Legal

Privacy notice

Last updated 18 October 2026

Who we are

Horizon Authority is run by Alex Varnals, a sole trader trading as Horizon Authority. We decide how your information is used, which makes us the “controller” under UK data protection law.

The short version

This site sets no cookies and has no analytics, advertising or tracking.
If you send a request through the form, we keep what you typed so Alex can reply, and email it to him.
If you're a client, your account holds your business details and the work we do for you.
Some of the work is done with AI services, which process what you give us to write drafts and pages.
We never sell your information or share it for anyone else's marketing.

What we collect, why, and our lawful basis

Requests through the form

What: your name, email address, business or website, the kind of business, your message, and the date. We also keep a scrambled version (a keyed hash) of your IP address, never the address itself.

Why: to read and answer your request, and, for the hash, to limit how many requests can come from one place, which stops spam.

Lawful basis (UK GDPR): steps you've asked us to take before a possible contract (Article 6(1)(b)); for the hash, our legitimate interest in keeping the form free of abuse (Article 6(1)(f)).

Client accounts

What: your email address for sign-in; your business's brand details, read from your website when the account is set up; the facts, pages and answers you give us, including voice notes and photos sent to the Interview Engine on Telegram; the drafts and pages made from them, with their history; and a log of the AI usage on your account and what it cost.

Why: to do the work you've asked for, show it to you for approval, and bill AI usage fairly.

Lawful basis: our contract with you (Article 6(1)(b)).

Payments

What: your subscription status and billing history. Card details go straight to Stripe; we never see or hold them.

Why: to take payment and keep the records tax law requires.

Lawful basis: contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)).

Please don't send us sensitive personal details, such as health information or other people's details, unless the work needs them. A product page rarely does.

How long we keep it

Requests through the form: 12 months from your last contact with us, unless you become a client. Ask us and we'll delete it sooner.
Client accounts: while you're a client. After you leave, we delete your account and its work within 90 days, unless you ask us to hand it over first.
Billing records: as long as UK tax law requires.
Rate limiting: the counter that uses the IP hash is cleared within an hour.
Technical logs: our hosts keep short-lived request logs to find faults and spot abuse. They can include your IP address and browser details, and are deleted automatically.

Who processes it for us

Cloudflare (United States): this domain's DNS, and hosting this site.
Railway (United States company, running in its EU West region): hosting the app that receives form requests and runs client accounts.
Supabase (United States company, database in London): the database and email sign-in.
Resend (United States): sending email, including sign-in links and form requests to Alex.
Anthropic (Ireland and United States): the Claude AI model that writes drafts and pages from what you give us.
OpenAI (United States): turning voice notes into text.
fal.ai (United States): generating images for social posts.
Stripe (Ireland and United States): subscriptions and card payments.

If you use the Interview Engine, your answers travel through Telegram, under Telegram's own privacy policy.

Some of these companies, or their suppliers, are outside the UK, so your information may be processed there. Where that happens we rely on UK adequacy regulations (including the UK-US data bridge) or the UK Addendum to the EU Standard Contractual Clauses in the provider's data processing terms. Ask us at privacy@horizonauthority.io for the detail for any provider.

Cookies and local storage

This site sets no cookies and loads nothing from other sites: even the fonts are served from here.

When you sign in at app.horizonauthority.io, your browser keeps a sign-in token in local storage so you stay signed in. The account needs it to work, and signing out removes it.

Your rights

You have the right to:

ask for a copy of the information we hold about you;
ask us to correct it;
ask us to delete it;
object to, or ask us to restrict, how we use it;
ask for your information in a portable format.

Email privacy@horizonauthority.io to use any of these rights. We'll reply within one month.

Complaints

If you're unhappy with how we've handled your information, please tell us first at privacy@horizonauthority.io. You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint, or call 0303 123 1113.

Children

Horizon Authority is a service for businesses and isn't meant for anyone under 18.

Changes to this notice

If we change how we use your information, we'll update this page and its date. If the change is significant and you're a client, we'll tell you by email first.