1. Who is responsible
Colibri Holdings Ltd, company number 09741137, registered office 71 Queen Victoria Street, London EC4V 4BE, United Kingdom. ICO registration ZB415775. Data protection contact: hello@axiom.vc.
We are the controller for everything below. We have not appointed a Data Protection Officer and are not required to; the person accountable is the director, and that address reaches them.
Representative in the EEA. We offer the Wire to people in the EEA, so Article 27 of the EU GDPR is engaged. We have not appointed a representative and rely on the exemption in Article 27(2): the processing is occasional, involves no special category or criminal-offence data, is small-scale, and is unlikely to result in a risk to rights and freedoms. Selling to businesses rather than consumers narrows both the number of people and what is held. This is a position taken deliberately and recorded, and it is revisited if that changes.
2. What we collect, why, and on what basis
| What | Why | Lawful basis |
|---|---|---|
| Your email address, registration time and accepted Terms version, and hashes of verification codes, links and sessions | To create your free account, verify your email and provide the access you choose. Sign-in is passwordless; verification codes and links expire after 15 minutes and work once | Contract |
| Subscription and billing records — plan, status, period, VAT number, billing country, card metadata (never the card) | To sell you a subscription, take payment, apply the right VAT, and keep the records tax law requires | Contract, and legal obligation |
| Referral codes, optional public link names, linked accounts, subscription/payment references, qualification and reward records | To check referrals, add free months, confirm them by email and prevent abuse | Contract for rewards; legitimate interests for fraud prevention |
| What you confirmed at checkout, with the time and the version of the Terms shown | Because the Consumer Contracts Regulations require us to be able to show it | Legal obligation |
| Account usage records — while you are signed in: the pages you view, what the Wire loads for you, what you click, filter and search for, and your sign-ins, sign-outs, checkouts and billing visits. See Account usage records below | To run and secure the service, including spotting a shared or misused account; to support you and manage your account; to decide what to publish and build | Legitimate interests; contract where the record is needed to run your account |
| An access log. Each time the Wire's data is loaded, the relay writes a line to its hosting log with the kind of access, the account and what was loaded. For a signed-in reader the account is your email address. The same loads are also in your account usage records | Security, and spotting the misuse section 10 of the Terms prohibits — a shared credential, a scraper | Legitimate interests |
| Server logs — IP address, user-agent, request, time | Security, abuse prevention, knowing the site is up | Legitimate interests |
| Visitor counts — page views and clicks by people who are not signed in, with no identity — see section 5 | To know how many people read the open parts of the Wire, and what they use | Legitimate interests. You can decline |
| Newsletter email address, consent version and confirmation time, plus hashed confirmation tokens and temporary abuse-prevention identifiers | To confirm your request and deliver the DFC newsletter separately from any Wire account | Consent; legitimate interests for preventing abuse |
| Google Analytics — cookies if you allow them, and cookieless signals with no identifier if you do not — see section 5 | To know which parts of the Wire are read | Consent for the cookies; legitimate interests for the cookieless signals |
| What you send us — an access request, an event, a correction, a bug report, an email | To read it, answer it, and act on it | Steps before a contract, and legitimate interests |
Referrers see counts only, never the invited person’s name or email. A name you choose for your referral link is visible to anyone you share it with.
We do not sell or share personal data, there is no advertising on the Wire, and there is no automated decision-making with legal or similarly significant effects about any subscriber.
Account usage records
When you are signed in, we keep a record of how your account uses the Wire. Keeping this record is a condition of having an account (section 2 of the Terms), and there is no setting that turns it off. You can still object to it, as explained below.
What is recorded, against your account:
- every page you view: its address on the Wire, the name of the site you came from, your type of device and browser, and how long the page was visible on your screen;
- everything the Wire loads for you — which feed, company, deal or report;
- what you do on a page: clicks, filters, the panels and storylines you open, the stories you open and the links you follow out to a source;
- the full text of what you type into search;
- when you sign in and sign out, and when you go to checkout or to the billing portal.
Why: to run the Wire and keep it secure, including spotting an account that is shared or misused (section 10 of the Terms); to support you and manage your account; and to decide what to publish and what to build from what readers actually use.
Lawful basis: our legitimate interests in those purposes, and performance of our contract with you where the record is needed to run your account. We have weighed those interests against yours, and you may ask for a summary of that assessment.
Who sees them: our own staff. The records are stored by Supabase and pass through Render, who process them for us (section 6). We do not sell them, use them for advertising, send them to a model provider, or give them to your employer or team administrator.
How long: 24 months from the date of each record. When your account is deleted, its records are deleted with it.
Your rights over them. A copy or export of your data includes these records, and erasing your account erases them. You have the right to object to this recording under Article 21 of the UK GDPR, and of the EU GDPR where it applies. Write to hello@axiom.vc. There is deliberately no switch in the product: we consider each objection on its own facts and stop recording for you unless there are compelling legitimate grounds to continue, such as protecting the Wire from a shared or misused account. We tell you the outcome and the reason.
3. What you submit, and where it goes
Three things are worth stating plainly because they are not obvious.
Free registration asks for your email and acceptance of the Terms. Your account is created after you verify the email. This does not create a paid subscription or join a mailing list. We retain the registration time and accepted Terms version with your account. Verification challenge hashes expire after 15 minutes and are cleared after a day when further challenges are issued. Existing invitation codes and sign-in links remain supported.
Newsletter signup is optional and separate from registration or paid access. We send a confirmation email; only after you confirm do we add you to the DFC newsletter list in Resend. The link expires after 30 minutes. Each newsletter includes an unsubscribe link. We do not enable email-open or link-click tracking. Existing opt-outs and delivery suppressions are preserved; contact hello@axiom.vc if you need help changing a previous opt-out.
A plan enquiry asks for your name, work email, company and any optional details you supply. Formspree receives the form and emails it to AXIOM so we can answer you.
An event submitted through the calendar can appear on the Wire, marked unconfirmed, before a person has looked at it. Do not put anything in it you would not want published.
Submitted events and contributions are processed by a language model as part of checking and categorising them. That is the one place something a reader sent reaches a model provider. Your account, your billing and your correspondence never do.
The provider does not train on it. Anthropic's commercial terms state that "Anthropic may not train models on Customer Content from Services", which covers both the published material and anything a reader submits.
4. People in the news, and in the universe
This is the largest volume of personal data we handle, and it is not about you as a subscriber.
The Wire reports defence, deep tech and cyber — contracts, awards, rounds, policy and the organisations and people behind them — and maintains a universe of organisations. Reporting names people: an executive quoted in the trade press, a minister announcing a programme, a procurement official named in an award notice.
| What | Why | Lawful basis |
|---|---|---|
| Names, roles, employers and publicly reported statements and actions of people in the sector | Journalism: reporting what has been published, and keeping a record of it | Legitimate interests, and the journalism exemption — Schedule 2, Part 5, para 26, Data Protection Act 2018 |
Where it comes from: trade and financial press, company announcements, government and regulator notices, and public registers. We do not buy personal data, scrape social networks for it, or enrich it against third-party databases. The universe's records describe organisations, not individuals.
Your rights when you are in the news are in section 7, subject to the journalism exemption — which exists because reporting could not work if everyone written about could require their removal. If something is wrong, a correction is usually faster than a data protection request: section 12 of the Terms.
5. Cookies, storage and analytics
We use Google Analytics 4 with Consent Mode v2, defaulting to denied. Until you allow it, no analytics cookie is set, and Google receives only cookieless signals that carry no identifier, which it uses for aggregate measurement. Change your mind any time from the Analytics settings link in the footer.
Our own visitor count. If you are not signed in, we count page views and clicks without knowing who you are. Nothing is stored on your device for it. To count unique visitors we use a one-way code that changes every day, so one day's visits cannot be linked to another's. If you decline in the banner or from Analytics settings, or your browser sends a Global Privacy Control signal, you are not counted. The counts are kept for 90 days. When you are signed in, the account usage records in section 2 apply instead.
The Wire stores a few things in your browser so it works: your theme, your session, and your analytics answer. These are localStorage keys, not cookies, they never leave your browser, and clearing site data removes them.
Stripe and Link set what they need on their checkout, billing and subscription-management pages. For Managed Payments, Link is the merchant of record and processes transaction data under its Privacy Policy.
A Global Privacy Control signal is treated as declining: no analytics cookie is set, and you are not in our visitor count.
6. Who processes data for us, and where
| Provider | What they do | Where |
|---|---|---|
| Render Services, Inc. (US) | Hosts the site and the relay, and keeps the relay's logs | US, and treated as a transfer |
| Cloudflare, Inc. (US) | Delivers the site at the network edge | Global edge |
| Supabase, Inc. | Subscriber database, sessions, invitations, newsletter consent records, account usage records and visitor counts | Ireland (eu-west-1) |
| Stripe Payments UK, Ltd. / Stripe, Inc. and Link | Managed Payments merchant-of-record service, checkout, tax, invoices, receipts and billing management | UK, EEA and US |
| Resend | Transactional email — sign-in codes and links, purchase confirmations, invitations — and the DFC newsletter mailing list and delivery | Ireland (eu-west-1) |
| Formspree | Receives and stores plan-enquiry forms and emails them to us | US |
| Analytics 4 (only with consent); web fonts; publication icons; machine translation of foreign-language headlines | EEA and US | |
| GitHub, Inc. | Private repository, which also holds access requests, invitations, event submissions, contributions and bug reports — see section 7 | US |
| Anthropic PBC (US) | Language models used on published material and on submitted events — see section 3 | US |
Nothing about your account goes to a model provider. Not your billing, not your correspondence, not what you read. What does is published material and the events readers submit, and section 3 says so rather than leaving it implied. Anthropic is not affiliated with, and does not endorse, the Wire.
Transfers. Where a provider is outside the UK we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU SCCs. You may ask for a copy of the mechanism relied on for any provider.
7. One thing we want you to know, because it limits a right
Access requests, invitations, event submissions, contributions and bug reports are currently written to files in a private Git repository. Git history is append-only: deleting the current file leaves earlier versions intact. So for those record types an erasure request cannot today be fully satisfied, and we would rather tell you that than claim a deletion that has not happened. Moving them into the subscriber database is planned and is the fix.
8. How long we keep things, and your rights
| What | How long |
|---|---|
| Account and subscription records | While you subscribe, then 12 months |
| Referral records | While pending, then 365 days after qualification or lapse. Records are deleted with the referrer’s account; deleting an invited account removes its account link. Reward transactions are retained as billing records. |
| Billing and tax records | 6 years, as tax law requires |
| Checkout confirmations | 6 years — they are the evidence of what was agreed |
| Sign-in tokens and sessions | Days; single-use and hashed |
| Newsletter confirmation requests | Links expire after 30 minutes; unconfirmed requests older than 7 days are removed when further requests are processed |
| Newsletter consent records | Up to 12 months; older confirmation records are removed when further requests are processed. Resend retains the mailing-list address while subscribed, and opt-out/suppression records to prevent unwanted sends |
| Account usage records | 24 months, and deleted with your account |
| Access log | A short fixed period set by our hosting plan, never more than 30 days. We do not extend the log or copy it elsewhere; the loads it records are kept separately, as your account usage records |
| Visitor counts | 90 days |
| Correspondence and submissions | Up to 24 months after the matter closes |
| Corrections and complaints | 6 years |
| Google Analytics | 14 months, the shortest setting that still allows a year-on-year comparison |
| Published material and the archive | Indefinitely |
You may ask us to give you a copy of your data, correct it, erase it, restrict or object to its use, and port it; and you may withdraw consent for analytics or the newsletter at any time. A copy or export includes your account usage records, and how we handle an objection to them is in section 2. Write to hello@axiom.vc; we answer within one month and there is no charge. Where the journalism exemption limits a right we will tell you we are relying on it and why, rather than simply declining.
If we get it wrong, please tell us — we would rather fix it. You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113) or to the supervisory authority where you live.
9. Security, and its limits
The site is served over HTTPS. Sign-in is passwordless, so there is no password of yours to lose; tokens are single-use and stored hashed. Card details never reach us. Access to the subscriber database is restricted and verified server-side.
No system is perfectly secure. If a breach is likely to risk your rights and freedoms we will tell the ICO within 72 hours of becoming aware, and tell you without undue delay where the risk to you is high. To report a security problem: hello@axiom.vc. We will not threaten you for reporting one in good faith.
10. Changes
The version and date at the top change with this policy. Where a change materially affects you we will say so on the Wire. Previous versions on request.