Privacy Notice

1. Who we are

Totem ("we," "us") is run by Stanley Matthews, trading as Totem, in the UK. We operate a networking community on Discord, an email newsletter, and associated paid services. Stanley Matthews is the data controller for everything described in this notice, except where section 6a says otherwise.

Totem’s team is Stanley Matthews, Adam Mokhtar and David Silva. All three can see the data described here, only to run Totem, and all three keep it confidential.

Contact for anything in this notice, including any request below: stan@totemcollective.org, or riggbiz on Discord.

2. What data we collect

• Name and email address (provided at signup or purchase)
• Newsletter signups: your email address, and your Discord username only if you choose to enter it in the form
• During our calls: your Discord username and profile picture, which calls you join, when you join and leave, how long you stay, and how many messages you send. We count messages, we never read or store what they say.
• Applications (to come on as a guest, to join Elusive, or to become a client): your name, email, Discord username, Instagram username or a link to your account if you give it, roughly how big your audience is, what you do or sell, and why you’re applying
• Whether you click a call’s booking link
• Notes we add about you, such as marking you as a good fit for something we sell
• Payment and transaction information (processed via Stripe; we do not store your full card details)

3. Why we collect it

• To send you the newsletter, where you've asked us to
• To answer "are you already in the Discord server?" when you give us a Discord username on the signup form. We check it once against the member list and store the yes/no answer so we don't have to ask you again
• To deliver the services you've paid for (e.g. call recordings, written summaries, warm lead identification)
• To see who gets the most out of the calls, so we, and that night’s guest, can follow up with the people who engaged most
• To improve turnout by identifying which times work best for members
• To communicate with you about your membership, or something you've bought from us

4. Legal basis

The newsletter runs on consent. We only email you because you ticked the box on the signup form, and we keep a record of when you did and which form you used. You can withdraw that consent whenever you like (see section 7), and withdrawing it is as easy as giving it was. We do not buy email lists and we never add anyone who didn't ask.

Paid services run on contract. We use your data because it's needed to deliver what you've bought.

Tracking calls runs on legitimate interests. Counting who comes to our calls, how long they stay and how many messages they send is how we run the community: it shows which times work, who keeps coming back, and who to follow up with. We think that’s a reasonable thing for a community to do with activity that happens in its own calls, and it’s why we only count messages rather than read them. You can object to it at any time (see section 7).

Ranking who engaged most is profiling, in a small way. We use it to decide who to follow up with and who goes on the guest’s shortlist. It never makes a decision with legal or similarly serious effects on you, and you can ask to be left out of it.

4a. Where your data is held

Our database is in London (Neon, on AWS). Everything else that handles your data:

• Vercel: runs this site and the Totem Analytics dashboard
• Railway: runs our Discord bot, which records call attendance
• Discord: where the community and calls live
• Resend: sends our emails
• Stripe: takes payments
• Google Forms: the guest application
• Tally: the Elusive and client applications, and the data agreement clients sign
• Microsoft: hosts our email inbox, so anything you email us
• OpenAI: only if a dashboard’s question box is switched on. It receives totals and reps’ names with what they’ve sold, never members’ usernames

Some of these are based in, or process data in, the US. Where data leaves the UK, it’s covered by the safeguards in their terms, such as the UK International Data Transfer Addendum. We don’t sell your data or send it anywhere else.

Cookies: signing in to the dashboard uses a cookie that keeps you signed in. We don’t use advertising or tracking cookies. The video on our homepage is played by Loom, which may set its own cookies when it loads.

5. Who we share it with

• Stripe (for invoices, refunds, and anything else)
• Your Discord username may be displayed on the clips we create
• Lena (our Discord bot) will know your Discord username
• The guest caller on a call you attend: we send them the usernames of everyone who attended, and a shortlist of up to three attendees ranked by how many minutes you spent in the voice channel and how many messages you sent, so they can follow up with the people who engaged most. They see your username and those two figures: nothing else, no email address, and nothing from any other call. If you'd rather not appear in that shortlist, tell us and we'll exclude you from it permanently (see section 7).
• Call recording may be shared with members of our paid community tier and you only, or as a one-time rare freebie to everyone
• The call thumbnail will have your name on it + whatever else you want us to put on it to attract members and potential leads

6. How long we keep it

• Newsletter: we keep your email address until you unsubscribe or ask us to delete it. When you unsubscribe we record the date and stop sending. We keep the address itself on a suppression list so that a later signup can't accidentally put you back on. If you'd rather be erased entirely instead, ask and we'll do that.
• Payment and transaction records are retained as long as legally required for tax purposes (HMRC recordkeeping).
• Call recordings and Lena data: if you want a recording or any Lena information deleted, tell us and we'll delete it.
• Applications: we keep them so we can look back at who’s applied and what we said. Ask and we’ll delete yours within 7 days.
• Call activity (attendance, time in calls, message counts, notes): we keep it while it’s useful for running the calls, mainly so we can see who keeps coming back. Ask and we’ll delete yours within 7 days.

6a. If you're a member of a server that uses Totem Analytics

Some Discord servers that aren't Totem's own use Totem Analytics, our events dashboard. That includes servers we build and run with a client. On those servers, the server's owner decides what's tracked and why, so they're the data controller. Totem handles the data for them, as their processor.

What gets recorded, during that server's calls:

• Your Discord username and profile picture
• Which voice calls you joined, when you joined and left, how long you stayed, and whether you'd marked yourself as interested beforehand
• How many messages you sent during a call. Never what they said: the bot counts messages, it doesn't read them
• Whether you clicked the call's booking link
• Notes the server's owner or their reps add, such as marking you as a good fit for something they sell, or logging that they booked you onto a call
• If you buy something and a rep logs it: the amount, what it was, and which rep sold it

Who can see it: the server's owner, anyone with Admin or Manage Server on that Discord, and reps the owner adds (reps don't see the owner's private notes or overall revenue). If Totem is running the server with its owner, Totem's team (Stanley Matthews, Adam Mokhtar and David Silva) can see it too. Nobody outside that server sees it.

Where it's held: in our database in London (Neon, on AWS), with the dashboard hosted on Vercel and our Discord bot on Railway. If the dashboard's question box is switched on, the totals it answers from, and reps' names with what they've collected, are sent to OpenAI to write the answer. Members' usernames are not sent.

How long we keep it: for as long as that server uses Totem Analytics. When the owner stops, or asks us to, we delete that server's data within 30 days.

Your rights: you have the same rights as in section 7. Because the server's owner is in charge of this data, it's usually quickest to ask them. You can also email us at stan@totemcollective.org. Tell us which server, and we'll work with its owner to get it done, including removing you from their dashboard.

7. Your rights

Under UK GDPR you have the right to access your data, have it corrected, have it erased, restrict or object to how we use it, and receive a copy in a portable format. Where we rely on consent (which is the whole basis for the newsletter), you can withdraw it at any time, and doing so does not affect anything we did before you withdrew it.

To get off the newsletter: click unsubscribe in any email we send. That's the fastest route and it takes effect immediately. You can also email us and we'll do it for you.

To stop us tracking your activity in calls: ask us. That’s your right to object, and we’ll stop and delete what we’ve recorded about you.

To stay out of the warm lead shortlist: ask us and we'll exclude you from it for good. You can still come to every call. You just won't be one of the names we pass to the guest caller. This is the "object to how we use it" right applied to the one thing in section 5 that goes to someone outside Totem.

For anything else: contact us on the details below. We action deletion requests within 7 days. Payment and transaction records are the one exception: those have to be kept for as long as HMRC requires.

If you think we've handled your data badly, you can complain to the Information Commissioner's Office through the ICO website. We'd rather you came to us first, but you don't have to.

8. Changes to this notice

We may update this notice from time to time. The version date at the top reflects the latest revision.