Legal
Last updated: 8 July 2026
This Privacy Policy explains how David 2 Goliath Ltd collects, uses, stores, shares and protects personal data when you use Prime Position, our website at www.primeposition.ai, our contact and sign-up forms, our marketing communications and related services. It also explains your rights and how to exercise them. We are committed to handling your data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025 and other applicable laws.
David 2 Goliath Ltd ("we", "us", "our") is the data controller for the personal data described in this policy, except where we act as a processor on your instructions (see section 5). We are a marketing agency specialising in digital advertising, lead generation, AI-assisted marketing systems and social media strategy for property professionals. We are registered in England and Wales.
David 2 Goliath LtdDepending on how you interact with us, we may collect:
We use your personal data to create and manage your account, to provide and run Prime Position, to generate content from your inputs, to take payment and manage your subscription, to operate our referral scheme, to provide support, to send marketing where permitted, to maintain and improve our products, to detect and prevent fraud, abuse and misuse and protect the security of the service, and to comply with our legal obligations.
Under UK GDPR we must have a lawful basis for each use of your data. Our bases are:
| What we do | Lawful basis |
|---|---|
| Creating and running your account and providing the service | Performance of a contract with you |
| Taking payment and managing your subscription | Performance of a contract, and compliance with legal and tax obligations |
| Generating content from your inputs using AI | Performance of a contract with you |
| Operating the referral scheme and processing referred-person data | Our legitimate interests in running a referral scheme |
| Product analytics to maintain and improve the service | Our legitimate interests in running and improving the platform |
| Detecting and preventing fraud, abuse and misuse (for example repeated trial creation, or use of the platform on behalf of a competing product), and protecting the security and integrity of the service and our other users | Our legitimate interests in protecting our service, our users and our business |
| Marketing communications about Prime Position | Your consent, or our legitimate interests where permitted by law |
| Meeting legal, accounting, tax and regulatory duties | Compliance with a legal obligation |
Where we rely on legitimate interests, we have balanced those interests against your rights. You can ask us about this balancing at any time.
Prime Position uses artificial intelligence and large language models, provided by Anthropic, to generate content from the inputs you give us. When you generate content, your inputs (such as your brief, profile and settings) are sent to Anthropic's systems to produce the output, which is returned to you and stored in your account.
We use Anthropic under commercial terms intended for business use. We do not sell your inputs or outputs. We do not use your private inputs to train our own public models, and our AI provider's commercial terms restrict the use of business inputs for training their models. AI outputs can contain errors and you remain responsible for reviewing them before use, as set out in our Terms and Conditions.
You should not enter into Prime Position any special category data, sensitive personal data, confidential client information, health, financial or criminal-offence data, or any information you do not have permission to process. The platform is designed for marketing and content inputs about your own business, not for sensitive records.
For account registration, billing, website analytics, marketing, enquiries and business administration, we act as an independent data controller and decide how and why your data is processed.
Where you upload personal data about other people (for example prospect or customer data) into Prime Position for us to process only on your instructions, we act as a data processor for that specific data, and you are the controller. You remain responsible for ensuring you have a lawful basis, notices and permissions to provide that data to us. Where we process such personal data on your behalf as a processor, our Data Processing Addendum applies automatically and forms part of your subscription agreement. You do not need to request it separately.
We use a small number of trusted third-party providers to run Prime Position. Each only processes data as needed to provide its service, under contractual data protection obligations:
| Provider | Role | Purpose |
|---|---|---|
| Supabase | Database and cloud infrastructure | Stores your account, profile and generated content |
| Anthropic | AI and large language models | Processes your inputs to generate content outputs |
| Stripe | Payment processing | Handles subscription billing and card details |
| Resend | Email delivery | Sends account, billing and service emails |
| PostHog | Product analytics | Measures how the platform is used so we can improve it |
| Vercel | Hosting and deployment | Serves the website and application |
We maintain a current list of sub-processors and may update it from time to time. We will take steps to notify you of material changes. We do not sell your personal data to anyone.
Payments are processed by Stripe. When you subscribe, your card and payment details are collected and handled directly by Stripe under its own terms and privacy policy. We do not store your full card number or security details on our systems. We retain limited billing information, such as your billing address, plan, subscription status and any VAT number you provide, so we can manage your subscription, issue records and meet our accounting and tax obligations.
Some of our sub-processors are based outside the UK, including in the United States and the European Economic Area. Where personal data is transferred outside the UK, we rely on an appropriate safeguard recognised under UK data protection law, such as UK adequacy regulations or the International Data Transfer Agreement (IDTA) or addendum to the EU Standard Contractual Clauses, so that your data continues to receive an equivalent level of protection.
We keep your personal data and account content only for as long as we need it. After you cancel, we delete or anonymise your account content within 30 days, unless we are legally required, or need, to retain specific records for longer. The table below sets out our standard retention periods by data type:
| Data type | Retention |
|---|---|
| Account and identity data | Kept while your account is active; deleted or anonymised within 30 days of cancellation |
| Profile and business data | Kept while your account is active; deleted or anonymised within 30 days of cancellation |
| Generated content and content inputs | Kept while your account is active; deleted within 30 days of cancellation unless you export it first |
| Third-party data you upload (prospect or customer data) | Deleted or anonymised within 30 days of cancellation, or sooner on request |
| Billing and transaction records | Retained for up to 7 years to meet accounting and tax obligations |
| Referral data | Pending referral data deleted within the 14-day attribution and holding window; converted records kept as customer data |
| Analytics data | Retained in identifiable form for up to 14 months, then deleted or aggregated |
We may retain certain records for longer where we are required to do so for legal, regulatory, accounting or tax purposes, or to resolve disputes, prevent abuse and enforce our agreements. When data is no longer needed, we delete or anonymise it.
We may create anonymised and aggregated data from platform usage that does not identify you or any individual, for example to understand trends and improve our products. Anonymised data is not personal data and may be used and retained without restriction. We will not use identifiable personal data for any purpose described in this section without a lawful basis, and where any future feature would rely on your consent to use your data in an identifiable way, we will ask for that consent separately and clearly before doing so.
If you take part in our referral scheme, we process limited personal data to operate it.
When you invite a peer, the invitation is sent by you from your own email account or messaging apps. We are not the sender of the invitation, so we are not sending electronic marketing to your contact on our own behalf.
Where you refer someone and we record the referral, we store the referred person's email address and, optionally, their first name, so we can show invitation status and attribute any reward. We do not collect more than this. Our lawful basis for this processing is our legitimate interests in operating the scheme.
We keep pending referral data only as long as needed: we delete it when the 14-day attribution and holding window expires, or when it converts into a customer record, unless the referred person asks us to erase it sooner. A referred person can object to this processing, or ask us to erase their data, at any time using the contact and rights routes in this policy. When a referred person lands on our referral page, we make clear that a member invited them, link to this policy, and offer a way to opt out or be erased.
Under UK data protection law you have the right to:
To exercise any of these rights, contact us at support@primeposition.ai. We may need to verify your identity. We will respond within the time limits set by law, usually within one month.
If you are unhappy with how we handle your personal data, you have the right to complain directly to us, and we will acknowledge your complaint within 30 days and take steps to resolve it without undue delay. You can use our complaints form, or email us at support@primeposition.ai in the first instance.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at www.ico.org.uk. We would appreciate the chance to address your concerns before you approach the ICO.
We may send you updates about Prime Position, property marketing insights and relevant services. Where required, we send electronic marketing only with your consent. Where we contact corporate subscribers on a business-to-business basis, we may rely on our legitimate interests where permitted by PECR and UK GDPR. You can unsubscribe at any time using the link in any marketing email, or by emailing support@primeposition.ai. Unsubscribing from marketing does not stop essential service messages about your account or billing.
We use appropriate technical and organisational measures to protect your information, including access controls, encryption in transit, and row-level security on our database so that accounts are isolated from one another. No method of internet transmission or storage is completely secure, but we work to protect your data and will notify you and the ICO of any qualifying personal data breach as required by law.
Prime Position is a business tool intended for property professionals aged 18 or over acting in the course of a business. It is not directed at children, and we do not knowingly collect personal data from anyone under 18.
We may update this Privacy Policy from time to time. When we do, we will update the date at the top of this document and, where changes are material, take reasonable steps to notify you.
For any questions about this policy or how we handle personal data, contact us at support@primeposition.ai, or see our contact page.
David 2 Goliath Ltd | Registered in England and Wales | Company no. 15811179 | support@primeposition.ai | Terms