1. Who is responsible
Colibri Holdings Ltd, company number 09741137, registered office 71 Queen Victoria Street, London EC4V 4BE, United Kingdom. ICO registration ZB415775. Data protection contact: hello@axiom.vc.
We are the controller for the Wire’s processing described below. Stripe and Link also process payment and transaction data under their own privacy terms. We have not appointed a Data Protection Officer and are not required to; the person accountable is the director, and that address reaches them.
Representative in the EEA. We offer the Wire to people in the EEA, so Article 27 of the EU GDPR is engaged. We have not appointed a representative and rely on the exemption in Article 27(2): the processing is occasional, involves no special category or criminal-offence data, is small-scale, and is unlikely to result in a risk to rights and freedoms. Selling to businesses rather than consumers narrows both the number of people and what is held. This is a position taken deliberately and recorded, and it is revisited if that changes.
2. What we collect, why, and on what basis
| What | Why | Lawful basis |
|---|---|---|
| Your email address, and a hash of your sign-in credential | To let you sign in, and to know what you have access to. Sign-in is passwordless: an email and a six-digit code or single-use link | Performance of the contract |
| Registration date and the Terms version you accepted | To record when your account was created and the account agreement | Performance of the contract |
| Subscription and billing records — plan, status, period, VAT number, billing country, card metadata (never the card) | To provide subscription access, support billing through Stripe and Link, and keep required records | Contract, and legal obligation |
| Referral codes, optional public link names, linked accounts, subscription/payment references, qualification and reward records | To check referrals, add free months, confirm them by email and prevent abuse | Contract for rewards; legitimate interests for fraud prevention |
| What you confirmed at checkout, with the time and the version of the Terms shown | Because the Consumer Contracts Regulations require us to be able to show it | Legal obligation |
| Account usage records — while you are signed in: the pages you view, what the Wire loads for you, what you click, filter and search for, and your sign-ins, sign-outs, checkouts and billing visits. See Account usage records below | To run and secure the service, including spotting a shared or misused account; to support you and manage your account; to decide what to publish and build | Legitimate interests; contract where the record is needed to run your account |
| Server logs — IP address, user-agent, request, time; and, while you are signed in, a line naming your account and what the Wire loaded | Security, abuse prevention, and knowing the site is up | Legitimate interests |
| Google Analytics — cookies if you allow them, and cookieless signals with no identifier if you do not — see section 4 | To know which parts of the Wire are read | Consent for the cookies; legitimate interests for the cookieless signals |
| Ahrefs Web Analytics — only if you accept the notice that names Ahrefs: a cookieless count of visits to public pages, with the domain of the referring site — see section 4 | To know which search engines, AI assistants and other sites send readers to the Wire | Consent |
| Visitor counts — page views and clicks by people who are not signed in, with no identity — see section 4 | To know how many people read the open parts of the Wire, and what they use | Legitimate interests. You can decline |
| Media CFO newsletter signup, if you make one: your email and your agreement to receive it | To pass your request to the Media CFO team. Receiving a request is not enrolment; the newsletter itself is sent under the Media CFO privacy notice, with an unsubscribe link in every email | Consent |
| The Media CFO newsletter that comes with an account — from 10 November 2026 a new account is added to the weekly Media CFO newsletter, our newsletter on the business of entertainment, unless you untick the box for it on the sign-up form, which sits under the Terms box and is ticked to begin with. We hold your email address in the Media CFO newsletter list, and a record of the notice you were shown, your choice and the outcome, kept against a hash of your address | To send account holders the newsletter, and to be able to show that it was offered and could be declined. Accounts opened before that date were not added. If you had already unsubscribed from Media CFO or from all our email, opening an account does not add you back. Every issue has an unsubscribe link, and unsubscribing changes nothing about your account | Legitimate interests: telling our own readers about our related publication. You can decline at sign-up and unsubscribe from any issue |
| What you write to us — support, corrections, bug reports and plan enquiries, including the contact and company details you provide | To answer and to fix things | Legitimate interests |
Referrers see counts only, never the invited person’s name or email. A name you choose for your referral link is visible to anyone you share it with.
We do not sell or share personal data, there is no advertising on the Wire, and there is no automated decision-making with legal or similarly significant effects about any subscriber.
Account usage records
When you are signed in, we keep a record of how your account uses the Wire. Keeping this record is a condition of having an account (section 2 of the Terms), and there is no setting that turns it off. You can still object to it, as explained below.
What is recorded, against your account:
- every page you view: its address on the Wire, the name of the site you came from, your type of device and browser, and how long the page was visible on your screen;
- everything the Wire loads for you — which feed, company, deal or report;
- what you do on a page: clicks, filters, the panels and storylines you open, the stories you open and the links you follow out to a source;
- the full text of what you type into search;
- when you sign in and sign out, and when you go to checkout or to the billing portal.
Why: to run the Wire and keep it secure, including spotting an account that is shared or misused (section 10 of the Terms); to support you and manage your account; and to decide what to publish and what to build from what readers actually use.
Lawful basis: our legitimate interests in those purposes, and performance of our contract with you where the record is needed to run your account. We have weighed those interests against yours, and you may ask for a summary of that assessment.
Who sees them: our own staff. The records are stored by Supabase and pass through Render, who process them for us (section 5). We do not sell them, use them for advertising, send them to a model provider, or give them to your employer or team administrator.
How long: 24 months from the date of each record. When your account is deleted, its records are deleted with it.
Your rights over them. A copy or export of your data includes these records, and erasing your account erases them. You have the right to object to this recording under Article 21 of the UK GDPR, and of the EU GDPR where it applies. Write to hello@axiom.vc. There is deliberately no switch in the product: we consider each objection on its own facts and stop recording for you unless there are compelling legitimate grounds to continue, such as protecting the Wire from a shared or misused account. We tell you the outcome and the reason.
3. People in the news, and in the register
This is the largest volume of personal data we handle, and it is not about you as a subscriber.
The Wire reports on the business of entertainment — companies, deals, and the people who run and decide them — and maintains a register of mostly-private companies. Reporting names people: an executive quoted in the trade press, a regulator's decision, a filing.
| What | Why | Lawful basis |
|---|---|---|
| Names, roles, employers and publicly reported statements and actions of people in the industry | Journalism: reporting what has been published, and keeping a record of it | Legitimate interests, and the journalism exemption — Schedule 2, Part 5, para 26, Data Protection Act 2018 |
Where it comes from: the trade and financial press, company announcements, public registers and filings. We do not buy personal data, scrape social networks for it, or enrich it against third-party databases. The register's records describe companies, not individuals.
Your rights when you are in the news are in section 7, subject to the journalism exemption — which exists because reporting could not work if everyone written about could require their removal. If something about you is wrong, a correction is usually faster and more useful than a data protection request: section 12 of the Terms.
4. Cookies, storage and analytics
We use Google Analytics 4 with Consent Mode v2, defaulting to denied. Until you allow it, no analytics cookie is set, and Google receives only cookieless signals that carry no identifier, which it uses for aggregate measurement. You can change your mind at any time from the Analytics settings link in the footer.
Ahrefs Web Analytics (Ahrefs Pte. Ltd., Singapore). Only after you accept the notice that names Ahrefs, we use it to count visits to our public pages and to see which kinds of sites refer visitors. Ahrefs receives the page address without its query string or fragment, the page title, the domain of the site that referred you (never the full link), your browser language and screen size. Loading the script also sends your IP address and browser type to Ahrefs, which says it does not store IP addresses with analytics data. It sets no cookies and stores nothing on your device. It does not run on sign-in, account, invitation or checkout pages. A previous acceptance of Google Analytics alone does not start Ahrefs. You can decline, or withdraw at any time through Analytics settings. See Ahrefs' privacy policy.
Our own visitor count. If you are not signed in, we count page views and clicks without knowing who you are. Nothing is stored on your device for it. To count unique visitors we use a one-way code that changes every day, so one day's visits cannot be linked to another's. If you decline in the banner or from Analytics settings, or your browser sends a Global Privacy Control signal, you are not counted. The counts are kept for 90 days. When you are signed in, the account usage records in section 2 apply instead.
The Wire stores a few things in your browser so it works: your theme choice, your session, your analytics answers, when you last visited and which edition you saw, so it can mark what is new since then, and which stories you have opened or saved. These are localStorage entries, not cookies, they never leave your browser, and clearing site data removes them. Ahrefs sets no cookies and runs only after you accept.
Stripe sets what it needs on the checkout and customer-portal pages, which are its pages, for payment and fraud prevention.
A Global Privacy Control signal is treated as declining: no analytics cookie is set, Ahrefs does not run, and you are not in our visitor count. Because your browser has already answered, the Wire then shows no analytics banner and no Analytics settings link, whatever was chosen before.
5. Who processes data for us, and where
| Provider | What they do | Where |
|---|---|---|
| Render Services, Inc. (US) | Hosts the site and the relay, and keeps the relay's logs | US, and treated as a transfer |
| Supabase, Inc. | Subscriber database, including account usage records and visitor counts | Ireland (eu-west-1) |
| Stripe and Link | Managed Payments checkout, tax, invoices, billing notices, transaction support and customer portal | UK, EEA and US |
| Resend | Transactional email — sign-in codes and links, subscription confirmations, reminders. Open and click tracking off. Also holds the Media CFO newsletter list, which a new account joins unless you declined at sign-up | Ireland (eu-west-1) |
| Formspree | Receives and stores plan-enquiry forms and Media CFO newsletter signup requests and emails them to us, including your name, email, company and any other details you submit | US |
| Analytics 4, only with your consent | EEA and US | |
| Ahrefs Pte. Ltd. | Web Analytics: a cookieless count of visits to public pages and the domains that refer them, only with your consent | Singapore, and treated as a transfer |
| GitHub, Inc. | Private repository, which also holds bug reports and event submissions — see section 6 | US |
| Anthropic PBC (US) | Language models used on published news content | US |
For payment processing, see Stripe’s Privacy Policy and the privacy terms shown by Link at checkout. Link sends transaction receipts and certain subscription notices directly. Colibri sends sign-in and product emails.
For enquiry forms and newsletter signups, see Formspree’s Privacy Policy.
Nothing about you goes to a model provider. Not your account, not your billing, not your correspondence, not what you read. The models work on published material — articles, filings, registry records. Anthropic is not affiliated with, and does not endorse, the Wire.
Transfers. Where a provider is outside the UK we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU SCCs, except for Ahrefs: transfers to Ahrefs Pte. Ltd. (Singapore) rely on the data transfer terms in Ahrefs' Data Processing Addendum (its Annex C), and Ahrefs receives only the limited, short-lived data described in section 4. You may ask for a copy of the mechanism relied on for any provider.
6. One thing we want you to know, because it limits a right
Bug reports and event submissions are currently written to files in a private Git repository. Git history is append-only: deleting the current file leaves earlier versions intact. So for those two record types an erasure request cannot today be fully satisfied, and we would rather tell you that than claim a deletion that has not happened. Moving them into the subscriber database is planned and is the fix.
The same applies to an earlier, smaller log of reader events — page and story interactions, tagged with a code derived from the sign-in session rather than with a name or address. The account usage records in section 2 replace it, in the subscriber database, where deletion is complete.
Invitations used to be on this list and are not any more: since 27 September 2026 an invitation is a row in the subscriber database, which we can and do delete. The invitation code itself was never stored — only an unreadable hash of it.
7. How long we keep things, and your rights
| What | How long |
|---|---|
| Referral records | While pending, then 365 days after qualification or lapse. Records are deleted with the referrer’s account; deleting an invited account removes its account link. Reward transactions are retained as billing records. |
| Account and subscription records | While you subscribe, then 12 months |
| Billing and tax records | 6 years, as tax law requires |
| Checkout confirmations | 6 years — they are the evidence of what was agreed |
| Sign-in tokens and sessions | Days; single-use and hashed |
| Newsletter record for account holders | Kept while you have an account, and afterwards until you ask us to delete it: it holds a hash of your address, not the address, and exists so that we do not add you again. The record of a sign-up that was never finished is removed after 7 days, when further sign-ups are processed. Your address stays in the Media CFO list until you unsubscribe |
| Account usage records | 24 months, and deleted with your account |
| Server logs, including the account line | 30 days, our hosting provider's log period |
| Correspondence | Up to 24 months after the matter closes |
| Corrections and complaints | 6 years |
| Google Analytics | 14 months, the shortest setting that still allows a year-on-year comparison |
| Ahrefs Web Analytics | Ahrefs discards IP addresses straight away and deletes the daily key it uses to count unique visitors after 24 hours, so visits cannot be linked across days. It keeps only aggregated visit counts, with no fixed deletion date, and may use anonymised aggregated data to improve its services. |
| Visitor counts | 90 days |
| Published material and the archive | Indefinitely |
You may ask us to give you a copy of your data, correct it, erase it, restrict or object to its use, and port it; and you may withdraw consent for analytics or the newsletter at any time. A copy or export includes your account usage records, and how we handle an objection to them is in section 2. Write to hello@axiom.vc; we answer within one month and there is no charge. Where the journalism exemption limits a right we will tell you we are relying on it and why, rather than simply declining.
If we get it wrong, please tell us — we would rather fix it. You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113) or to the supervisory authority where you live.
8. Security, and its limits
The site is served over HTTPS. Sign-in is passwordless, so there is no password of yours to lose; tokens are single-use and stored hashed. Card details never reach us. Access to the subscriber database is restricted and verified server-side.
No system is perfectly secure. If a breach is likely to risk your rights and freedoms we will tell the ICO within 72 hours of becoming aware, and tell you without undue delay where the risk to you is high. To report a security problem: hello@axiom.vc.
9. Changes
The version and date at the top change with this policy. Where a change materially affects you we will say so on the Wire. Previous versions on request.