make-a-complaint