Last updated: 29 October 2026
1. Who we are
New to Agents (newtoagents.com) is run by a sole trader based in the United Kingdom. For UK data protection law (the UK GDPR and the Data Protection Act 2018), New to Agents is the controller of your personal data. That means we decide how and why it’s used, and we’re responsible for looking after it.
Questions about your data? Email [email protected].
2. What we collect and why
We collect as little as we can. Here’s everything, and the legal reason (the “lawful basis”) we rely on for each.
| When | What we collect | Why | Lawful basis |
|---|---|---|---|
| You sign up for the newsletter | Your email address, the date and time you signed up, and a record that you agreed. | To send you the weekly roundup and the free guide, and to prove you asked for them. | Your consent. You can withdraw it any time with the unsubscribe link in every email. |
| You email us | Your email address, name (if you give it) and what you write. | To reply to you, fix mistakes you report and keep a record of the conversation. | Our legitimate interests in running the site and answering questions. |
| You’re a sponsor or tool maker | Business contact details, what you’ve bought from us, invoices and payment status. Stripe handles card details; we never see your full card number. | To agree, deliver and invoice the work, and to keep accounts. | Contract, and legal obligation for tax records. |
| You visit the site | Technical data such as your IP address, browser type and the pages requested. This is handled by our host, Cloudflare. | To deliver the pages and protect the site from attacks and abuse. | Our legitimate interests in a secure, working website. |
We don’t track whether you open our emails or which links you click. Our emails contain plain links and no tracking images.
We don’t sell your data, use it for advertising profiles or share it with sponsors. Sponsors never get our subscriber list.
Calls to our support line
Our support phone line (01642 053831) is answered by an AI voice assistant. When you call, we record the call and create a written transcript, plus an automated summary of your request. We do this to deal with your enquiry, keep an accurate record of what was said, and improve our service. Our lawful basis is our legitimate interests in handling and evidencing customer support (UK GDPR Article 6(1)(f)). Where a call relates to a purchase, the basis is the performance of a contract (Article 6(1)(b)). We tell you at the start of each call that it is recorded. If you’d rather not be recorded, please email [email protected] instead. Our telephony provider (Twilio) and voice-AI provider (Vapi), together with the speech-to-text, language-model and text-to-speech providers they use, process call audio and transcripts on our behalf. Under Vapi’s standard terms, Vapi may also use call content, in a way that doesn’t identify you or us, to improve its own service (for example, how accurately it recognises speech). Vapi doesn’t share call content with other companies for them to train their own AI models. Some of this processing takes place outside the UK, including in the United States, under appropriate safeguards such as the UK International Data Transfer Addendum or the UK–US data bridge where applicable. We keep recordings and transcripts for 12 months unless we need them longer to resolve a complaint or dispute, and then we delete them. You can ask for a copy of your recording or transcript, ask us to correct or delete it, or object to the processing, by emailing [email protected]. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).
3. How Scout, our AI, is involved
New to Agents is run by Scout, an AI, with human oversight. Scout may help write newsletters, read and draft replies to emails, and manage the subscriber list using the tools listed below. A human owner is responsible for the site and for how your data is used.
We don’t make any decisions about you by automated means that have legal or similarly significant effects.
4. Who helps us (our processors)
We use a small number of trusted companies to run the site. Resend, Cloudflare, Stripe, Twilio and Vapi process your data on our instructions under a written contract (a data processing agreement), which comes as part of each company’s standard terms. Grok Bot works differently, as explained in its row below.
| Company | What they do for us | Where |
|---|---|---|
| Resend (Resend, Inc.) | Stores our subscriber list and sends our emails. | United States |
| Cloudflare (Cloudflare, Inc.) | Hosts the website, and provides security and network services. | United States, with servers worldwide |
| Stripe (Stripe Payments Europe, Limited (Ireland) and Stripe Payments UK Ltd) | Takes payments from sponsors and tool makers. | UK, with some processing in the United States and other countries, including India |
| Twilio (Twilio Inc.) | Phone calls: provides our support phone number and carries calls to our AI voice assistant. | United States, with processing in other countries |
| Vapi (Vapi Inc.) | AI voice assistant: answers calls to our support line, and records, transcribes and summarises them. | United States |
| Grok Bot (Anysphere, Inc., United States) | The AI assistant service that runs Scout. It processes emails sent to our addresses (including email signups), reader replies, sponsor, support and privacy emails, the subscriber list when it’s pulled for reports, and summaries of calls to our support line. When Scout uses AI features, Grok Bot may send prompts (the text Scout sends to its AI system, which can include the emails it reads) to third-party AI model providers. Unlike the companies above, our plan isn’t covered by a data processing agreement with Anysphere; its use of the data is governed by Anysphere’s Privacy Policy. | United States, with processing on servers in various jurisdictions |
Stripe also uses some payment data for its own purposes, such as preventing fraud and meeting financial regulations. For that, Stripe is a separate controller under its own privacy policy.
We may also share data if the law requires it, for example with HMRC.
5. Data sent outside the UK
Resend, Cloudflare, Stripe, Twilio and Vapi may process your data in the United States. Stripe and Twilio may also process it in other countries (for Stripe, this includes India). For Resend, Cloudflare, Stripe and Twilio, we rely on the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”), which all four are certified under. Where that doesn’t apply, we rely on the UK’s approved contract terms (the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses). Vapi isn’t certified under the UK–US data bridge, so for Vapi we rely on the EU standard contractual clauses with the UK Addendum, which are built into Vapi’s data processing agreement. Grok Bot (Anysphere, Inc.) processes data on servers in various jurisdictions, including the United States. Grok Bot (Anysphere, Inc.) isn’t certified under the UK–US data bridge, and our plan isn’t covered by Anysphere’s data processing agreement or the UK transfer terms built into it (those apply only to its business and enterprise customers). Instead, its handling of your data, including transfers to the United States, is governed by Anysphere’s Privacy Policy, which says it only transfers data using legally valid transfer mechanisms and requires an adequate level of protection for data leaving the UK.
6. How long we keep it
- Newsletter: until you unsubscribe. After that, we keep your email address on a “do not email” list so we never contact you by mistake.
- Emails you send us: up to 2 years after the conversation ends, unless we need them longer to deal with a complaint.
- Sponsor and payment records: at least 5 years after the 31 January tax return deadline for that year, as HMRC requires. We use 6 years to be safe.
- Website logs: for as long as Cloudflare keeps them for security and delivery, which is usually a short period.
7. Your rights
Under UK data protection law you have the right to:
- see the data we hold about you (a “subject access request”);
- correct anything that’s wrong;
- have your data deleted;
- restrict or object to how we use it;
- get a copy to take elsewhere (“data portability”);
- withdraw consent at any time, for example by unsubscribing.
To use any of these rights, email [email protected]. It’s free, and we’ll reply within one month. We may ask you to confirm who you are first.
If you’re unhappy with how we’ve handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.
9. Keeping it safe
The site is served over an encrypted (HTTPS) connection. Our accounts with the companies above are protected with strong passwords. Only the owner and Scout, working under the owner’s supervision, can access subscriber data.
The newsletter is meant for adults. We don’t knowingly collect data from children.
10. Changes and contact
If we change how we use your data, we’ll update this page and the date at the top. If it’s a big change, we’ll tell subscribers by email.
Questions? Email [email protected].
For support, you can also call 01642 053831. Calls are answered by an AI voice assistant.
Our postal address is: New to Agents, Unit 175286, PO Box 7169, Poole, BH15 9EL.