Privacy policy

Herd UK Ltd (“Herd”, “we”, “us”, or “our”) is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains in detail how we collect, use, disclose, and safeguard your information when you use our platform at herduk.co.uk and any related mobile applications or services (collectively, “the Service”).

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). Herd UK Ltd, registered in England and Wales, is the data controller for the personal data described in this policy.

By using our Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our Service.

Herd UK Ltd is the data controller responsible for your personal information. Our details are:

3.1 Information You Provide Directly

Account Registration:

• Full name
• Email address
• Password (stored in encrypted form)
• Phone number (optional, for 2FA)
• Account type (Creator, Agency, or Brand)

Profile Information:

• Display name and bio
• Profile picture
• Location and timezone
• Professional information (niche, industry)
• Website and portfolio links

Financial Information:

• Payment card details (processed securely via Stripe - we do not store full card numbers)
• Bank account details for receiving payments (encrypted at rest)
• Billing address
• VAT number (for business accounts)
• Tax identification information where required by law

Content You Create:

• Posts, drafts, and scheduled content
• Messages and communications
• Invoices and contracts
• Notes and comments
• Uploaded files and media

3.2 Information from Social Media Platforms

The platforms you can connect are Instagram, Facebook, TikTok and X. When you connect one of these accounts, we access information through its official API in accordance with that platform’s terms. We may collect:

TikTok:

• Public profile (username, display name, avatar, bio)
• Follower and following counts
• Video content and performance metrics (views, likes, comments, shares)
• Account analytics and audience demographics

Instagram:

• Business or Creator account profile information
• Follower counts and growth data
• Media content and engagement metrics
• Stories insights and reach data
• Audience demographics (age, gender, location)

X (Twitter):

• Profile information
• Follower and following counts
• Tweet content and engagement metrics
• Direct messages (only with explicit consent)

Facebook:

• Page information (for Page connections)
• Post content and engagement
• Page insights and audience data

3.3 Automatically Collected Information

Device & Technical Information:

• IP address
• Browser type and version
• Operating system
• Device type and identifiers
• Screen resolution
• Language preferences

Usage Information:

• Pages and features visited
• Time spent on pages
• Click patterns and navigation paths
• Search queries within the Service
• Error logs and performance data
• Referring and exit pages

Location Information:

• Approximate location derived from IP address
• Timezone settings
• Precise location only if explicitly permitted by you

4.1 Service Provision

• Creating and managing your account
• Providing dashboard features and analytics
• Processing content scheduling and publishing
• Facilitating brand partnerships and deals
• Processing payments and managing subscriptions
• Generating invoices and financial reports

4.2 Communication

• Sending transactional emails (receipts, confirmations, alerts)
• Providing customer support
• Notifying you of important account or service changes
• Sending marketing communications (with your consent)

4.3 Improvement & Development

• Analysing usage patterns to improve features
• Conducting research and analytics
• Testing new features and functionality
• Personalising your experience

4.4 Safety & Security

• Detecting and preventing fraud
• Protecting against unauthorised access
• Enforcing our Terms of Service
• Complying with legal obligations

We process your personal data based on the following legal grounds:

Where we rely on legitimate interests, we have conducted a balancing test to ensure our interests do not override your fundamental rights and freedoms.

6.1 With Your Consent

• Brands/Partners: When you apply for or accept partnerships, relevant profile information is shared
• Public Profile: If you choose to publish your profile page, what you put on it is published at herduk.co.uk/yourname and can be seen by anyone with the address. It is unpublished by default, and while it is unpublished the address returns a “not found” response.
• Creator Search: If you choose to mark your creator profile as discoverable, signed-in brand and agency accounts can find it in the creator search inside Herd. This is a separate setting from your profile page, it is off until you turn it on, and your rate card stays hidden unless you separately choose to show it. There is no public creator directory.
• Agencies: If you connect with an agency, they may access your performance data

6.2 Service Providers

We share information with third-party providers who help us operate the Service. These providers are bound by data processing agreements and can only use your data for specified purposes:

• Supabase: Our database, sign-in and authentication, and file storage
• Stripe: Subscription billing, payments between members, and payouts through Stripe Connect
• Google Drive: Storage, only if you connect your own Google account. Your files stay in your own Drive; we read and write only the files the connection covers.
• Wasabi: Storage for files you upload, if you buy the paid storage add-on
• Aurinko: Connecting your own Gmail or Outlook mailbox and calendar, so you can read, send and schedule from inside Herd
• LiveKit: Video meetings. We run our own LiveKit server, so meeting audio and video pass through our infrastructure rather than a third-party meetings service.
• Bunny.net: Hosting and delivery of videos rendered in the video editor
• Resend: Sending transactional email
• Twilio: Sending SMS codes for two-factor authentication
• Creator data provider: A third-party provider of public creator profile data (such as handles, follower counts and publicly listed business contact details), used in agency creator discovery
• OpenAI: Text generation in the content tools and, where a meeting has been recorded and transcribed, summarising the transcript into notes and action items. Only the text needed for the request is sent.
• Our hosting provider: Running the Herd application servers

6.3 Legal Requirements

We may disclose your information if required to:

• Comply with applicable law, regulation, or legal process
• Respond to lawful requests from public authorities
• Protect our rights, privacy, safety, or property
• Enforce our Terms of Service
• Protect against legal liability

6.4 What We Do NOT Do

• We do not sell your personal information to third parties
• We do not share your data for third-party advertising purposes
• We do not provide your data to data brokers

Our Service integrates with various third-party platforms. When you connect these services, their privacy policies apply to their handling of your data:

We use cookies and similar technologies to enhance your experience. For detailed information, please see our Cookie Policy.

8.1 Types of Cookies We Use

Essential Cookies:

• Keeping you signed in and refreshing your session
• Keeping an admin console session separate from an ordinary one
• Short-lived anti-forgery cookies that make a social, storage or mailbox connection safe to complete

Analytics and Advertising Cookies:

We do not set any. There is no analytics or advertising script on our website or in the product. If that changes, we will update the Cookie Policy and ask for your consent before setting them.

8.2 Managing Cookies

You can manage cookies through your browser settings and relevant provider opt-out tools. We do not currently provide a persistent in-product cookie preference centre in the footer. If we roll out non-essential cookie controls in-product, we will request consent before enabling them.

We implement comprehensive technical and organisational measures to protect your data:

9.1 Technical Measures

• TLS encryption for all traffic to and from the Service, with HTTP Strict Transport Security set on every response
• Bank account details and uploaded expense receipts encrypted before they are stored, and the access tokens for your connected accounts encrypted the same way
• Two-factor authentication using an authenticator app, an SMS code or a passkey
• Passwords stored only as salted hashes by our authentication provider; we never see or store your password
• Row-level access control in the database, so a request can only read the rows that belong to the account making it
• Security headers on every response, including a content security policy, frame and content-type protections, and a restrictive referrer policy
• Signed, expiring links for private media rather than public file URLs
• Rate limiting on sign-in and other sensitive endpoints, and an audit log of administrative actions

We do not hold a security certification such as ISO 27001 or SOC 2, and we do not claim one.

9.2 Organisational Measures

• Staff security training and awareness programmes
• Access to personal data limited to the staff who need it for their role
• Confidentiality agreements with all staff
• Regular security policy reviews
• Incident response procedures

9.3 Your Responsibilities

You can help protect your account by:

• Using a strong, unique password
• Enabling two-factor authentication
• Not sharing your login credentials
• Logging out on shared devices
• Reporting suspicious activity immediately

We retain your data only as long as necessary for the purposes outlined in this policy:

As a data subject, you have the following rights regarding your personal data:

11.1 Right of Access

You can request a copy of all personal data we hold about you. We will provide this within one month of your request in a commonly used electronic format.

11.2 Right to Rectification

You can request correction of any inaccurate or incomplete personal data. You can also update most information directly in your account settings.

11.3 Right to Erasure (“Right to be Forgotten”)

You can request deletion of your personal data when:

• The data is no longer necessary for its original purpose
• You withdraw consent (where processing is based on consent)
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed

11.4 Right to Restriction of Processing

You can request that we limit how we use your data in certain circumstances.

11.5 Right to Data Portability

You can request your data in a structured, machine-readable format (JSON or CSV) to transfer to another service provider.

11.6 Right to Object

You can object to processing based on legitimate interests, including profiling. You can also object to direct marketing at any time.

11.7 How to Exercise Your Rights

To exercise any of these rights, please contact us at privacy@herduk.co.uk. We will respond within one month. If your request is complex, we may extend this by two months, but we will inform you of any delay.

Some of our service providers may process data outside the UK. When this occurs, we ensure appropriate safeguards are in place:

• Adequacy Decisions: Transfers to countries deemed adequate by the UK Government
• Standard Contractual Clauses (SCCs): UK-approved SCCs with each provider
• Supplementary Measures: Additional technical and organisational measures where needed

You can request information about the specific safeguards we use by contacting privacy@herduk.co.uk.

13.1 How We Use Automated Processing

We use automated processing for:

• Performance Figures: Calculating follower, reach and engagement figures from the accounts you have connected
• Search Ranking: Ordering creator search results for brands and agencies against the filters they set. The ranking follows fixed rules we have written; it is not machine learning and it does not decide anything on your behalf.
• Payment Fraud Checks: Stripe runs its own fraud checks on card payments, under its own terms
• Text Generation: Where you ask for it, the content tools and meeting summaries send text to OpenAI and return a suggestion for you to accept, edit or discard

We do not profile you for advertising, we do not score you for creditworthiness, and we do not use automated processing to decide whether to suspend or terminate an account.

13.2 Your Rights

We do not make fully automated decisions that produce legal or similarly significant effects without human review. If you believe an automated decision has significantly affected you, you can request human review by contacting us.

The Service is not intended for users under 18 years of age. We do not knowingly collect personal information from children under 18.

If we become aware that we have collected data from a child under 18 without parental consent, we will take steps to delete that information promptly. If you believe we may have collected information from a child, please contact us at privacy@herduk.co.uk.

15.1 Types of Marketing

With your consent, we may send you:

• Product updates and new features
• Tips and best practices
• Industry news and trends
• Partnership opportunities
• Promotional offers

15.2 Managing Preferences

You can manage your marketing preferences by:

• Clicking “Unsubscribe” in any marketing email
• Updating preferences in Settings → Notifications
• Contacting us at privacy@herduk.co.uk

Note: You will still receive essential transactional communications even if you opt out of marketing.

In the event of a personal data breach that poses a risk to your rights and freedoms:

• We will notify the ICO within 72 hours of becoming aware of the breach
• If the breach is likely to result in high risk to you, we will notify you without undue delay
• Our notification will describe the nature of the breach, likely consequences, and measures taken
• We will provide recommendations for steps you can take to protect yourself

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons.

• We will notify you of material changes by email or prominent notice on the Service
• Minor changes will be reflected in the “Last updated” date
• Continued use of the Service after changes constitutes acceptance
• We encourage you to review this policy periodically

If you have questions about this Privacy Policy, wish to exercise your rights, or have a complaint about how we handle your data, please contact us:

Supervisory Authority

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO):