This policy explains what we do with personal data when you use Telore. It is written to be read, not to be skipped.
Telore Ltd, company number 17458232, registered office Suite A, 82 James Carter Road, Mildenhall, Suffolk, IP28 7DE, United Kingdom, is the data controller for the personal data described here. You can reach us at support@telore.com. If you are not satisfied with how we have handled your data you can complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk.
Telore holds two kinds of personal data, and our role is different for each. Your account — your name, email address, sign-in methods, the companies you belong to and how you use Telore — is ours to look after: for it we are the controller, and this policy is how we do that. Your company's records — its books, invoices, bills, documents, payroll, what its connections bring in, and the names and details of its customers, suppliers, employees and directors in them — belong to your company: for those your company is the controller and we are its processor, acting only on its instructions under our data processing terms. If you are a customer, supplier or employee of a company that uses Telore and you want to ask about your data in its records, ask that company first; we will help it answer.
Account details you give us — your name, email address and password (stored only as a hash). Company details you enter, such as your company name and registration number. Financial data imported from the accounts you connect — Stripe, Wise, Airwallex and UK bank accounts through Open Banking: transactions, balances, fees, transfers, conversions and payouts, and the names, references and descriptions the provider attaches to them, which can include the names of your customers, suppliers and other people you pay or are paid by. Documents you upload. Technical data such as your IP address, browser type and the times you signed in.
To provide the service you have asked for — this is a contractual basis. To keep the service secure and prevent abuse, and to improve it, which are legitimate interests. To meet legal obligations, including the record-keeping periods that apply to financial records.
You choose which bank and payment providers to connect: Stripe for card payments, Wise and Airwallex for business accounts in several currencies, and UK banks through Open Banking. When you connect one, we receive permission to read your balances and transactions there; from Stripe we also read payouts, refunds and disputes, and from Wise and Airwallex the transfers and conversions between your own balances. We read the fees each provider states, and the names, references and descriptions it attaches to each payment. We use what we read only to keep your company's books: to record what happened, match it to your invoices and bills, value it in pounds and show you your balances. When you connect Stripe, we also receive permission to create payment pages for your own invoices only, so your customers can pay you by card, and to refund a card payment to your customer when you ask us to by pressing “Refund to the card” on a credit note. We store the credentials for each connection in encrypted form and use them only for these purposes. We never receive your banking password, and we cannot move, withdraw or send your money or initiate a payment from your account, other than a refund you ask for in that way. What a connection brings in becomes part of your company's records and is kept for as long as they are. When a provider notifies us that something has happened, we keep its message for 90 days after we have dealt with it and then delete it; we keep only the fact that it arrived, so that the same payment can never be recorded twice. You can disconnect a provider at any time, in Telore or at the provider: we stop reading it at once, delete the credentials we held for it, and keep what was already brought in, because it is part of your books. Each provider also holds your data under its own privacy notice; they are not our processors, they are the source you asked us to read.
Company verification can ask a person who runs a company to prove who they are. It is optional, and it is never required to sign up for Telore or to use it. The check is run for Telore Ltd by Didit (Didit Technologies), an identity verification provider acting as our processor, on its own secure page: you show an identity document, record a short selfie video so Didit can confirm a live person is there, and Didit matches your face with the photo on the document. We use the result to show that a company is run by real, named people before its emails carry the verified badge and before it can take card payments. Because the face match uses biometric data, we ask for your explicit consent on the screen before the check starts. Telore keeps only your name as the document gives it, the month and year you were born, the country that issued the document, and Didit’s decision with its date — never the images, the video, the document number or the day you were born. Authorised Telore staff may look at the images and the video in Didit only to investigate fraud or to settle a dispute, and every such look is recorded. If you ask us to review your right to act for a company by hand, we keep your explanation and our decision, and delete the documents you send 90 days after we decide. A verified result is kept for as long as your account exists; a check that did not pass, or was not finished, is deleted after 90 days. Didit keeps the images and the video for 12 months — the period we have set in our account with Didit — and then deletes them; they never reach Telore. To withdraw your consent and have the check deleted, by us and by Didit, write to support@telore.com.
If you write to us through the partner or contact form, we keep what you send: your name and email address, your organisation, its type and website, the topic and your message — and, for a Business Pack enquiry, the offer you propose for Telore companies — with the language and the page you wrote from. A contact message — and anything you send through the support page or a “Write to us” form inside Telore — becomes a support ticket in Intercom, the service our support team answers from; a partner enquiry is passed by email to our support team. If you are signed in, the ticket is linked to your account and names the company you were working in, the page you wrote from and any error code on it; if you are not, Intercom keeps the email address and name you gave so that we can reply. Card numbers, bank account details and passwords that we recognise are taken out of your message before it is kept or sent, and we tell you when that happens — but please do not send them at all. We use what you send only to answer you and to discuss the partnership or offer you proposed; this is our legitimate interest in replying to people who write to us. An offer is not shown to anybody outside Telore unless we agree in writing to include it. Writing to us does not put you on any mailing list. We keep an enquiry while we are discussing it with you, and delete it when you ask.
Telore in Sports is our programme for athletes. If you apply, we keep everything you send in the form — your name, email address, phone number if you give one, your confirmation that you are 18 or over (never your date of birth), the country you live in, your sport, discipline and level, your season plan, your current sponsors, the support you need, how you run your sport, your links and why you — with the language you applied in and a reference number. It is read only by the Telore in Sports team, to choose the athletes for that season and to contact you about your application; this is our legitimate interest in running the programme you applied to. The form is checked by Cloudflare Turnstile when it is switched on, as our contact form is. We keep an application until the end of that season’s selection — the month the athletes are announced — and for 12 months after it, and our retention job then deletes it; ask us and we delete it sooner. If you follow the season, we keep your email address and language, with your consent: one email first to check the address is yours, nothing else until you confirm, a one-click unsubscribe link in every email, and your address deleted within 30 days of unsubscribing — we keep only a note never to email it again. If you are chosen, we publish a profile only once you have given your consent and we have recorded the date: your name, sport, country, photo, races and results, and what you choose to tell us about yourself. Photos are stored without their location data. You can withdraw that consent at any time; your profile comes down at once. What each athlete receives from Telore is private between Telore and that athlete and is never published. Write to sports@telore.com for anything about the programme.
A small number of named Telore staff can look at an account or a company, to give support, keep the service safe or meet a legal obligation — and only after giving a reason, which is recorded with everything they open and kept for six years. Staff sign in separately from customers, with a passkey and a code sent to a separate mailbox. They can see a company as its owner sees it, to help with a question, but only to read: nothing can be changed, sent or deleted that way. Staff cannot change your books.
Most of our email is part of running your account: verifying your address, resetting a password, telling you about a security event, sending the invoices and reminders your company asks us to send, and answering support. Those are sent because they are necessary to provide the service you asked for, and they are not something to opt out of while the account is open. Marketing email is separate, requires your consent, and can be withdrawn at any time without affecting anything else. Our email policy sets out every category we send, what we do about bounces and complaints, and where to report unwanted mail.
While your account is open, we keep what you put into Telore. When a company is closed in Telore, we keep its business records for it — read only, and downloadable at any time — until six years after the end of the financial year it closed in, or later where one of its own records must be kept longer; we remind its owners once a year and twice more before that date, and then delete the records. A company can ask us in writing to delete them sooner. When you delete your account, your sign-in details, devices and sessions are removed at once; if a closed company's records still need to show who did something, your name stays only there. We also keep a short record of each account and each company — when it was created, signed in to, connected, closed and deleted — for six years after it ends, so that we can prevent fraud and answer questions or claims about it, which can be brought for six years. This is our legitimate interest. Your email address in that record is encrypted, and only named Telore staff can read it, with a recorded reason. When you delete your account we keep what you said to our support team — your conversations and requests in Intercom — for six years from the deletion, or from your last conversation if that is later, because it may be needed to establish or defend a legal claim; it is not used to contact you, only the people who handle claims and complaints can see it, and it is then deleted. A bank or payment provider's message telling us something happened is kept for 90 days after we have dealt with it. Anything under a legal hold, because of a dispute, an investigation or a request from an authority, is kept until the hold ends. You can ask us to delete anything these reasons do not cover.
You can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict how we use it, object to processing, or ask for it in a portable format. Where we rely on your consent — marketing email, Telore’s newsletter, the launch email and the identity check, and in Telore in Sports following the season and a published athlete profile, are the only places we do — you can withdraw it at any time, and you can object to direct marketing at any time with no reason given. Email us and we will respond within one month. If you are not satisfied, you can complain to the Information Commissioner's Office.
Your data is held on servers in the United Kingdom — our hosting, databases and file storage are in Amazon Web Services' London region. Error reports are held by Sentry, our email is sent by MailerSend, and identity checks are run by Didit, all in the European Union, which UK law recognises as giving adequate protection. Where a provider processes data outside the UK, we rely on the transfer safeguards required by UK data protection law: the UK adequacy regulations where they apply, and otherwise the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Support conversations and tickets are held by Intercom in the United States: Intercom is certified under the EU-US Data Privacy Framework and its UK Extension, which UK law recognises as giving adequate protection, and its data processing agreement brings in the UK Addendum to the EU standard contractual clauses if that certification ever stops applying.
If we change this policy in a way that materially affects you, we will tell you by email before the change takes effect.
End of this document · Last updated 18 October 2026
Back to the top