Privacy policy

Last updated: 20 October 2026

Who is responsible for your information?

Truffle Hound is operated by Zapfolder Ltd, company number 17015445, registered at 2nd Floor College House, 17 King Edwards Road, Ruislip, London, United Kingdom, HA4 7AE. We are the data controller for this website and its early-access list. Contact legal@zapfolder.com about privacy or your rights.

This policy covers trufflehound.io, our blog and early-access enquiries. It does not describe prospect-data processing in a separate Truffle Hound search or outreach service. Product-specific terms and privacy information will be provided when that service is offered to you.

What we collect and why

Early-access requests: your email address, the landing page you signed up from, submission time and, where supplied by the form, the version of the early-access notice. We use these to respond to your request, send relevant early-access invitations and understand which audiences are interested. Providing an email is optional, but we need it to contact you. Signing up does not create a paid account.
Correspondence: information you choose to send us when making an enquiry or exercising your rights.
Technical and security information: our hosting infrastructure processes connection information, including IP addresses, requested URLs, browser information and request times, to deliver and protect the website and diagnose failures.
Website analytics (with an opt-out): Ahrefs Web Analytics runs by default on public pages to measure page visits, referrals and interactions, with device, browser, language and approximate location information. It uses a daily pseudonymous visitor identifier. Ahrefs says it does not use analytics cookies, retain raw IP addresses in its analytics database or logs, or track the same visitor across days. Do not put personal information in a page URL.
CMS accounts: for authorised editors, we store account details, password hashes and information needed to administer content and secure access. Public visitors do not need a CMS account.

Our lawful bases

We rely on your consent for the early-access emails you request. We rely on legitimate interests to measure aggregate website use and improve our pages, answer enquiries, administer editorial access, understand interest in the service from signup source pages, and keep the website secure and reliable. Those interests are operating and improving our business website and preventing misuse. Where necessary, we process records to comply with legal obligations or establish, exercise or defend legal claims.

You can withdraw your consent or object to processing based on legitimate interests. For early-access emails, reply asking us to stop or contact legal@zapfolder.com. You can object to website analytics at any time using the settings on our Cookies and analytics page. Withdrawal does not affect processing that was lawful before you withdrew. We do not treat an early-access request as permission for unrelated promotional email.

Who receives information?

Authorised members of our team can access early-access requests. We use Amazon Web Services (AWS) for website hosting, database hosting, media storage and backups. Payload is the CMS software we operate on that infrastructure; this site does not use Payload Cloud. Our database, media bucket and backup bucket are in AWS's London region. The website also uses AWS's global content-delivery infrastructure.

Unless you opt out, your browser sends analytics events to Ahrefs Pte. Ltd. Ahrefs may also use aggregated data for its service improvements and studies. See Ahrefs' description of the collected data and its privacy policy. We do not send the contents of signup email fields to Ahrefs.

We may also share information with professional advisers or authorities where necessary for legal obligations, or with a successor if the relevant business is transferred. We do not sell the early-access list.

International processing

Although our primary database and storage are in London, providers may process some information internationally. Ahrefs' privacy policy describes processing in the United States, and AWS operates a global delivery network. Where a restricted transfer of personal information requires safeguards, the applicable provider arrangements must provide an adequacy basis or contractual safeguards, such as standard contractual clauses with the UK Addendum. Contact us for details of the safeguards applicable to your information.

How long we keep information

We keep early-access details while needed to manage your request and the early-access programme, unless you ask us to remove them sooner. Once the purpose ends, we review whether the information should be deleted or whether a separate lawful reason requires retention. Enquiry and security records are retained according to the time needed to resolve the matter, investigate misuse and meet applicable legal requirements. These criteria, rather than the availability of storage space, determine retention.

Backups are restricted to recovery and are not used as an active mailing list. A deletion request is applied to active records; we also assess affected backup copies and ensure a restoration does not reinstate a withdrawn signup for active use. Analytics statistics are managed separately in Ahrefs. Your analytics preference remains in this browser until you change it or clear browser storage.

Your rights and complaints

Depending on the circumstances, you can ask for access, correction, deletion, restriction or portability of your personal information, and you can object or withdraw consent as described above. Contact legal@zapfolder.com. We may need to verify your identity and will respond within the period required by applicable law, normally one month.

You can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint, or to your local data-protection authority where applicable. This website's early-access signup does not make solely automated decisions that have legal or similarly significant effects on you.

Security, children and changes

We use HTTPS, restricted CMS access, encrypted database connections and private object storage. No online service can guarantee absolute security. The website is intended for adults using it for business purposes, not children. If you believe a child has submitted information, contact us so we can address it.

We will update the date above when this policy changes and provide additional notice where a material change requires it. See also our Website terms and Cookies and analytics policy.