Last updated 13 November 2026
1. Who we are
Sequence AI Limited runs the website at sequenceai.co.uk and the Sequence AI platform at app.sequenceai.co.uk. We are registered in England and Wales, company number 14691783, registered office 11 The Crofts, Rotherham, England, S60 2DJ, and with the Information Commissioner’s Office as a data controller under registration ZB530309.
We are the data controller for the personal data described in this policy, except where section 3 says we act as a processor. For anything about data protection, contact us at hello@sequenceai.co.uk. Questions about this policy or your data go to that address, or by post to the address above.
2. What this policy covers
This policy covers three things:
- the website at sequenceai.co.uk, including the forms on it;
- the Sequence AI platform at app.sequenceai.co.uk, used by our clients and their staff;
- the emails, text messages, WhatsApp messages, web forms, landing pages and short links that our clients send or publish through the platform.
It does not cover other websites we link to. Each client who uses the platform has their own privacy policy for the people they contact, and that policy applies alongside this one.
3. Our two roles
Controller. For visitors to our website, for people who enquire about or trial the platform, and for our clients’ staff who sign in to it, we decide what data is collected and why. We are the controller and this policy is the full picture.
Processor. When a client uses the platform to hold their customers’ details and send them messages, the client is the controller and we process that data only on their instructions, under a written contract. If you have received a message sent through Sequence AI, the sender is the business named in it. Contact them to exercise your rights, or reply STOP to a text or use the unsubscribe link in an email, which the platform honours immediately. We will pass any request you send us to the client concerned.
4. What we collect, why, and on what basis
We collect only what each purpose needs. The lawful bases below are those in the UK GDPR.
| What | Why | Lawful basis |
|---|---|---|
| Name, email, phone and company from a website enquiry or trial form | To answer you and set up the trial you asked for | Taking steps at your request before a contract |
| Platform account details: name, email, role, sign-in times | To run your account, keep it secure and show who did what | Performance of the contract with your business |
| Billing details: company name, address, invoices; card details are held by Stripe, never by us | To invoice and take payment | Performance of the contract; legal obligation to keep accounting records |
| Support emails and messages you send us | To help you and keep a record of what was agreed | Legitimate interest in running the service |
| Website usage: pages visited, device, browser, referring page | To keep the site working and understand what people use | Legitimate interest; we set no analytics cookies (section 9) |
| Server logs: IP address, request time, errors | Security, fraud prevention, fault finding | Legitimate interest in keeping the service secure |
| Marketing emails to clients and trialists about the platform | To tell you about changes and new features | Consent, or the soft opt-in for existing clients; every email has an unsubscribe link |
We do not sell personal data, and we do not use it for automated decisions that have a legal or similarly significant effect on you.
As a processor for our clients (section 3) we hold their customers’ names, contact details, consent records, the products they hold, messages sent and replies received, form answers, and page visits. The client chooses what to collect and must have a lawful basis for it.
5. Connected Google accounts
A client, or Sequence AI on a client’s behalf, can connect a Google account to the platform so that it can work with Google Tag Manager, Google Ads, Google Analytics and Google Search Console. You choose which account to connect and which permissions to grant on Google’s own screen, and you can disconnect at any time from the platform or from your Google account settings.
What we access and why:
- Your Google email address, to show which account is connected.
- Tag Manager, to read and edit the containers you choose and publish the tags the platform installs for you.
- Google Ads, to read campaign, ad group, keyword and cost figures for the accounts you choose, and to apply changes you approve in the platform.
- Google Analytics, to read traffic and conversion figures for the properties you choose.
- Search Console, to read search clicks, impressions and positions for the sites you choose.
These figures are stored in the platform to produce your reports and are shown only to users of the client account they belong to. The sign-in itself is stored encrypted.
Our use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, and no human reads it except to provide the service you asked for, with your permission, for security, or where the law requires.
6. Who we share it with and where it is held
The platform and its database run on Railway in the European Union (Amsterdam). Personal data leaves the UK only to the suppliers below, each under a contract with the safeguards the UK GDPR requires, and in the United States only under the UK extension to the EU-US Data Privacy Framework or the standard contractual clauses.
| Supplier | What they do for us | Data they see | Where |
|---|---|---|---|
| Railway | Hosting, database, backups | Everything the platform holds | EU (Netherlands) |
| SMTP.com | Sends emails and reports bounces and complaints | Email addresses and message content | USA |
| Twilio | Sends texts and WhatsApp messages and receives replies | Phone numbers and message content | USA, with UK and EU edges |
| Stripe | Takes card payments | Billing name, address and card details (held by Stripe only) | USA and EU |
| Checkio | Checks a phone number is live and an email address is deliverable; finds addresses from a postcode | Phone numbers, email addresses, postcodes | UK |
| Mailgun | Receives files emailed to a client’s import address | The emailed file and the sender’s address | EU |
| Sign-in and the connections in section 5 | The account email and the figures described there | USA and EU |
We share data with nobody else except where the law requires it, for example a court order, or where a client instructs us to send their data somewhere, for example to their own CRM through the client API. If the business is sold, the data goes with it under the same terms.
7. How long we keep it
- Website enquiries and trials that do not become a client: 12 months from the last contact, then deleted. If you asked us not to contact you, we keep the minimum needed to honour that.
- Client accounts: for the life of the contract and 12 months after it ends, so you can come back or ask for an export, then deleted. Invoices and accounting records are kept for 6 years as the law requires.
- Server logs: 90 days.
- Clients’ customer data (where we are the processor): the client sets a retention period in their settings and manages removal themselves. Nothing is anonymised or deleted without the client’s instruction, and the platform shows the client each night how many records have passed their period. When a client leaves, their data is deleted 30 days after the contract ends unless they ask for it sooner.
- Suppression records: an opt-out or STOP is kept for as long as needed to make sure that person is not contacted again.
8. Your rights
Under the UK GDPR you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct anything that is wrong or incomplete;
- delete it, where we have no continuing reason to keep it;
- stop or restrict how we use it, including stopping all direct marketing;
- give you a copy in a form you can take to another provider;
- withdraw consent you have given, which does not affect what was done before you withdrew it.
Email hello@sequenceai.co.uk or write to the address in section 1. We will reply within one month and will not charge unless a request is clearly excessive. If your request is about messages sent by one of our clients, we will pass it to them and tell you we have done so.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would welcome the chance to put it right first.
9. Cookies
A cookie is a small file a website stores on your device. We use very few, and none for advertising.
The website at sequenceai.co.uk sets no analytics or advertising cookies, so there is no cookie banner: there is nothing to accept or refuse. To count how often a page is viewed, the site keeps the date of your last visit to that page in your browser’s own storage. It identifies nobody; it only stops the same visit being counted twice in a day.
The enquiry form on the website, like every form published through the platform, stores a random identifier in your browser when the form opens: a first-party cookie called seqai_vid, kept for 90 days. It links your visit to the form you send, so that we can see which page or campaign an enquiry came from, and it helps us spot misuse. It contains nothing about you. The form also keeps your answers in your browser for up to 24 hours so that a refresh does not lose them; they are removed when you send the form.
The platform at app.sequenceai.co.uk sets one strictly necessary cookie, the sign-in session. Without it you cannot sign in.
Forms and landing pages that clients publish through the platform work in the same way as our own enquiry form. A client may also add analytics or advertising tags of their own to their pages; those are covered by that client’s cookie policy.
You can block or delete cookies in your browser settings. Blocking the sign-in cookie will stop you signing in.
10. Changes to this policy
We will update this policy when the law, our suppliers or the platform change. The date at the top is the date of the current version. For a change that affects how we use your data in a significant way, we will tell clients by email before it takes effect.
This version replaces the previous policy in full.