Privacy Policy

1. Introduction

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use and share your personal data when you use:

• Our marketing websites and landing pages, and
• Our online platform and TeamOf8 Dashboard, including the TeamOf8 Dashboard / TeamOf8 workspace (together, the "Services").

It also explains your rights in relation to your personal data.

This policy is subject to copyright (ours or our licensor's) and may not be copied or used or adapted for use by anyone else without written permission from us.

If you need this policy in a different format (for example, larger print or accessible format), please contact us using the details below.

2. Who We Are and How to Contact Us

References in this policy to "we", "us" or "our" are to:

TeamOf8, a trading name of Hafa Investments Ltd.

Hafa Investments Ltd is a limited company registered in England and Wales with registered number 10146883, VAT number 239930578, with its registered office at:

65A London Rd,
Oadby, Leicester, LE2 5DN,
United Kingdom.

Hafa Investments Ltd is the data controller responsible for your personal data for the purposes described in this Privacy Policy when we operate under the TeamOf8 brand.

You can contact us for any data protection or privacy-related matters at:

• Email: hello@teamof8.ai
• Postal: Data Protection Manager, Hafa Investments Ltd, 65A London Rd, Oadby, Leicester, LE2 5DN, UK

3. When This Policy Applies

This Privacy Policy applies when you:

• Visit or interact with our marketing websites, landing pages or lead capture forms for TeamOf8, and/or
• Register for, log into or use our TeamOf8 Dashboard, TeamOf8 Dashboard, TeamOf8 workspace, or related tools and services.

This policy is aimed at:

• Prospective, current and former customers and users of TeamOf8,
• Subscribers to our newsletters or marketing content, and
• Visitors to our websites and online properties.

We may have separate or additional policies for employees, contractors, licensees or other categories of individuals. Where those apply and conflict with this policy, they take precedence for those individuals.

Our Services are not directed at children and are intended for individuals 18 years or older. We do not knowingly collect or maintain personal data relating to children. If you are under 18, please do not use our Services.

4. Data Protection Principles

We comply with applicable data protection law (including UK GDPR and, where applicable, EU GDPR and similar laws in other English-speaking countries). This means that your personal data must be:

• Used lawfully, fairly and in a transparent way
• Collected only for valid purposes that we have clearly explained to you
• Relevant to the purposes we have told you about and limited only to those purposes
• Accurate and kept up to date
• Kept only as long as necessary for the purposes we have told you about
• Kept securely.

5. How We Obtain Your Information

We may collect information directly from you when you:

• Fill in a form on our websites or landing pages (e.g. request a demo, book a call, download a resource, join a webinar)
• Subscribe to our newsletters, updates, or lead magnets
• Create an account or profile in the TeamOf8 Dashboard
• Configure your Content DNA (business details, messaging, keywords, audiences, etc.)
• Communicate with us (for example by email, chat, social media messages or comments, calls, online meetings, support tickets or within the app)
• Provide feedback, respond to surveys, or participate in beta tests
• Enter a promotion, challenge or event
• Pay for a subscription, product or service (payments processed via our third-party providers such as Stripe and GoCardless).

We may also receive information about you from:

• Third-party tools and integration partners: for example Zapier, analytics providers, email service providers, CRM tools or scheduling tools, when they connect with our platform.
• Payment service providers: including Stripe and GoCardless (and potentially PayPal), who process your payments and share limited information with us.
• CRM and marketing tools: for example Capsule CRM and Transpond, where contact details and engagement data may be synchronised.
• Publicly available sources: such as professional websites, Companies House, and social media, typically for business research, lead qualification or compliance checks.
• Referrals and partners: where someone else has suggested that we contact you and has shared your details with your permission.
• Security and anti-fraud providers: where necessary to protect our Services and your accounts.

6. What Information We May Collect and Process

The personal data we may collect and process about you includes:

Identity and contact information

• Name, title, business name
• Email address
• Phone number
• Country / region and time zone
• Job title or role, and other professional details you choose to provide.

Account and authentication data

• Account login details (email and password) for the TeamOf8 Dashboard, or SSO-related identifiers where applicable
• Security-related data (for example, logs of login attempts, IP addresses, device and browser information).

Business and Content DNA data

Information you provide about your business, such as:

• Business name and trading name(s)
• Website URL(s)
• Industry, location, markets you serve
• Offerings, services, and positioning
• Messaging preferences, brand voice, tone, language rules, and internal terminology
• Target audiences, buyer personas, and customer profiles
• Keywords, topics, content pillars, and performance metrics you choose to store
• Your Content DNA configuration, including the variables, preferences and rules that guide how content is generated for you.

User-generated content and usage data

All content you create, upload or store in the platform, such as:

• Content briefs, prompts and instructions
• Blog themes and outlines
• Drafts and finalised articles
• Social media posts, email copy, ad copy and other assets
• Notes, comments and feedback
• Log and usage data about how you interact with the platform.

Lead capture and marketing data

• Information you submit via our lead forms: Name, email, phone number, business name, role, company size, country
• Newsletter and campaign engagement data (e.g. opens, clicks, unsubscribes, preferences).

Billing and subscription data

• Subscription plan, renewal dates, status and billing history
• Information that our payment processors share with us such as transaction ID, last 4 digits of card, card type, and billing country.

We do not store or process full payment card details ourselves. These are handled by third-party payment providers such as Stripe and GoCardless under their own security and privacy policies.

Technical and analytics data

• IP address, approximate location (based on IP)
• Device and browser information (e.g. operating system, browser type and version)
• Information about how you use our websites and apps, including pages visited, links clicked, time spent, and referral sources.

We may also collect, use and share aggregated data, such as usage statistics and performance trends. Aggregated data does not directly identify you. If we ever combine aggregated data with personal data in a way that identifies you, we treat the combined data as personal data.

We do not routinely collect "special category" data (such as health, religious or political beliefs, etc.) and we do not design our Services for processing that kind of information.

7. On What Basis We Use Your Information

We use your personal data only where we have a lawful basis to do so. The main bases we rely on are:

• Performance of a contract: where we need to process your data to provide the Services you have requested, or to take steps at your request before entering into a contract.
• Legitimate interests: where it is necessary for our legitimate business interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Compliance with legal obligations: where we must process your data to comply with law or regulations.
• Consent: where you have given us specific consent for a particular purpose.

Where we rely on legitimate interests, we consider and balance any potential impact on you before we process your data. You can object to processing based on legitimate interests – see "Your Rights" below.

8. What We Use Your Information For

We may use your information for the following purposes:

a) Providing and managing your account and the Services

• Creating and managing your account on the TeamOf8 Dashboard
• Providing access to the TeamOf8 Dashboard / TeamOf8 workspace
• Generating, storing and organising your content, themes, briefs and assets
• Managing subscriptions, billing and payments
• Providing customer support and responding to your questions or issues.

Legal basis: performance of a contract; our legitimate interests in operating our business.

b) Operating the TeamOf8 system and AI-powered workflows

• Using your Content DNA and inputs to generate content using internal logic and integrated AI tools
• Orchestrating workflows that pass relevant data between our Services and third-party tools
• Improving and tuning our prompts, templates and content strategies based on aggregate usage and performance.

Legal basis: performance of a contract; our legitimate interests in providing and improving an AI-powered content platform.

c) Using third-party AI and automation tools

We use a range of third-party AI and automation services, which may include providers such as Claude, Google Gemini, OpenAI ChatGPT, Nano Banana Pro and others, as well as Zapier for workflow automation.

We aim to minimise the amount of personal data we send to these services and to focus primarily on business-related and content-related inputs. We also configure these tools, where options are available, in ways that are designed not to allow your data to be used to train publicly available models.

Legal basis: performance of a contract; our legitimate interests in operating an AI-enabled content platform.

d) Sales, marketing and relationship management

• Communicating with you about TeamOf8, including new features, content, events, training and offers
• Sending newsletters and educational resources where you sign up or where permitted by law
• Managing your marketing preferences and subscription status
• Using tools like Transpond, Capsule CRM and similar services to manage and deliver communications.

You can opt out of marketing communications at any time by using the unsubscribe link in our emails or by contacting us.

Legal basis: our legitimate interests in promoting and growing our business; your consent where required.

e) Improving our Services and analytics

• Monitoring and analysing how our websites, dashboard and workflows are used
• Troubleshooting and optimising performance and user experience
• Developing new features, templates and workflows
• Producing aggregated reports and insights.

Legal basis: our legitimate interests in developing and improving our products and services.

f) Security, fraud prevention and legal compliance

• Protecting our platform and infrastructure against misuse, unauthorised access and security incidents
• Detecting and investigating potentially fraudulent or unauthorised activity
• Complying with legal, regulatory, tax and accounting obligations
• Exercising or defending legal claims.

Legal basis: our legitimate interests in operating a secure and lawful business; compliance with legal obligations.

9. Sharing Your Information

We do not sell your personal data to third parties.

We may share your personal data with:

a) Service providers (processors)

We use carefully selected third-party service providers to help us run our business and deliver our Services. These service providers act as our processors and only use your data on our instructions and for the purposes we specify.

b) Group company and licensor

Because TeamOf8 is a trading name of Hafa Investments Ltd, your data may be accessed or processed by Hafa Investments personnel and systems where necessary for operating and supporting the platform, finance, billing, administration, security, compliance and risk management.

c) Business partners and referrals

Where you expressly agree, we may share your details with business partners, resellers or referral partners.

d) Legal and regulatory

We may disclose your personal data where required to comply with law or regulatory obligations, respond to lawful requests from public authorities, or exercise or defend legal claims.

e) Business transfers

If we are involved in a merger, acquisition, sale of assets or similar transaction, your personal data may be transferred as part of that deal, subject to appropriate confidentiality and data protection safeguards.

10. Third-Party Service Providers – Examples

Our choice of suppliers may change over time. As at the date of this policy, examples of third-party processors and services we may use include:

• Payment processing: Stripe, GoCardless, and PayPal
• CRM: Capsule CRM
• Email and marketing: Transpond
• Automation and workflows: Zapier, Make, n8n
• AI providers: Claude (Anthropic), Google Gemini (Google), OpenAI (ChatGPT), Nano Banana Pro and other AI models
• Analytics and tracking: tools such as Google Analytics or similar platforms
• Infrastructure and hosting: cloud hosting providers and related services.

Each of these has its own privacy policy, which we encourage you to review. Where relevant, you may be able to adjust your privacy preferences or opt out through those providers.

11. Cookies, Tracking and Third-Party Links

Our websites and apps may use cookies and similar technologies to:

• Help the site and dashboard function correctly
• Remember your preferences
• Analyse how our sites and Services are used
• Support marketing and advertising activities.

You can usually control cookies through your browser settings and, where implemented, via our cookie banner or preferences centre.

Our Services may also contain links to third-party websites, tools or apps. We do not control these third parties and are not responsible for their privacy practices. You should review their privacy policies before providing them with your personal data.

12. International Transfers

Hafa Investments Ltd is based in the UK, but our personnel, infrastructure and service providers may be located in other countries, including outside the UK and the European Economic Area (EEA).

Where we transfer personal data from the UK or EEA to a country that does not have equivalent data protection laws, we take steps to ensure that your data is given a similar level of protection. This may include:

• Using countries that the European Commission has decided provide an adequate level of protection; and/or
• Putting in place standard contractual clauses or other appropriate safeguards approved by relevant authorities.

You can contact us if you would like more information about international transfers relating to your data.

13. How We Keep Your Information Secure

We take appropriate technical and organisational measures to protect your personal data, including:

• Secure hosting, firewalls and access controls
• Encryption and pseudonymisation where appropriate
• Strong password and authentication practices
• Limiting access to personal data to those who need it for their role
• Policies and training for staff and contractors about data protection and information security
• Regular monitoring and review of our systems and controls.

Despite our efforts, no system can be completely secure. Transmission of information over the internet always carries some risk. We encourage you to keep your passwords secure, use unique credentials, and log out of your account when finished.

We have procedures in place to deal with suspected personal data breaches and will notify you and any applicable regulator of a breach where we are legally required to do so.

14. How Long We Keep Your Information

We keep your personal data only for as long as reasonably necessary to fulfil the purposes we collected it for, including:

• Providing and supporting your use of the Services
• Meeting legal, accounting, tax or reporting requirements
• Handling disputes or potential legal claims.

In general:

• Core account and billing records are typically retained for at least six years after your account or relationship ends, to comply with tax and accounting rules.
• Content and configuration stored in your TeamOf8 account may be retained while your account is active and for a reasonable period afterwards, unless you delete it or request deletion.
• We may retain certain non-identifiable or aggregated data indefinitely.

15. Your Rights

Depending on where you are located and subject to applicable law, you may have some or all of the following rights in relation to your personal data:

• Right to be informed – to be told how we use your data (this policy is intended to do that).
• Right of access – to request a copy of the personal data we hold about you.
• Right to rectification – to request correction of inaccurate or incomplete data we hold about you.
• Right to erasure ("right to be forgotten") – in certain circumstances, to request that we delete your personal data.
• Right to restrict processing – in certain circumstances, to ask us to suspend the processing of your data.
• Right to object – to object to certain types of processing, including where we rely on legitimate interests or for direct marketing.
• Right to data portability – in certain cases, to request that we transfer your data to you or to another provider in a structured, commonly used, machine-readable format.
• Right to withdraw consent – where we rely on consent, you can withdraw it at any time. This will not affect the lawfulness of processing before withdrawal.
• Right to complain – to a data protection authority if you are unhappy with how we handle your data.

For UK users, the relevant supervisory authority is the Information Commissioner's Office (ICO) (www.ico.org.uk). If you are in the EU or another jurisdiction, you may have the right to complain to your local data protection authority.

We would appreciate the chance to deal with your concerns before you approach a regulator, so please contact us first if you can.

16. How to Exercise Your Rights

To exercise any of your rights, or to make a complaint or request regarding your personal data, please contact us at:

Email: hello@teamof8.ai

To help us respond efficiently, please:

• Clearly state that your request relates to data protection or privacy, and
• Specify which rights or issues you are concerned about, and
• Provide enough information for us to verify your identity.

We aim to respond to all valid requests within one month. Sometimes it may take longer if your request is complex or if you have made multiple requests. If so, we will let you know and keep you updated.

Please note that if you ask us to restrict or delete certain data, this may impact our ability to provide some or all of the Services to you.

You can opt out of our marketing emails at any time by clicking the "unsubscribe" link in any marketing email, or contacting us at the email address above.

17. Our Role as a Data Controller and Processor

In most cases, we act as a data controller in relation to the personal data described in this policy – particularly where we determine the purposes and means of processing.

In some cases, we may act as a data processor on behalf of another controller (for example, where our Services are provided under a different brand or as part of a wider solution managed by a partner or licensee). Where we act as a processor, we:

• Process personal data only on the documented instructions of the controller
• Have written contracts or equivalent terms in place that meet applicable legal requirements
• Ensure that our personnel are subject to appropriate confidentiality obligations
• Implement appropriate technical and organisational security measures
• Assist the controller with their obligations regarding data subject rights and data breaches
• Use sub-processors only with appropriate safeguards and, where required, the controller's approval.

If you are unsure whether we are acting as a controller or processor in your specific situation, you can contact us for clarification.

18. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website and/or within the TeamOf8 platform, with the version date shown at the top.

If we make material changes that significantly affect how we process your personal data, we will take reasonable steps to inform you, for example by posting a prominent notice on our website or in the dashboard, and/or sending you an email or in-app notification.

It is important that the personal data we hold about you is accurate and up to date. Please let us know if your details change during your relationship with us.