Privacy Policy
Last updated: 2 October 2026
Distil Technology Limited ("Chora", "we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and share information about you when you visit trychora.com, use the Chora platform, or are contacted by us about a potential partnership.
We are the data controller for the purposes of UK GDPR and the Data Protection Act 2018. Distil Technology Limited is registered in England and Wales (company number 15452977). Our senior officer responsible for data protection is Ben Anthoney, Director. Contact us at ben@trychora.com.
1. Who this policy applies to
This policy covers:
- Professionals who claim a Chora handle (trychora.com/<handle>) and share partner tools from their public page
- Event organisers who sign up to receive brand-partnership recommendations for their events
- Brands and suppliers who use Chora to be matched with relevant event organisers or professionals
- Prospective partners we contact as part of our outbound business-development activity
- Visitors to our marketing website at trychora.com
2. What data we collect
2.1 Chora users (link-in-bio)
When you claim a handle and create a Chora page we collect:
- Name, work email address, and (optionally) phone number
- Your chosen handle, display name, bio, portrait, and public social links
- The partner tools you choose to recommend, together with any notes you write about them
- Which theme and visual settings you select for your public page
- Attribution data: which visits to your public page click through to a partner, and which of those convert into partner signups
Sign-in is via email magic link or Google OAuth. Chora does not hold your password.
2.2 Event organisers
When you create and manage a Chora Events account we collect:
- Name, work email address and (optionally) phone number
- Your organisation's name, website and public social-media handles
- Your event programme: event names, dates, locations, expected attendance, format and audience profile
- Your sponsor preferences and "dream categories" — the kinds of brand you want to be matched with
- Profile data derived from your event history and public web presence (see 2.5)
- Any files or free-text you upload (e.g. attendee feedback, sponsor briefs) to help us improve matching
2.3 Brand and supplier users
When you create a Chora account we collect:
- Name, work email address and job title
- Your brand or company's name, website and public social-media handles
- Information about your product, target customer and partnership objectives
- Profile data derived from your public web presence (see 2.5)
2.4 Prospective partners (outbound contacts)
Before you have a Chora account we may contact you — by email or on LinkedIn — because we believe your brand, event or service is a potential fit for the platform. In that case we process:
- Your name, job title and employer
- A work email address and/or LinkedIn profile URL
- Publicly available information about the company (website, social handles, press coverage)
- A short record of our outreach to you (whether a message was sent, replied to, or declined), so that we do not contact you repeatedly
The business contact data for these outreach activities is sourced from publicly available web pages and from licensed B2B data providers (see section 5, Apollo). You can ask us to stop at any time by replying "unsubscribe", or by emailing ben@trychora.com — we will remove you from all future outreach within 5 working days.
2.5 Data we derive from public web content
To build useful matching recommendations and to enrich partner profiles we automatically ingest the content of your public website, event listings and public social-media profiles. We use the Firecrawl service to retrieve the pages, Anthropic's Claude model to extract structured information, and OpenAI's embedding model to produce a numerical "fingerprint" of your profile that our matching engine can compare against others.
We only process content that is already publicly available on the open internet. We do not scrape content that sits behind a login, is private, or is explicitly blocked by robots.txt.
2.6 AI-generated recommendations
We use large language models operated by Anthropic (Claude) and OpenAI (embeddings) running under contracts that prohibit the use of our data to train their general-purpose models. All recommendations are advisory: a human (either you or someone on the Chora team) always decides whether to act on them. No fully automated decision with a legal or similarly significant effect on you is taken by Chora.
If you receive a recommendation and want to understand how it was produced, email ben@trychora.com and we will explain the main factors behind it. You can object to being included in AI-generated recommendations at any time (section 8).
3. How we use your data and our lawful bases
| Purpose | Data | Lawful basis |
|---|---|---|
| Running your Chora page: hosting your public profile, tracking attribution on partner clicks, calculating payouts | Chora account data (2.1), attribution events | Performance of a contract |
| Creating and managing organiser, brand and supplier accounts; generating partnership recommendations; introducing matched parties | Account data (2.2, 2.3); derived profile data (2.5) | Performance of a contract |
| Sharing your profile with a matched counter-party when we recommend a partnership | Name, role, company name, website, public social handles, profile summary | Legitimate interests (facilitating the B2B introductions you signed up for) |
| Running the AI matching and drafting engine | Data in 2.1–2.5 | Performance of a contract (for signed-up users); legitimate interests (for prospective-partner research) |
| Outbound business development | Business contact data (2.4) | Legitimate interests (B2B marketing to work contact details) |
| Sending transactional emails (sign-in links, account notifications, recommendation summaries) | Email address | Performance of a contract |
| Sending product and marketing updates about Chora | Email address | Consent (opt-in on signup; withdraw at any time) |
| Keeping invoicing and tax records | Transaction records | Legal obligation |
| Understanding how the platform and website are used, and improving them | Usage data and PostHog events (section 9) | Legitimate interests |
Where we rely on legitimate interests we have completed a Legitimate Interests Assessment, available on request from ben@trychora.com.
4. Who we share your data with
Partner tools. When a visitor to your public Chora page clicks through to a partner tool and signs up, we share the attribution tag with the partner so they can credit the signup to your account. We do not share the visitor's identity or any personal data beyond what the partner collects directly from them during their own signup.
Matched counter-parties. When our engine identifies a strong match on the Events side and you accept an introduction, we share the information needed to make the introduction useful: name and role of the primary contact, company name, website, public social handles and the summary of your profile that explains the fit. We do not share private notes, uploaded files or raw AI prompts.
No sale, no ad networks. We do not sell personal data and we do not share it with data brokers or advertising networks.
5. Service providers (data processors and sub-processors)
We use the following providers to run Chora. Each processes data only on our instructions and under a written contract.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication and file storage | EU (Frankfurt) |
| Render | Hosting the Chora API and background jobs | EU (Frankfurt) |
| Cloudflare | Edge routing for trychora.com and TLS termination | Global edge network, UK-approved safeguards |
| Anthropic (Claude) | Large language model used for profile extraction, matching rationales and drafting | US, under Standard Contractual Clauses; data not used to train general models |
| OpenAI | Embedding model used to generate profile vectors for matching | US, under Standard Contractual Clauses; data not used to train general models |
| Firecrawl | Scraping public web pages during organiser and brand ingestion | US, under Standard Contractual Clauses |
| Apollo | Licensed B2B contact-data provider used to source business email addresses and LinkedIn URLs of prospective partners | US, under Standard Contractual Clauses |
| Google OAuth sign-in, Google Workspace (email and documents), Gmail API for outbound business-development messages sent from Ben's work mailbox | UK/EU/US under Google's UK data transfer addendum | |
| PostHog | Product analytics and session recording on trychora.com and in the Chora web app | EU (Frankfurt) |
| Crisp | Live-chat widget on the marketing site and dashboard. Stores chat history and any email you share with us. | EU |
| Stripe | Payment processing and payouts to Chora users. Chora never sees or stores card details. | UK/EU/US under Stripe's data transfer terms |
Where a provider processes data outside the UK we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and on the UK adequacy decision for the EU.
6. How long we keep your data
- Chora account and attribution data. While your account is active, then deleted within 30 days of closure unless we must keep it by law.
- Event organiser, brand and supplier account data. While your account is active, then deleted within 30 days of closure unless we must keep it by law.
- Derived profile data and AI embeddings. Refreshed on a rolling basis; deleted within 30 days of account closure.
- Prospective-partner outreach records. 24 months from the last contact, then deleted — kept so that we do not re-contact people who have declined.
- Opt-out records. Retained indefinitely as a suppression list, so that unsubscribe requests are honoured permanently.
- Marketing consent. Until you withdraw it.
- Invoicing, payout and tax records. 6 years, as required by HMRC.
- Server logs and analytics events. Up to 12 months.
7. Security
Data is encrypted in transit and at rest. Access to personal data is limited to Chora staff and controlled by role. Users can only see data for their own account and the counter-parties they are matched with, enforced by row-level security in our database. Sign-in uses Google OAuth or email magic link, with multi-factor authentication required for Chora staff. We review access and our providers' security certifications at least annually.
AI prompts and completions sent to Anthropic and OpenAI are transmitted over TLS and are covered by zero-retention or short-retention terms under our enterprise contracts. We do not send financial data, government identifiers or special-category data to any AI provider.
8. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data
- Restrict or object to how we process your data — including objecting to inclusion in AI-generated recommendations or to receiving outbound business-development messages
- Receive your data in a structured, machine-readable format
- Withdraw consent at any time, where processing is based on consent
- Request an explanation of the main factors behind any AI-generated recommendation that concerns you
To exercise any of these rights, email ben@trychora.com. We respond within 30 days.
9. Website analytics and cookies
Our marketing website at trychora.com and the Chora web app use PostHog for product analytics and, on parts of the app, session recording. PostHog collects pages visited, device and browser type, approximate location derived from IP address, in-app events, and (where enabled) replays of your interaction with pages. Form inputs on sign-up and sign-in screens are masked.
We also use Crisp to offer a live-chat widget on the marketing site and inside the dashboard. If you open a chat, Crisp stores the message history, any email address you enter, and basic session data (browser, time of visit) so we can continue the conversation later. Crisp is operated by Crisp IM SAS and hosted in the EU.
Both PostHog and Crisp are loaded only after you accept non-essential cookies in the banner shown on your first visit. You can change your choice at any time via the Cookie preferences link in the footer. If you reject cookies the chat widget will not appear until you re-open the preferences and accept.
We do not run Google Analytics, Microsoft Clarity, Meta Pixel or any advertising-network tag on trychora.com.
10. Children
Chora is intended for business users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a minor, contact ben@trychora.com and we will delete it promptly.
11. Changes to this policy
We may update this policy from time to time. We will notify registered users of material changes by email. The date at the top of this document always reflects the most recent revision.
12. Complaints
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. We would appreciate the chance to resolve your concern first: please contact ben@trychora.com.
13. Contact us
Email: ben@trychora.com
Company: Distil Technology Limited (company number 15452977)
Website: trychora.com