Privacy notice

TheCold.Ai is a business-to-business outbound marketing agency based in England, operating across the UK and internationally. We are the data controller for the personal data described in this notice.

We are not yet incorporated. TheCold.Ai is a trading name of Araf Perwaze and Fouad Eltibrizi, who are jointly responsible as controllers. When the company is formed, this notice will be updated to name it.

For anything in this notice — including any request below — contact us at sales@thecold.ai. We aim to reply within one working day, and stop requests are actioned the same day.

We contact people in their professional capacity about services we think are relevant to the organisation they work for. We did not get your details from you. We are required to tell you where they came from and what we hold, which is the purpose of this section.

What we hold about you:

• Your name and job title
• Your business email address
• The organisation you work for, and public information about it — sector, approximate size, location, website, and publicly reported facts we may reference in an email
• A record of what we sent you and how you responded, including any request to stop

Where it came from: business contact data providers — principally Apollo.io — together with publicly available sources such as company websites, Companies House and public business directories. We do not buy consumer data, and we do not use personal social media profiles.

Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)). Our interest is in offering business services to organisations likely to want them; we have considered your interests and rights and take the view that a small volume of relevant, professional, easily-stopped email to a work address does not override them. You can object at any time, and we will stop — see below. Where the recipient is a sole trader or an unincorporated partnership, different rules apply under PECR and we do not send without consent.

We use AI tools to help research organisations and draft the opening line of our emails. A person reviews every message before it is sent. No decision that affects you is made solely by automated means.

Reply to any email from us with the word "stop". That is the fastest route and it is actioned the same day — you do not need to explain yourself or find an unsubscribe link.

You can also email sales@thecold.ai. If you tell us to stop, we will not remove you from our records entirely — we keep the minimum needed (your email address on a suppression list) precisely so that we cannot contact you again by accident. That is a compliance obligation, not a loophole.

You have the right to ask us for a copy of the personal data we hold about you, to have it corrected or erased, to restrict or object to how we use it, and to receive it in a portable format where that applies. You have an absolute right to object to direct marketing, which we honour without question.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you told us first so we can put it right.

• Prospect records: reviewed at 12 months. Anything no longer relevant is deleted.
• Suppression list (people who asked us to stop): kept indefinitely, because deleting it would mean we could contact you again by mistake. It holds the minimum needed to recognise you — normally just an email address.
• Correspondence: kept for as long as needed for the conversation it belongs to, and then for as long as we may need it to deal with a dispute.
• Campaign records, when a client engagement ends: the replies and conversation history for that campaign are handed to the client, along with a copy of the prospect records used in it, and they are controller of their copy from that point. We keep our own contact database — it is built across all our work, not for any one client. The sending domains and mailboxes we used stay with us. Anyone who asked us to stop is excluded from what transfers, because a suppression record is not something we hand on.
• Anything a client gave us about their own customers or contacts: returned or deleted when the relationship ends, per the contract with that client.

We do not sell personal data, and we do not share it with anyone for their own marketing. We use the following service providers, who process data on our instructions:

• Apollo.io — business contact data sourcing
• An email-sending platform, US-based, under standard contractual clauses — sending and managing our email campaigns
• Google Workspace — the mailboxes we send from
• Zapmail — setting up and managing those mailboxes and the domains they send from
• Anthropic — AI assistance with research and drafting
• Calendly — booking calls, if you choose to book one
• Supabase — the database that holds what you send us through a form
• Cloudflare — serving this website from a location near you, blocking abusive traffic, counting page views without cookies, and the anti-spam check on our forms
• Our web host — storing the files behind this website

Our clients are the other recipients, and it is worth being plain about this. We run campaigns for client businesses. If you reply with interest, your details and your reply go to that client so they can follow up — that is the purpose of the message you received. If our work for a client comes to an end, the campaign records for that client are handed to them and they become the controller of that data from that point, under their own privacy notice. If you have asked us to stop, you are excluded from both: we do not pass on the details of someone who opted out.

Some of these are based in the United States. Where personal data is transferred outside the UK, we rely on the transfer mechanisms recognised under UK law — the UK International Data Transfer Agreement, or the UK Extension to the EU–US Data Privacy Framework where the provider is certified.

We may also disclose data where we are legally required to, or to establish or defend legal claims.

This site is deliberately quiet. It sets no cookies of its own, runs no advertising pixels and no tag manager. The one measurement we take is Cloudflare Web Analytics, which counts page views and load times without cookies or any identifier that follows you between visits. We cannot tell who you are or that you have been here before. It stores nothing else in your browser, with one exception: if you fill in the form on the Claude skills pages, your browser holds a one-day key that lets the download buttons work while you look around. It is cleared when you close the tab, and it goes nowhere.

One exception, and only if you choose it: the booking widget is provided by Calendly and is not loaded at all until you click a "book a call" button. At that point Calendly's script loads and Calendly may set its own cookies, under its own privacy policy. If you never click, it never loads.

The site is delivered through Cloudflare, which sits in front of our web host to serve pages from a location near you and to block abusive traffic. Cloudflare and our web host both keep standard connection logs, including IP addresses, for security and to keep the site running. If you email us or book a call, we keep what you send us so we can reply.

Some pages offer a free download. If you ask for one, we store the email address you give us, which page you asked from, and any campaign tags in the link you arrived on. That is so we can send you the thing you asked for and know which page it came from.

The Claude skills pages ask for a phone number as well as an email address, and those files are only released once you have given both. We store the number so we can ring you to ask how you are getting on with them. If you would rather we did not, say so on the call or in reply to any email and we will not ring again. You can also ask us to delete the number and keep the rest.

You get what you asked for whether or not you tick the box about our occasional emails. Ticking it is a separate choice, and we record the exact wording you were shown when you made it. To be plain about what that box does today: it records your permission. This site sends no automatic email of any kind, so nothing arrives until we have something worth writing, and you can withdraw the permission before we ever use it.

Our lawful basis for sending the download, and for releasing the skill files once you have given us your details, is performing what you asked for. Our basis for ringing the number you gave us is our legitimate interest in knowing how the skills are used, which you can object to at any time and we will stop. For the occasional emails it is your consent, which you can withdraw at any time using the unsubscribe link in every email or by replying to us. We act on that immediately.

To limit abuse, the server briefly stores a one-way hash of your IP address, never the address itself, and counts submissions against it. Where the Cloudflare Turnstile check is switched on, it also checks that a person rather than a script is submitting the form.

We keep what you send us for 24 months from the last time you contacted us or we contacted you, and then delete it. You do not have to wait for that: ask us and we will delete it sooner.

We will update this page when what we do changes — in particular when the company is incorporated, or if we add a service provider. The date at the top always reflects the current version.