Privacy Policy

1. Scope and controller

1.1 V1 business information

This V1 is effective from the date shown above. The controller and operator is WITHIN7 LTD, trading as Within7, a private company limited by shares registered in England and Wales with company number 17466931, incorporated on 18 September 2026.

Its registered office, and its address for correspondence, is 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

This Privacy Policy applies to Within7's websites, public creator profiles, registration, inbox, email routing, sender verification, creator-team functions, support, safety, paid enquiries, creator payouts, and related services (the Service). It covers visitors, senders, creators, creator-team members, support contacts, and people whose information appears in a message, report, or transaction.

The Within7 operator identified in the Terms & Conditions is the controller of personal information used for Within7's core purposes, including accounts, profiles, communications, transactions, security, fraud prevention, support, moderation, complaints, and legal compliance. This means Within7 determines why and how that processing occurs. Where a written agreement expressly makes Within7 a processor for a separate service, that agreement governs that processing.

This Policy is designed as one global notice. Privacy laws differ, and the rights, legal bases, disclosures, and safeguards described below apply to the extent required in the circumstances. Mandatory rights are not reduced because this Policy uses global wording.

2. People and data-protection roles

• Senders provide contact and identity information, verify an email address, submit an enquiry to a selected creator, and may make a payment without opening a creator account.
• Creators operate a public profile and workspace, connect social profiles, set preferences and prices, review and reply to enquiries, block senders, and receive payouts.
• Creator-team members may receive permissions to read, reply, comment, assign, or manage messages only where Within7 expressly enables those functions and the creator grants access.
• Within7 personnel and providers process information as needed to operate, secure, support, and enforce the Service.

A creator normally acts as an independent controller when deciding how to respond, continuing a relationship, exporting information, or using sender data for the creator's own purposes. The creator is responsible for that separate use, including any notice, legal basis, security, retention, marketing, and rights obligations. Creator-team members act under the creator's authority. Contact the creator about their independent use and Within7 about processing within Within7.

3. Information we process

We process the following categories depending on your role, location, and the features you use:

Messages or reports may incidentally reveal health, disability, race or ethnicity, religion, political views, trade-union membership, genetics, biometrics, sex life, sexual orientation, alleged offences, or other sensitive information. Within7 does not ask users to include those details. Do not provide them unless necessary, lawful, and safe. Where we intentionally use sensitive or offence information, we do so only when applicable law permits it and any required additional condition, authorisation, policy, or safeguard is in place.

4. Where information comes from

We collect information:

• directly from you when you register, verify, connect, message, reply, pay, configure a workspace, or contact us;
• from another user who addresses, mentions, invites, assigns, reports, pays, or corresponds with you;
• from authentication, social, email, payment, identity, banking, tax, and payout providers involved in a feature you use;
• from public social profiles and content a creator chooses to connect;
• automatically from devices, browsers, cookies, requests, email and payment events, and interaction with the Service; and
• from advisers, fraud-prevention sources, competent authorities, and other people where necessary for a safety, legal, or payment matter.

If you provide another person's information, you must be authorised to do so and give any notice required by law. Public availability does not remove privacy rights. Where law requires us to notify a person whose information we obtained indirectly, we will provide the required information unless a documented exception applies.

5. Why we use information and our legal bases

We use personal information only for the purposes below. Where law requires a legal basis, we rely as appropriate on performing or taking steps toward a contract, complying with law, legitimate interests, consent, protecting vital interests, and establishing or defending legal claims. Where another legal standard applies, we process only as that standard permits.

When we rely on legitimate interests, we consider necessity, expectations, likely impact, and safeguards. When we rely on consent, you may withdraw it without affecting earlier lawful processing.

6. Messages, creator profiles, and social connections

When a sender contacts a creator, Within7 discloses the sender's name, verified email, sender type, organisation where supplied, and message to that creator. The information may appear in the Within7 inbox, an email notification, and a routed email thread. It is available to authorised creator-team members only where the feature is enabled and access is granted. Creator replies are sent to the sender's verified email.

Messages and internal comments are not posted publicly by Within7, but they are not end-to-end encrypted. Within7 personnel and providers may access them where necessary and legally permitted for delivery, support, security, moderation, payment disputes, investigations, or law. A recipient may copy, export, screenshot, forward, or separately retain a message, and Within7 cannot control an independent recipient's use.

A public creator profile may show the creator's name, handle, Within7 address, biography, website, image, connection badge, audience totals, linked profiles, selected public social content and metrics, and contact price. A connection badge indicates control of the connection when it was made; it is not legal-identity, age, credential, background, or conduct verification.

Social access is obtained through the selected provider and Within7's authentication provider. Within7 does not use the connection to post to the creator's account. Revoking or unlinking stops future access when completed, but does not necessarily erase information that remains necessary for a transaction, audit, safety matter, backup, or legal obligation.

If you connect a YouTube channel, Within7 uses YouTube API Services with read-only access. We use it only to confirm that you control the channel you select and to show the channel's public name, handle, image, subscriber count, and recent uploads on your Within7 profile. Within7 does not store your Google access token, and it does not post to, change, or delete anything on your channel. Google handles information under the Google Privacy Policy, and by connecting you also agree to the YouTube Terms of Service. You can revoke Within7's access at any time in your Google security settings; unlinking the channel in Within7 also deletes the channel information and content we stored from it.

7. Payments, identity checks, and creator payouts

Stripe processes paid-enquiry checkout, card authorisation, capture, release, refund, dispute, creator verification, transfers, and payouts. Card and bank information entered on Stripe-hosted interfaces is provided directly to Stripe. Within7 does not need the full card number or bank credentials to operate the Service, but receives identifiers, status, amounts, fees, risk information, and other transaction data.

When a creator uses Stripe-hosted or another hosted verification flow, that provider receives raw identity documents and full bank information directly. Within7 seeks to avoid receiving copies where they are not needed. Depending on the creator's country, entity type, payment configuration, and legal requirements, Within7 may receive or need to retain identity and business details, representatives or beneficial owners, tax residence and identifiers, VAT/GST status, verification results, and payout-account information. Stripe's checks do not remove Within7's own seller, sanctions, tax, consumer, or platform-reporting obligations.

When a creator sets up payouts, Within7 records the country they choose for their payout account. That country decides where Stripe opens the creator's connected account, which currency it holds, and what Stripe asks the creator for, and Stripe may process the information through its group company for that region. For a payout account in the United States or Canada, Within7 also gives Stripe a business category, a statement name, and the creator's public Within7 profile address, because Stripe requires them for an account there.

Where Within7 is a reporting platform operator under digital-platform tax-reporting rules, such as the UK Platform Operators (Due Diligence and Reporting Requirements) Regulations 2023 or rules implementing the OECD Model Rules elsewhere, we report the information those rules require about creators and their earnings to HM Revenue & Customs or another competent tax authority. That authority may exchange it with the tax authority of the creator's country of residence. We will tell affected creators what was reported about them.

We use payment and verification information to operate transactions, calculate creator payouts and Within7 fees, prevent fraud, administer refunds and disputes, reconcile accounts, comply with sanctions and financial requirements, report seller income where required, and establish or defend claims. Payment providers, banks, card networks, tax authorities, and verification providers may process information as independent controllers under their own notices.

8. Who receives personal information

We disclose information only for the purposes described in this Policy, at your direction, or where otherwise permitted or required by law. The recipients may include:

• the selected sender or creator and authorised creator-team members, to provide the requested communication and workspace;
• our authentication providers, for identity, sign-in, sessions, and account security;
• Stripe, banks, card networks, identity and tax providers, for checkout, verification, fraud controls, refunds, disputes, transfers, reporting, and payouts;
• Resend and related email or webhook infrastructure, for inbound and outbound email and delivery records;
• our error-monitoring provider, which receives technical error reports (including the page address, browser details, and, where an error concerns a specific account or enquiry, an identifier for it), and our DNS and web-traffic provider, through which requests to Within7 may pass;
• social providers you choose to connect, to authenticate, retrieve, refresh, or disconnect selected creator information;
• hosting, database, storage, security, logging, support, and other infrastructure providers that operate or protect the Service;
• professional advisers, auditors, insurers, investors, lenders, and parties to a proposed or completed corporate transaction, subject to appropriate need and confidentiality; and
• courts, regulators, tax and law-enforcement authorities, emergency services, and other competent recipients in response to law, valid process, mandatory reporting, or a legally recognised emergency.

A recipient may act as Within7's processor, an independent controller, or in different roles for different purposes. We do not currently sell or rent personal information or disclose it for cross-context behavioural advertising. If that practice changes, we will update this Policy and provide any required notice, consent, or opt-out before the change applies.

9. International transfers

Within7 is intended for international use. We and our providers may process information in countries other than the country where it was collected. Privacy laws and government-access rules may differ there.

Within7 is based in the United Kingdom, and the following providers currently process personal information for us. The locations are those the providers currently use and may change; we keep this list current.

• Railway: application hosting, in the United States (east) and the EU (west).
• Neon: the database, hosted on Amazon Web Services in the United States (east).
• Amazon Web Services (S3): attachment storage and scanning, in the United States.
• Clerk: sign-in, sessions, and social-account connection.
• Stripe: payments, creator verification, and payouts.
• Resend: inbound and outbound email.
• An error-monitoring provider and a DNS and web-traffic provider.
• Google (YouTube), TikTok, and Meta (Instagram), only for the creator social accounts you choose to connect.

Where personal information is sent to a country without a UK adequacy decision, including the United States, we rely on the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”) where the recipient is certified under it, and otherwise on the Information Commissioner's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, contained in the provider's data-processing terms. You may ask us for information about the safeguard that applies to your data, subject to lawful confidentiality restrictions.

Where European Union, European Economic Area, or Swiss data-protection law applies to our processing, for example for creators or senders in those countries, we rely on the adequacy decisions those jurisdictions have adopted for the United Kingdom for transfers to us. For onward transfers to a country without an adequacy decision, we rely on the EU–US Data Privacy Framework, or its Swiss extension, where the recipient is certified under it, and otherwise on the European Commission's standard contractual clauses, with the amendments Swiss law requires where it applies, in the provider's data-processing terms.

10. How long we retain information

We retain personal information only while reasonably necessary for the purpose for which it was collected and for compatible legal, safety, security, accounting, dispute, and record-keeping purposes. We determine the period by considering the nature, volume, sensitivity, and context of the information; the account, conversation, or transaction lifecycle; user expectations; fraud and safety risk; provider constraints; legal reporting and limitation periods; and whether the purpose can be met by deletion, aggregation, or de-identification.

• Account, profile, social-connection, and workspace information is generally retained while the account or feature remains active and for a reasonable closure and recovery period afterward.
• Email verification codes and an enquiry that was started but never paid for or sent (including the message you typed) are deleted 30 days after they expire. Rate-limit records are kept only for the length of the limit window, and short-lived connection state for minutes.
• When a creator archives a conversation, Within7 deletes that conversation and its messages, comments, participant access, and attachment records after six calendar months. A conversation with no activity for 12 months is archived automatically, so it is deleted about 18 months after its last activity unless it is restored or receives a permitted reply first. Any stored attachment objects are queued for secure deletion. Restoring the conversation, or receiving a permitted reply before deletion, removes the archive date and restarts the lifecycle.
• A sender record with no remaining conversation, block, or safety report is deleted. Personal details in the raw event records we receive from our payment provider are removed after 90 days; the event identifier, type, and time are kept with the payment record.
• Minimal delivery, payment, audit, safety, or enforcement records may be retained separately where they remain necessary. Open disputes, safety reviews, legal holds, or unresolved operational obligations can delay deletion until the relevant matter is resolved.
• Payment, payout, refund, dispute, tax, seller-reporting, sanctions, and accounting records are retained for the periods required by applicable financial, tax, and record-keeping law, generally six years, and audit records of account and payment actions for up to six years, the period in which a legal claim can generally be brought.
• When you ask us to close your account or erase your information, we act within one month, deleting or anonymising your account details except records we must keep for the reasons above.
• Support, safety, fraud, incident, enforcement, and legal records are kept until the matter and relevant preservation or claims periods end, with access restricted according to need.
• A minimal suppression record may be retained as needed to honour a marketing or communication opt-out.

A legal hold, mandatory preservation duty, active investigation, or claim may require longer restricted retention. Backups are deleted or overwritten through their normal lifecycle unless isolated for a valid reason. Deletion from Within7 does not delete copies independently held by another user, an email provider, a payment provider, or another controller. When information is no longer needed, we delete, de-identify, aggregate, or securely isolate it as appropriate.

11. Security and incident response

We use technical and organisational measures designed for the nature and risk of the information we process. Depending on the system, these may include managed authentication, role and ownership checks, access restrictions, transport encryption, salted and hashed verification codes, rate limits, audit records, webhook authentication, environment separation, provider security controls, backups, monitoring, and incident procedures.

No service, device, email, or transmission is completely secure. Protect your account and email, keep credentials and thread links confidential, use secure devices, and notify us promptly of suspicious activity. If a personal-data breach requires notice, we will notify affected people and competent authorities as required by applicable law.

12. Cookies, similar technologies, and marketing

Within7 and its authentication provider use cookies and similar storage that are necessary for sign-in, session continuity, security, fraud prevention, and requested social-account connections. A signed social connection-state cookie is short-lived. Authentication-cookie names, access, and duration depend on the provider and account configuration.

Sign-in also uses a bot-protection check from our authentication provider, which may load a script from its provider to tell people from automated traffic; our error-monitoring provider receives technical error reports as described in section 8. We treat these as necessary for security and to keep the Service working. Within7 does not currently deploy advertising cookies or a third-party analytics SDK. Before using a non-essential technology, we will provide information about its provider, purpose, and duration and obtain consent or offer refusal and withdrawal where required. Browser or universal opt-out signals are honoured to the extent applicable to processing we conduct.

We send messages needed for accounts, transactions, security, support, and the Service. Optional marketing is sent only where permitted, and each recipient can opt out. A creator needs its own lawful authority before using sender details for marketing outside the requested conversation.

13. Automated processing and AI

Within7 uses automated processing for sender verification, rate limits, email routing, delivery state, payment deadlines, capture or release, provider reconciliation, spam or fraud indicators, and operational prioritisation. Payment, identity, social, and security providers may independently use automated checks under their own notices.

Recorded events may automatically initiate payment capture or release under the transaction rules. A person may challenge the transaction through the Contact page, and we provide human review where applicable law requires it. Within7 does not currently use private message content to train a general-purpose AI model or target advertising. If we introduce materially different AI or automated decision-making, we will assess it and provide any required explanation, notice, choice, or review before it applies.

14. Children

The Service is intended only for people aged 18 or older and is not directed to children. A person under18 must not register, join a workspace, send an enquiry, or otherwise use Within7. Sexual or lewd content is prohibited for every user regardless of age.

We may use proportionate age-assurance measures where justified by law and risk and, where possible, retain an age-band or pass result rather than underlying evidence. If we learn that a child used Within7, we may restrict access, delete or de-identify information where appropriate, preserve evidence needed for safety or law, and make required reports. A parent, guardian, or other person may report a concern without sending unlawful imagery. Contact local emergency services first if anyone is in immediate danger.

15. Your privacy rights

Depending on applicable law and context, you may have rights to know whether and how we process information; access or receive a copy; correct it; delete it; restrict or object to processing; receive portable data; withdraw consent; opt out of direct marketing, sale, sharing, targeted advertising, or specified profiling; request human review of certain automated decisions; appeal a decision; and receive equal service without unlawful discrimination for exercising a right.

To exercise a right, use the Contact page or email [email protected]. Describe the right, the account or email involved, and relevant context. We may request proportionate information to verify identity and authority. An authorised agent may need to show authority, and we may ask the person to verify directly.

We respond within the period required by applicable law and ordinarily without charge. Rights are not absolute. We may retain or withhold information where law permits or requires it, including to protect another person, preserve confidentiality, prevent fraud, fulfil safety or evidence duties, comply with law, or establish and defend claims. If we deny a request, we will explain the reason and available appeal or complaint route where required.

16. Privacy complaints

You may complain through the Contact page or by emailing [email protected]. We will investigate and respond as required by applicable law, and we will acknowledge a complaint within 30 days. In the United Kingdom you may complain to the Information Commissioner's Office (ICO), the UK data-protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. Elsewhere you may complain to the privacy or data-protection authority where you live, work, or believe a violation occurred. You do not have to contact Within7 before exercising a right to complain to an authority.

17. Changes to this Policy

We may update this Policy when the Service, providers, law, or our practices change. We will post the updated version and effective date and provide additional notice of a material change where appropriate or required. We will request consent before a change where law requires it. Earlier versions are retained or made available where necessary to understand processing that occurred under them.

18. Contact Within7

The Within7 legal entity and establishment identified in the Terms & Conditions is responsible for this Policy. For a privacy request, complaint, question, safety concern, or information about transfer safeguards, use the Contact page or email [email protected]. Where applicable, details of a data-protection officer or legally required representative will be provided here or through the Contact page.

Do not email passwords, full payment-card or bank details, identity documents, or suspected unlawful imagery. If evidence is necessary, ask Within7 for a secure and lawful submission method.