Privacy
This is the privacy policy for cmintel.ai (the website) and the COLOSSEUM content intelligence and publishing platform operated by Colosseum Market Intelligence Ltd. We refer to ourselves as “we”, “us”, and “our” below.
It is a normal privacy policy. It describes the data we collect, what we do with it, and how to make us stop. It does not editorialize about the operational state of the service. The rules below apply to anyone who engages — visitors, operators, prospective customers, and customers when subscription billing is enabled.
If you want to know who is responsible for this document and the data behind it: that is Colosseum Market Intelligence Ltd (UK), and the named contact is the Data Protection Officer at dpo@cmintel.ai.
1. Last updated
2026-10-20. Material changes are described in section 12 (Changes), and the change log is at the bottom of this page.
2. Controller
Colosseum Market Intelligence Ltd — registered in England and Wales. Companies House registration number, VAT number (if applicable), and the registered office address are listed in the footer of every page on this site and at /about. The Data Protection Officer (DPO) is reachable at dpo@cmintel.ai.
We are the controller of personal data covered by this policy. When we process customer data on behalf of a subscribed business, we may be the processor; the controller-vs-processor split is governed by the Data Processing Addendum (DPA) at /dpa.
3. Data we collect
We collect five categories of personal data.
| Category | What it is | When |
|---|---|---|
| Account data | Operator name, work email, employer (where given) | When you create an operator account in the dashboard |
| Platform-fetched public data | Public data the platforms (Meta, TikTok, YouTube, X, Pinterest, Snap, LinkedIn at Phase 6.5+) expose under operator-granted scopes — engagement counts, timestamps, public post bodies | When an operator connects a platform integration with explicit consent |
| Usage data | Timestamps and identifiers of operator actions inside our dashboard (which agents ran, which decisions were taken, which approvals were issued) | While you use the operator dashboard |
| Device and browser data | IP address (truncated for analytics), user-agent string, referrer | On every request to cmintel.ai or the operator dashboard |
| Cookies and storage | Session and consent state — see /cookies for the full list | As described in the cookie list |
We do not collect: payment-card data (Stripe holds that when subscriptions are enabled — see section 5), passwords (we use SSO + passwordless auth where supported), facial-recognition data, or any data from a user under 16 (see section 9).
4. Why we collect it
Each category is collected on a specific lawful basis under UK GDPR Article 6.
| Category | Purpose | Lawful basis |
|---|---|---|
| Account data | Authentication, authorisation, sending operational emails | Performance of contract — Art 6(1)(b) |
| Platform-fetched public data | Producing the operator’s content insights, the Feedback agent’s learning loop, and training COLOSSEUM’s central brain for every customer (section 4.2) | Legitimate interests — Art 6(1)(f); balanced against the data subject’s rights, see section 4.1 below |
| Usage data | Audit-log integrity, billing, system-incident response | Performance of contract — Art 6(1)(b); legitimate interests — Art 6(1)(f) |
| Device and browser data | Site security, abuse prevention, aggregate analytics | Legitimate interests — Art 6(1)(f) |
| Cookies and storage | Functional preferences, security (Turnstile), consent record | Consent (Art 6(1)(a)) for any non-essential cookie; necessity for essential cookies |
4.1 Legitimate-interests balancing test (summary)
Where we rely on legitimate interests under Art 6(1)(f), we have completed a balancing test and recorded it internally. The summary, in plain language:
- Our interest is to operate a content platform that publishes on behalf of business operators with a complete audit trail.
- Your interest is to know what we are doing with your data and to be able to stop us.
- Our safeguards are: a published audit log, a 30-day deletion SLA at
/data-rights, a 24-month retention cap on engagement data, and a public sub-processor list at/trust. - Net effect: the processing is foreseeable and disclosed. Personal identifiers can be erased on request. What COLOSSEUM’s central brain has already learned cannot be unlearned (section 4.2). We hold the balancing test on file at the DPO mailbox.
4.2 Fleet learning
COLOSSEUM has one central brain. It learns from the content and results of every customer, post by post, and uses what it learns to create content for every customer. That is a condition of using the service.
The brain learns from everything the service creates, publishes or reads for a customer. That includes engagement on the customer’s posts and the text of comments people leave on them. If you comment on a post we publish for a customer, your comment may train the central brain.
Your handle, display name and other identifiers are personal data, and your rights in section 8 cover them. You can ask us to erase them at any time through /data-rights. When a customer’s account ends, we erase or strip those identifiers within 30 days.
We never sell what the central brain learns, and we never publish it outside COLOSSEUM. The full rules are in section 7A of the terms and section 9 of the Data Processing Addendum.
5. How we share it
We share your data with named recipients only. Every sub-processor is listed at /trust with the data category, country of operation, a link to its Data Processing Addendum where one is published, and whether that DPA is signed yet.
Today the list is: Cloudflare (hosting, edge compute, DNS, Turnstile, analytics, storage of customer voice samples), Supabase (operator database), SendGrid/Twilio (transactional email, and email to a customer’s own audience), Anthropic and OpenAI (language-model inference and text embeddings), Sentry (error monitoring), Stripe (payment processing — activated only when subscription billing goes live), Zernio (publishing to connected social accounts), Temporal Cloud (workflow orchestration), ElevenLabs (voiceover and voice cloning), Kling AI (video generation), Black Forest Labs (image generation), D-ID (lip-sync video), and AssemblyAI and Deepgram (transcription). Niche research uses Perplexity, which receives niche and topic queries. Brave Search, NewsAPI and Google Trends (research) and Pexels and Pixabay (stock footage search) receive short keywords only, never personal data. LinkedIn integration via the Marketing Developer Platform is deferred to a later phase and will be added to this list when active.
When you connect a social or advertising account and tell us to publish or advertise on it, we send your content and use your account authorisation with that platform (YouTube/Google, Instagram and Facebook/Meta, TikTok, Pinterest, X, Google Ads). Those platforms act under their own terms with you. They are recipients at your direction, not our sub-processors.
We do not sell your data to anyone. We do not share data with advertisers or data brokers. We do not use your data to train third-party AI models without an explicit, separate consent — and to date we have not requested any such consent.
When law enforcement or a court compels disclosure, we comply with the minimum disclosure that satisfies the demand and we publish an annual transparency report at /trust summarising aggregate counts.
6. Where we send it
Some sub-processors are based outside the UK, in the United States and Singapore. For transfers of UK and EU personal data to the US (and any other non-adequate country):
- UK transfers rely on the International Data Transfer Addendum (IDTA) to the EU Standard Contractual Clauses (SCCs).
- EU transfers rely on the EU Standard Contractual Clauses (2021/914).
- Transfers rely on the IDTA and SCCs incorporated in each sub-processor’s Data Processing Addendum. We are completing the signature of those addenda;
/trustshows each one’s status. - We have not yet completed a written Transfer Risk Assessment. We will complete one for each non-adequate destination (currently the United States and Singapore, plus any further country a vendor’s DPA confirms) before our first paying customer, and hold the records on file at the DPO mailbox.
Destination countries today: United States (Cloudflare, Supabase, SendGrid, Anthropic, OpenAI, Sentry, ElevenLabs, Perplexity, Google Trends), United Kingdom (Stripe, Temporal Cloud), Singapore (Kling AI). We are confirming the country of operation for Zernio, Black Forest Labs, D-ID, AssemblyAI, Deepgram, Brave Search, NewsAPI, Pexels and Pixabay; /trust shows each one as it is confirmed.
7. How long we keep it
| Category | Retention |
|---|---|
| Account data | For the life of the operator account, plus 90 days after closure for billing-record reconciliation |
| Platform-fetched engagement data | 24 months from the date of fetch |
| Operator usage data (audit log) | 24 months for trend analysis; cryptographic hashes of audit-log rows retained indefinitely for integrity verification |
| Device and browser data (analytics) | Aggregated, no row-level retention beyond 30 days |
| Cookies and storage | As listed at /cookies |
| DSAR records (verification tokens, request bodies) | 36 months as required by the regulator’s enforcement record-keeping; verification tokens are deleted within 24 hours of resolution |
| Contact-form submissions | 90 days; mail us first if you need a copy or earlier deletion |
We do not say “as long as necessary.” Every category has a number above.
8. Your rights
Under UK GDPR (and the EU GDPR for EU users), you have the following rights. Exercise any of them at /data-rights, or by mailing dpo@cmintel.ai.
- Access — get a copy of all data we hold about you.
- Rectification — correct inaccurate data.
- Erasure — be deleted (“right to be forgotten”).
- Restriction — pause our processing of your data.
- Portability — receive your data in a portable format.
- Objection — object to legitimate-interests processing (see section 4.1).
- No automated decision-making — opt out of any automated decision that produces legal or similarly significant effects (see section 11).
- Withdraw consent — where consent is the basis, you may withdraw it at any time.
Our SLA for any of these is 30 days from verification of your identity. If we cannot meet it, we will tell you why and what we are doing about it. If you are not satisfied, you may complain to your supervisory authority — the UK ICO for UK users, your national DPA for EU users.
9. Children
The service is not directed to users under 16, and we do not knowingly collect personal data from minors. If we learn that we have collected data from a user under 16, we delete it and notify the parent or guardian where contact details are available.
10. Security
A summary lives at /security. The short version: TLS 1.3 in transit, AES-256 at rest, multi-factor authentication on every human account that can reach customer data, quarterly internal penetration tests, an independent third-party penetration test planned before our first paying customer, and a one-business-hour disclosure mailbox at security@cmintel.ai.
11. Automated decisions
The COLOSSEUM publishing engine performs automated content classification and decision-making — for example, deciding whether a draft post passes the safety guardrails described at /safety. These decisions do not produce legal or similarly significant effects on the individuals whose engagement we read. If you believe an automated decision has affected you significantly, you may request human review by mailing dpo@cmintel.ai; we will review and respond within 30 days.
We do not profile individuals for marketing or advertising purposes.
12. Changes
We notify users of material changes by:
- Posting a change-log entry at the bottom of this page (below).
- Emailing every operator account holder at least 30 days before the material change takes effect, where reasonably practicable.
- Restating in plain language what changed and why.
Material changes include: a new sub-processor, a new data category, a new lawful basis, an extension of retention, a change in jurisdiction, or any erosion of a data-subject right. Cosmetic changes — typo fixes, link rewordings — do not require notice.
13. Contact
- DPO — dpo@cmintel.ai
- Press / legal — legal@cmintel.ai
- Trust desk — trust@cmintel.ai (sub-processor questions, transparency report)
- Postal — see footer for the registered office address
For UK users, the supervisory authority is the UK ICO. For EU users, your national supervisory authority. The lead supervisory authority for the EU is to be determined once Colosseum’s main establishment in the EU is set; until then, EU users may complain to their national DPA.
When subscription billing goes live (Phase 7 of the build), an EU representative under Article 27 will be appointed and named here. Until then, the service does not require an Article 27 representative because the in-scope EU data is limited to inbound contact-form and DSAR submissions.
Change log
- 2026-10-20 — material change: added 14 sub-processors to section 5 that were processing data but were missing from the list (Zernio, Temporal Cloud, ElevenLabs, Kling AI, Black Forest Labs, D-ID, Perplexity, AssemblyAI, Deepgram, Brave Search, NewsAPI, Google Trends, Pexels, Pixabay), and named the social and advertising platforms that receive content at your direction. Section 6 now says plainly that DPA signatures and Transfer Risk Assessments are still being completed, and lists Singapore. Section 10 now describes penetration testing as it stands today.
- 2026-10-18 — added section 4.2 on fleet learning: COLOSSEUM’s central brain learns from every customer’s content and results, including comments on their posts. Section 4 now lists that purpose. The Data Processing Addendum is now published at
/dpa. - 2026-05-04 — first published. No prior versions.
This document was Claude-drafted in line with the deferred-counsel policy at /research. Tier-2 solicitor review will fire when the first paying customer subscribes or when the data-flow scope changes materially — see the trigger logic at the same link.