Data Policy

Last updated 15 August 2026

This Data Policy is the technical and legal companion to our Privacy Policy. It sets out how Hookology connects to your marketing platforms, exactly what data we read and write, where it is stored, how our AI features use it, who processes it on our behalf, and the rights and obligations that apply under the UK GDPR, the Data Protection Act 2018 and PECR.

Our role

Processor for your connected platform data; controller for your account data.

Access model

OAuth with least-privilege scopes, tokens encrypted and never in the browser.

Isolation

Row Level Security binds every record to one workspace and one client.

AI boundary

Aggregates only, with no training on your data by model providers.

Hosting

UK and EU infrastructure, with safeguarded transfers where required.

Revocation

Disconnect or remove any source at any time from Data Sources.

On this page

Read alongside the Privacy Policy, Cookie Policy and Terms of Service. To remove data early, see Data Deletion.

Related policies

Data Policy

1. Scope and rolesWhen we are your processor, and when we are a controller in our own right.

2. How we connect to your platformsOAuth, least privilege, encrypted tokens and one-click revocation.

3. What data we readField-level detail by platform type, and what we explicitly do not want.

4. How data flows through the platformIngestion, normalisation, deterministic analysis, AI interpretation, action.

5. Data isolation and access controlRow Level Security, client scoping, staff access rules and audit logs.

6. AI processing in detailAggregates not identities, no training on your data, short provider retention.

7. Storage, location and international transfersUK and EU hosting, with safeguarded transfers for specific sub-processors.

8. Sub-processorsThe categories that process data for us, and your right to object.

9. Retention scheduleHow long each dataset lives, and how to shorten it.

10. Security measuresEncryption, RLS, least privilege, scanning, change control and incident response.

11. Your rights and how we support themWhat we do when a data subject request reaches us as processor.

12. Your obligations as controllerWhat you must have in place before connecting data to Hookology.

13. Data Processing AddendumThe Article 28 terms that apply automatically to every customer.

14. Incident response and breach notificationWhat we do in the first 72 hours.

15. Changes and contactNotice of material changes and where to send data protection enquiries.