Privacy notice

TheCold.Ai is a business-to-business outbound marketing agency based in Middlesbrough, operating across the UK and internationally. We are the data controller for the personal data described in this notice.

We are not yet incorporated. TheCold.Ai is a trading name of Araf Perwaze and Fouad Eltibrizi, who are jointly responsible as controllers. When the company is formed, this notice will be updated to name it.

For anything in this notice — including any request below — contact us at sales@thecold.ai. We aim to reply within one working day, and stop requests are actioned the same day.

We contact people in their professional capacity about services we think are relevant to the organisation they work for. We did not get your details from you. We are required to tell you where they came from and what we hold, which is the purpose of this section.

What we hold about you:

• Your name and job title
• Your business email address
• The organisation you work for, and public information about it — sector, approximate size, location, website, and publicly reported facts we may reference in an email
• A record of what we sent you and how you responded, including any request to stop

Where it came from: business contact data providers — principally Apollo.io — together with publicly available sources such as company websites, Companies House and public business directories. We do not buy consumer data, and we do not use personal social media profiles.

Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)). Our interest is in offering business services to organisations likely to want them; we have considered your interests and rights and take the view that a small volume of relevant, professional, easily-stopped email to a work address does not override them. You can object at any time, and we will stop — see below. Where the recipient is a sole trader or an unincorporated partnership, different rules apply under PECR and we do not send without consent.

We use AI tools to help research organisations and draft the opening line of our emails. A person reviews every message before it is sent. No decision that affects you is made solely by automated means.

Reply to any email from us with the word "stop". That is the fastest route and it is actioned the same day — you do not need to explain yourself or find an unsubscribe link.

You can also email sales@thecold.ai. If you tell us to stop, we will not remove you from our records entirely — we keep the minimum needed (your email address on a suppression list) precisely so that we cannot contact you again by accident. That is a compliance obligation, not a loophole.

You have the right to ask us for a copy of the personal data we hold about you, to have it corrected or erased, to restrict or object to how we use it, and to receive it in a portable format where that applies. You have an absolute right to object to direct marketing, which we honour without question.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you told us first so we can put it right.

• Prospect records: reviewed at 12 months. Anything no longer relevant is deleted.
• Suppression list (people who asked us to stop): kept indefinitely, because deleting it would mean we could contact you again by mistake. It holds the minimum needed to recognise you — normally just an email address.
• Correspondence: kept for as long as needed for the conversation it belongs to, and then for as long as we may need it to deal with a dispute.
• Campaign records, when a client engagement ends: the replies and conversation history for that campaign are handed to the client, along with a copy of the prospect records used in it, and they are controller of their copy from that point. We keep our own contact database — it is built across all our work, not for any one client. The sending domains and mailboxes we used stay with us. Anyone who asked us to stop is excluded from what transfers, because a suppression record is not something we hand on.
• Anything a client gave us about their own customers or contacts: returned or deleted when the relationship ends, per the contract with that client.

We do not sell personal data, and we do not share it with anyone for their own marketing. We use the following service providers, who process data on our instructions:

• Apollo.io — business contact data sourcing
• Smartlead — sending and managing our email campaigns
• Google Workspace — the mailboxes we send from
• Anthropic — AI assistance with research and drafting
• Calendly — booking calls, if you choose to book one
• Brevo — sending downloads and our occasional emails, if you ask for them
• Cloudflare — the anti-spam check on our forms
• Our web host — serving this website

Our clients are the other recipients, and it is worth being plain about this. We run campaigns for client businesses. If you reply with interest, your details and your reply go to that client so they can follow up — that is the purpose of the message you received. If our work for a client comes to an end, the campaign records for that client are handed to them and they become the controller of that data from that point, under their own privacy notice. If you have asked us to stop, you are excluded from both: we do not pass on the details of someone who opted out.

Some of these are based in the United States. Where personal data is transferred outside the UK, we rely on the transfer mechanisms recognised under UK law — the UK International Data Transfer Agreement, or the UK Extension to the EU–US Data Privacy Framework where the provider is certified.

We may also disclose data where we are legally required to, or to establish or defend legal claims.

This site is deliberately quiet. It sets no cookies of its own, runs no analytics, no advertising pixels and no tag manager, and stores nothing in your browser. We cannot tell who you are or that you have been here before.

One exception, and only if you choose it: the booking widget is provided by Calendly and is not loaded at all until you click a "book a call" button. At that point Calendly's script loads and Calendly may set its own cookies, under its own privacy policy. If you never click, it never loads.

Our web host keeps standard server logs, including IP addresses, for security and to keep the site running. If you email us or book a call, we keep what you send us so we can reply.

Some pages offer a free download. If you ask for one, we store the email address you give us, which page you asked from, and any campaign tags in the link you arrived on. That is so we can send you the thing you asked for and know which page it came from.

The download is sent whether or not you tick the box asking for our occasional emails. Ticking the box is a separate choice, and we record the exact wording you were shown when you made it. If you do tick it, you get a confirmation email first and nothing else is sent until you click the link in it.

Our lawful basis for sending the download is performing what you asked for. For the occasional emails it is your consent, which you can withdraw at any time using the unsubscribe link in every email or by replying to us. We act on that immediately.

The form is protected by Cloudflare Turnstile, which checks that a person rather than a script is submitting it. To limit abuse, the server briefly stores a one-way hash of your IP address, never the address itself.

If you never confirm, we delete the record within 30 days. If you confirm and then never open anything for 24 months, we delete you from the list.

We will update this page when what we do changes — in particular when the company is incorporated, or if we add a service provider. The date at the top always reflects the current version.