Privacy Policy

1. Who we are

Folio is a business-admin tool for content creators — rate cards, media kits, deal tracking, contracts, invoices, and an AI assistant called Kit. This notice covers the Folio website at www.folioandkit.com and the Folio application.

The data controller is Froli Ltd (company number 17409426), trading as Folio and Kit, registered at 5 Percy Drive, St. Albans, United Kingdom, AL2 3FU.

For anything in this notice, write to privacy@folioandkit.com. A named person reads that inbox.

2. What we collect

Data you give us

Data we collect automatically

• Usage analytics. Page views and basic performance data via Vercel Analytics. This is aggregated and does not use cookies or build a profile of you.
• Technical logs. IP address, browser type and timestamps in server logs, kept short-term for security and debugging.
• Error reports. When something goes wrong, details of the error and the request that caused it are sent to our error-monitoring service, Sentry. For a sample of browser sessions, Sentry also records how the page behaved, with on-screen text and form inputs masked. See §8.
• Connected-assistant activity. If you connect another AI assistant to your account, a record of each action it takes — which tool, when, and whether it worked. See §5.
• Essential cookies. A session cookie from Clerk so you stay signed in, and a small preference cookie for your theme. See §14.

Data we do not collect

• Card details. Payments run through Stripe. Your card number never reaches Folio's servers. We hold a Stripe customer reference and your plan status, nothing more.
• Your social account passwords. Platform stats are entered by you.

Information you should not include

Folio's business-admin features do not require special category personal data, such as information about health, racial or ethnic origin, political opinions, religious beliefs or sexual orientation. Please do not include this information, or personal data about criminal allegations, proceedings or convictions, in your profile, uploaded documents or conversations with Kit. Redact these details from documents before uploading them.

Information you submit may be stored and, when relevant to a Kit request, sent to our AI providers as described below. If you have included information you want removed, contact privacy@folioandkit.com.

3. Why we use it, and our lawful basis

Under UK GDPR we need a lawful basis for every use. Here is ours, in full.

Where we rely on legitimate interests, we have weighed our interest against your rights and privacy. You can object at any time — see §12.

4. How Kit AI uses your data

Kit is the assistant built into Folio. When you ask Kit something, or use a Kit feature like the rate analyser or the contract scanner, we send the relevant parts of your data to a large language model provider so it can produce an answer.

What gets sent

Only what the specific request needs: your creator profile and platform stats, your rate card, and the deal, contract or invoice you are looking at. For chat, we also send recent turns of that conversation so Kit keeps context. We do not send your billing details, your password, or data belonging to other users.

Who processes it

Depending on configuration, either Anthropic (Claude models) or OpenAI (GPT models). Both act as our processors under contract.

Two checks also use TypeSafe, whose Jev model returns yes/no judgments rather than written text: the contract scanner's red-flag checks, which send the contract text being scanned, and the ASA disclosure check, which sends the caption being checked and its platform. TypeSafe acts as our processor.

To find and fix faults, the content of a sample of Kit requests and replies, with timing and usage figures, is also recorded in our error-monitoring service, Sentry (see §8).

Training

Neither Anthropic nor OpenAI uses data submitted through our API to train their models. That is the standard commercial API position for both, and it is a term of our agreement with them. We also do not train any model of our own on your data.

Retention at the provider

Providers may retain API inputs and outputs for a limited period for abuse monitoring — typically up to 30 days — after which they are deleted.

Kit is not a professional adviser

Kit produces suggestions, drafts and analysis. It is not legal, financial, tax or regulatory advice, it can be wrong, and you are responsible for anything you send or sign. See the Terms, §8.

5. Connecting Folio and Kit to other AI assistants

You can connect your Folio and Kit account to an AI assistant you already use — for example Claude, ChatGPT, a Notion Custom Agent, or another tool that supports the Model Context Protocol (MCP). Once connected, you can ask that assistant to look things up in your account or do things in it for you. Nothing is connected unless you set it up.

You start it, and you control it

A connection only exists if you add Folio and Kit in the assistant, then sign in to your Folio and Kit account and approve access on our consent screen. Sign-in and consent are handled by our authentication provider, Clerk. We do not choose which assistant you use, and we never connect one on your behalf. The assistant acts on the requests you make of it.

What the assistant can see and do

Through the connection, the assistant can read your creator profile, deals, contracts, invoices, media kit, rate cards, earnings, and Folio Value and Folio Index. That includes personal data about other people held in those records, such as a brand contact's name and email (see §7). It cannot read your bank details.

It can also create and update deals, and draft contracts and invoices. Sending an invoice, contract or email to a brand, or publishing your media kit, is marked as an action that needs your confirmation, and assistants ask you before running actions marked this way unless you have set them to approve automatically. How that confirmation looks, and whether you can turn it off, is up to the assistant.

Each action is limited to what your plan already includes. Connecting an assistant does not unlock anything extra.

Where your data goes

When the assistant asks for something, we send the result to it. From that point the data is processed by the company behind the assistant — for example Anthropic, OpenAI or Notion — under your own account, terms and privacy settings with them. For this, they are not our processors: what they keep, for how long, where, and whether they use it to train models is set by your agreement with them, so check your settings there.

This is different from Kit. When Kit uses Anthropic or OpenAI (§4), they act as our processors under our contract with them. When you connect your own Claude or ChatGPT account, they act under yours.

Some things the assistant can ask for — for example a contract scan or a rate analysis — run on Kit's own AI features. Those send the relevant data to our AI providers exactly as described in §4.

What we log

For security and audit, we record every action a connected assistant takes: which tool it used, when, and whether it succeeded. Actions that change something in your account, such as creating or updating a deal, also appear in your activity feed, the same as changes you make in the app. We do not receive your conversation with the assistant — only the requests it sends to Folio and Kit.

Disconnecting

You can disconnect at any time by removing Folio and Kit in the assistant's own settings — in Claude, for example, under Settings → Connectors. That stops the assistant using your account. If you also want us to revoke its access from our side, or you cannot get to the assistant's settings, email privacy@folioandkit.com and we will do it. Deleting your Folio and Kit account (§13) ends every connection.

Disconnecting does not delete anything the assistant has already received. That is held by the assistant's provider under your terms with them — ask them if you want it removed.

6. Folio Value, Folio Index and personalised insights

Folio calculates two numbers from your own data: Folio Value, an estimate of what your creator business is worth, and Folio Index, a score reflecting revenue durability, concentration, pricing power, growth and diversification. We also generate personalised recommendations from the same model.

What we use

Your creator profile, platform stats, deal history, contract terms and invoice records — only data from your own account. Folio Value and Folio Index are derived from this data, not a republishing of it: anyone who sees your Index cannot see the underlying revenue, invoices or payment records behind it.

How it's calculated

Folio Value starts from your trailing 12 months of settled revenue — invoices that have actually been paid in full, not just sent. That figure is then adjusted by a multiplier built from five factors, each based on your own data:

• Durability — how much of your revenue is recurring (a signed retainer, a repeat brand) versus one-off deals.
• Growth — your last 6 months of revenue compared to the 6 months before that, excluding retainer income so a single booked retainer can't manufacture a growth trend.
• Concentration — a penalty if too much of your revenue comes from one brand.
• Rate power — how your achieved rates compare to your own rate card, not an external market rate.
• Diversification — how spread out your revenue is across platforms and income types.

Folio Value is your settled revenue multiplied by this factor (bounded between 0.5× and 4×). Folio Index is a 0–100 score derived from the multiplier alone, deliberately independent of your revenue size, so a smaller creator with a stable, well-structured business can score as well as, or better than, a bigger one with scattered income.

We only show a number once there is enough data behind it. Under 3 settled deals, we show nothing. 3–7 deals, or under 6 months of history, gets a provisional range rather than a precise figure. A full figure needs 8 or more settled deals and 6 months of history. Year-on-year comparisons need 15 deals and 12 months.

What's not yet real-world calibrated

The inputs above are always 100% your own data. What is not yet calibrated is the multiplier formula itself — its weights, thresholds and scoring curve were set using general market research, because we don't yet have enough active users to calibrate them from real, aggregated Folio outcomes instead. Folio Value and Folio Index are Folio's own estimates, not a third-party valuation, appraisal, or a measured ranking against real creators, and any payment you record is not bank-verified — the figures reflect what you told us, scored against a formula built from general research rather than observed Folio outcomes.

What changes as Folio grows

Once enough creators are active, we plan to periodically recalibrate this formula — its weights, thresholds and curve — using aggregated, anonymised data from real deals across the platform. This is not active yet. Before it goes live, we will update this notice with the lawful basis for that specific use, and give you a separate choice about whether your anonymised deal data contributes to it.

Storage

We keep at most one snapshot of your Folio Value and Index per calendar month — created the first time it's needed that month, whether that's you opening your dashboard, asking Kit about it, or a scheduled check we run for every account. Each snapshot records the calculated Value, Index score, and the driver breakdown behind it at that point in time. What you see on your dashboard, media kit or in Kit chat is always calculated fresh — the stored snapshot is what powers month-over-month comparisons like "what moved your Value."

While your account is open, snapshots build up indefinitely — we don't currently delete or age out old ones. When you delete your account, every snapshot is deleted immediately along with it, with no retention period afterward — unlike invoices, which we keep for six years after deletion to meet UK tax record-keeping law (see §10). Folio Value and Index history isn't a legal record, so none of it survives account deletion.

Visibility

Folio Value is private to you and never shown to anyone else. Folio Index can only appear on a public media kit if two separate conditions are both true:

• You have switched on "Show my Folio Index on this media kit" in your media kit editor — off by default, and you can switch it off again at any time.
• Your Index has reached the confidence level needed for public display: 8 or more settled deals and 6 months of history (see "How it's calculated" above). Below that, Index is still visible to you on your own dashboard, but is never shown publicly — a provisional score on a public media kit could mislead a brand reading it.

If either condition isn't met, Index simply doesn't appear on your media kit.

Is this profiling?

Yes. Using aspects of your business performance to generate a score is "profiling" under UK GDPR, even though it doesn't make any decision about you on its own — you decide what, if anything, to do with the number. Our lawful basis is Contract for calculating Value and Index — it's part of the product you signed up for — and Consent for showing Index on a public media kit. Publishing Index is off by default; you choose to switch it on in your media kit editor, and can switch it off again at any time.

7. Data about other people

Folio is a tool for managing relationships with brands, so your account will end up containing personal data about people who are not you — a marketing manager's name and email on a brief, a signatory on a contract, a billing contact on an invoice.

For that data, you are the controller and we are your processor: we hold and process it on your instructions, to provide Folio to you. You are responsible for having a proper basis to put it into Folio in the first place, and for telling those people how you handle their data if you need to.

We only use that data to deliver the service to you — for example, sending an invoice to the address you specify. We do not use it for our own purposes, and we delete it when you delete the record or your account.

Practical advice: you rarely need a brand contact's name in Folio to get value from it. Where you can leave it out, leave it out.

8. Who we share data with

We do not sell your data, rent it, or share it for anyone else's advertising. We use a small number of service providers, each under contract and each processing only what they need.

WhatsApp is opt-in, and you can withdraw that at any time — unlink it in Settings → Channels, or text “stop” to Kit's WhatsApp number directly; either immediately removes your phone number from your account and stops any further messages there. A copy of your phone number may remain visible in your own past WhatsApp conversation history inside Folio until that conversation or your account is deleted (see §13).

Sub-processors and financial data

Neon is our database hosting provider. All data you store in Folio — including any bank details you enter under Settings → Business — is held on Neon's infrastructure. Neon acts as a data processor under contract. You can review their data processing terms at neon.tech/dpa.

Bank account details (account name, sort code, account number or payment link) are stored solely for the purpose of rendering payment instructions on invoices you generate through Folio. They are never used for any other purpose, never shared with third parties beyond what is required to host the database, and never used to initiate or process a payment on your behalf.

We will also disclose data where we are legally required to, and no further than required.

If Folio and Kit is ever acquired or merged, your data may transfer to the buyer. We would tell you before that happened and this notice would continue to apply until you were told otherwise.

9. International transfers

We are a UK business and we prefer UK and EU hosting. Some of our providers — including our AI providers — process data in the United States.

Where data leaves the UK, it is protected by one of: a UK adequacy decision; the UK Extension to the EU–US Data Privacy Framework; or International Data Transfer Agreements / the UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment where needed.

This section covers our own providers. If you connect another AI assistant (§5), data it fetches goes to that assistant's provider under your own agreement with them, and where they process it is set by their terms, not ours.

You can ask us for the specifics for any provider at privacy@folioandkit.com.

10. How long we keep it

11. Security

• Everything is encrypted in transit (TLS) and at rest.
• Authentication is handled by Clerk. We never see or store your password.
• Every database read and write is checked against the signed-in user's ID before it runs, so you cannot see another user's records and they cannot see yours.
• Access to production data is limited to people who need it, and it is a very short list.
• Payment card data never touches our infrastructure.
• A connected AI assistant never sees your password. Every action it takes is checked against your account and your plan in the same way as the app.

No system is perfectly secure. If a breach occurs that is likely to risk your rights and freedoms, we will notify the ICO within 72 hours and tell you without undue delay.

12. Your rights

Under UK GDPR you have the right to:

Exercising any of these is free. We respond within one calendar month, and usually much faster. We may ask you to confirm your identity from the email address on the account before we act on a request.

13. Deleting your data

You can delete your Folio account and everything in it. There are three ways to do it and you do not need to give a reason for any of them.

Option 1 — delete it yourself (fastest)

1. Sign in to Folio.
2. Go to Settings → Profile and scroll to Danger Zone.
3. Click Delete my account.
4. Type DELETE to confirm. This step exists because the action is irreversible.

Deletion begins immediately. Your account, profile, platforms, rate cards, deals, contracts, invoices, media kits, pitches, uploaded files and Kit conversations are removed from our live systems within 24 hours, and from encrypted backups within 30 days as those backups roll over. Any active subscription is cancelled at the same time.

Tip: use Export my data in the same panel first if you want a copy. Once deletion runs, we cannot recover anything.

Option 2 — email us

Send an email from the address on your Folio account to privacy@folioandkit.com with the subject “Data deletion request”. Tell us whether you want:

• Full deletion — your account and all content, or
• Partial deletion — specific records, for example all Kit conversations, or one particular deal and its files.

We will acknowledge within 3 working days and complete within 30 days, which is the statutory maximum. If the request is complex and we need the permitted extension, we will tell you why before the month is up. If your email address has changed and you can no longer send from the one on file, we will ask you a few questions to verify you are the account holder — we would rather annoy you briefly than delete someone's business records for an impostor.

Option 3 — by post

Write to the Data Protection Contact, Froli Ltd, 5 Percy Drive, St. Albans, United Kingdom, AL2 3FU. Include the email address on your account so we can find it.

What we keep after deletion, and why

Erasure is not absolute in law, and we would rather be specific than promise something untrue. After deletion we retain:

A contract that was signed by a brand through Folio is also a record they may have rights over. If a signed contract is deleted from your account, we retain the minimum signature audit record for that document only where we are legally required to, and we will tell you if that applies.

Deleting individual things without deleting your account

You do not have to go nuclear. Inside the app you can delete a single deal, contract, invoice, media kit, or Kit conversation at any time from that item's own screen. Deleting a record deletes its uploaded files with it.

14. Cookies

We use very few, and none for advertising.

Strictly necessary cookies do not require consent under PECR, which is why you are not being nagged by a banner. Our analytics (Vercel Analytics) is cookieless and does not track you across sites. If we ever add advertising or non-essential tracking, we will ask for your consent first and this section will change.

15. Children

Folio is a business tool and is not for under-18s. We do not knowingly collect data from children. If you believe a child has an account, email privacy@folioandkit.com and we will delete it.

16. Changes to this notice

We will update this page when what we do changes. The “last updated” date at the top always reflects the current version. If a change materially affects your rights — a new category of data, a new purpose, a new processor with real access — we will email you at least 14 days before it takes effect.

17. Complaints

Come to us first — privacy@folioandkit.com — and we will try to sort it out.

You also have the right to complain to the UK Information Commissioner's Office at any time:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113 · ico.org.uk/make-a-complaint