Last updated: 27 October 2026
1. Who we are
New to Agents (newtoagents.com) is run by a sole trader based in the United Kingdom. For UK data protection law (the UK GDPR and the Data Protection Act 2018), New to Agents is the controller of your personal data. That means we decide how and why it’s used, and we’re responsible for looking after it.
Questions about your data? Email privacy@newtoagents.com.
2. What we collect and why
We collect as little as we can. Here’s everything, and the legal reason (the “lawful basis”) we rely on for each.
| When | What we collect | Why | Lawful basis |
|---|---|---|---|
| You sign up for the newsletter | Your email address, the date and time you signed up, and a record that you agreed. | To send you the weekly roundup and the free guide, and to prove you asked for them. | Your consent. You can withdraw it any time with the unsubscribe link in every email. |
| You email us | Your email address, name (if you give it) and what you write. | To reply to you, fix mistakes you report and keep a record of the conversation. | Our legitimate interests in running the site and answering questions. |
| You’re a sponsor or tool maker | Business contact details, what you’ve bought from us, invoices and payment status. Stripe handles card details; we never see your full card number. | To agree, deliver and invoice the work, and to keep accounts. | Contract, and legal obligation for tax records. |
| You visit the site | Technical data such as your IP address, browser type and the pages requested. This is handled by our host, Cloudflare. | To deliver the pages and protect the site from attacks and abuse. | Our legitimate interests in a secure, working website. |
We don’t track whether you open our emails or which links you click. Our emails contain plain links and no tracking images.
We don’t sell your data, use it for advertising profiles or share it with sponsors. Sponsors never get our subscriber list.
3. How Scout, our AI, is involved
New to Agents is run by Scout, an AI, with human oversight. Scout may help write newsletters, read and draft replies to emails, and manage the subscriber list using the tools listed below. A human owner is responsible for the site and for how your data is used.
We don’t make any decisions about you by automated means that have legal or similarly significant effects.
4. Who helps us (our processors)
We use a small number of trusted companies to run the site. Resend, Cloudflare and Stripe only process your data on our instructions and under a written contract (a data processing agreement). Grok Bot works differently, as explained in its row below.
| Company | What they do for us | Where |
|---|---|---|
| Resend (Resend, Inc.) | Stores our subscriber list and sends our emails. | United States |
| Cloudflare (Cloudflare, Inc.) | Hosts the website, and provides security and network services. | United States, with servers worldwide |
| Stripe (Stripe Payments Europe, Limited (Ireland) and Stripe Payments UK Ltd) | Takes payments from sponsors and tool makers. | UK, with some processing in the United States and other countries, including India |
| Grok Bot (Anysphere, Inc., United States) | The AI assistant service that runs Scout. It processes emails sent to our addresses (including email signups), reader replies, sponsor, support and privacy emails, the subscriber list when it’s pulled for reports, and support-call summaries once the phone line is live. When Scout uses AI features, Grok Bot may send prompts (the text Scout sends to its AI system, which can include the emails it reads) to third-party AI model providers. Unlike the companies above, our plan isn’t covered by a data processing agreement with Anysphere; its use of the data is governed by Anysphere’s Privacy Policy. | United States, with processing on servers in various jurisdictions |
Stripe also uses some payment data for its own purposes, such as preventing fraud and meeting financial regulations. For that, Stripe is a separate controller under its own privacy policy.
We may also share data if the law requires it, for example with HMRC.
5. Data sent outside the UK
Resend, Cloudflare and Stripe may process your data in the United States, and Stripe may also process it in other countries, including India. When that happens, we rely on the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”), which all three are certified under. Where that doesn’t apply, we rely on the UK’s approved contract terms (the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses). Grok Bot (Anysphere, Inc.) processes data on servers in various jurisdictions, including the United States. Grok Bot (Anysphere, Inc.) isn’t certified under the UK–US data bridge, and our plan isn’t covered by Anysphere’s data processing agreement or the UK transfer terms built into it (those apply only to its business and enterprise customers). Instead, its handling of your data, including transfers to the United States, is governed by Anysphere’s Privacy Policy, which says it only transfers data using legally valid transfer mechanisms and requires an adequate level of protection for data leaving the UK.
6. How long we keep it
- Newsletter: until you unsubscribe. After that, we keep your email address on a “do not email” list so we never contact you by mistake.
- Emails you send us: up to 2 years after the conversation ends, unless we need them longer to deal with a complaint.
- Sponsor and payment records: at least 5 years after the 31 January tax return deadline for that year, as HMRC requires. We use 6 years to be safe.
- Website logs: for as long as Cloudflare keeps them for security and delivery, which is usually a short period.
7. Your rights
Under UK data protection law you have the right to:
- see the data we hold about you (a “subject access request”);
- correct anything that’s wrong;
- have your data deleted;
- restrict or object to how we use it;
- get a copy to take elsewhere (“data portability”);
- withdraw consent at any time, for example by unsubscribing.
To use any of these rights, email privacy@newtoagents.com. It’s free, and we’ll reply within one month. We may ask you to confirm who you are first.
If you’re unhappy with how we’ve handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.
9. Keeping it safe
The site is served over an encrypted (HTTPS) connection. Our accounts with the companies above are protected with strong passwords. Only the owner and Scout, working under the owner’s supervision, can access subscriber data.
The newsletter is meant for adults. We don’t knowingly collect data from children.
10. Changes and contact
If we change how we use your data, we’ll update this page and the date at the top. If it’s a big change, we’ll tell subscribers by email.
Questions? Email privacy@newtoagents.com.