Sequence

Privacy Policy

Last updated: 24 June 2026  |  Version 1.0

At Sequence, we take your privacy seriously. We know that the information flowing through a mortgage CRM is some of the most sensitive there is, and protecting it sits at the heart of everything we do.

Sequence is a software-as-a-service customer relationship management (CRM) platform built for mortgage advisers, designed to keep leads warm and stop opportunities going cold. This policy explains what personal data we collect, why we collect it, how we look after it, and the rights you have over it. It also explains the difference between the data we handle about our own customers and the data our customers store about their clients inside the platform - because our responsibilities differ in each case.

Please read this alongside any agreement you have with us and our Cookies Policy below.

1. Who we are

This platform and website are operated by Storyboard Digital Ltd (“Sequence”, “we”, “us” or “our”), a company registered in England and Wales.

• Registered company name: Storyboard Digital Ltd
• Company number: 16000472
• Registered address: Courtwood House, Sheffield City Centre, Sheffield, S1 2DD
• ICO registration number: 00011866253
• Privacy contact:Divya@legaci-ai.com

If you have any questions about this policy or about how we handle personal data, please contact us at Divya@legaci-ai.com.

2. Our role: controller and processor

Under UK data protection law, the responsibilities you have for personal data depend on whether you are a “controller” (you decide why and how data is used) or a “processor” (you handle data on someone else's instructions). Sequence wears both hats, depending on whose data we're talking about.

2.1 When we are the controller

We are the controller for personal data about our own customers and website visitors - for example, the mortgage advisers and firms who sign up to Sequence, the people who fill in our contact forms, and anyone browsing our website. This policy is the main place we explain how we use that data.

2.2 When we are the processor

When a mortgage adviser or firm uses Sequence to manage their own leads and clients, they are the controller of that client data, and we are the processor. We only handle that information on their instructions and in line with our agreement with them. If you are a client of one of our customers and want to know how your data is used, please contact that firm directly - they are responsible for it as the controller. We will, of course, support our customers in helping you exercise your rights.

3. Personal data we collect

The information we collect depends on how you interact with us. Here's a breakdown.

3.1 Account and customer data (we are the controller)

• Identity and contact details - name, business name, email address, phone number and job role.
• Account details - your login credentials, account settings and preferences.
• Billing and payment information - billing address and the details needed to collect payment (see section 6 on GoCardless).
• Communications - records of your correspondence with our support and sales teams.
• Usage and technical data - how you use the platform, IP address, device and browser information, and analytics data (see the Cookies Policy).

3.2 Client data within the platform (we are the processor)

When our customers use Sequence, they may input personal data about their own clients and leads. Depending on how they use the platform, this can include:

• Contact details of leads and clients (name, email, phone, address).
• Information relevant to a mortgage enquiry, such as financial circumstances, property details and application progress.
• Notes, communications and reminders recorded by the adviser.

We process this data strictly on our customers' instructions. We do not decide what client data is collected or why - that's the customer's responsibility as controller. Because mortgage enquiries can involve financial information, we apply strong safeguards to protect it (see section 8).

4. How and why we use your data

As controller, we use the personal data described in section 3.1 to:

• Set up, run and maintain your Sequence account.
• Provide the CRM service and its features, including lead tracking and reminders.
• Take payment for your subscription and manage billing.
• Provide customer support and respond to your questions.
• Send you service messages, such as updates about features, security or changes to our terms.
• Understand how the platform is used so we can improve it (using analytics tools described below).
• Send marketing about our own products where you've agreed to it or where we're otherwise permitted to - you can opt out at any time.
• Keep our service secure and prevent fraud or misuse.
• Comply with our legal and regulatory obligations.

5. Our lawful bases for processing

We only process personal data where the law allows us to. As controller, we rely on the following lawful bases:

• Contract - to provide the service you've signed up for and to manage our relationship with you.
• Legitimate interests - to run, secure and improve our business and the platform, in a way that doesn't override your rights and freedoms.
• Consent - for certain marketing and for non-essential cookies. You can withdraw consent at any time.
• Legal obligation - where we must process data to meet a legal or regulatory requirement, for example keeping financial records.

When we act as a processor for client data inside the platform, the lawful basis is determined by our customer as the controller.

6. Who we share data with

We do not sell your personal data. We do share it with trusted service providers (“sub-processors”) who help us run Sequence. Each is bound by contract to protect your data and use it only for the purposes we specify. Our key providers are:

We may also share personal data where we're legally required to - for example with regulators, law enforcement, or professional advisers - or in connection with a business sale or reorganisation, in which case any new owner would be bound by this policy.

7. Where your data is stored

Your data is hosted in the United Kingdom. We aim to keep personal data within the UK. Where any provider processes data outside the UK, we make sure appropriate safeguards are in place - such as UK “adequacy” regulations or the International Data Transfer Agreement - so your data receives the same level of protection.

8. How we keep your data secure

We take security seriously, especially given the financial nature of the data within the platform. Our measures include:

• Encryption of data in transit and at rest.
• Access controls so staff and systems only access data they need.
• Secure UK-based hosting infrastructure.
• Regular monitoring, backups and review of our security practices.

No system can be guaranteed completely secure, but we work hard to protect your data and to respond quickly if anything goes wrong. If a data breach is likely to affect your rights, we'll notify the ICO and, where required, you, in line with our legal obligations.

9. How long we keep data

We keep personal data only for as long as we need it for the purposes set out in this policy, or to meet legal and regulatory requirements. As a general rule:

• Account and customer data is kept for as long as you have an active account, and for a reasonable period afterwards.
• Billing records are kept for as long as required by law (typically at least six years).
• Client data within the platform is retained according to our customer's instructions, and deleted or returned when our agreement ends.

10. Your rights

Under UK data protection law you have a number of rights over your personal data. You can:

• Access - ask for a copy of the personal data we hold about you.
• Rectification - ask us to correct data that's inaccurate or incomplete.
• Erasure - ask us to delete your data in certain circumstances.
• Restriction - ask us to limit how we use your data.
• Portability - ask to receive your data in a portable format.
• Objection - object to certain processing, including direct marketing.
• Withdraw consent - where we rely on consent, you can withdraw it at any time.

To exercise any of these rights, email us at Divya@legaci-ai.com. If you're a client of one of our customers, please contact that firm directly, as they control your data - but we're happy to help them assist you. We'll respond within one month.

11. Cookies Policy

Cookies are small text files placed on your device when you visit a website. They help sites work properly and help us understand how our website and platform are used.

11.1 The cookies we use

• Essential cookies - needed for the website and platform to function, such as keeping you logged in. These don't require consent.
• Analytics cookies - set by Google Analytics (and, in future, PostHog) to help us understand usage and improve the service. These are only set where you consent.

11.2 Managing cookies

When you first visit our site, you can choose which non-essential cookies to accept. You can change your mind at any time through your browser settings or our cookie controls. Turning off some cookies may affect how the site works.

12. Children's data

Sequence is a business tool intended for mortgage professionals and is not directed at children. We do not knowingly collect data about anyone under 18 through our own services.

13. Changes to this policy

We may update this policy from time to time - for example, when we introduce new tools like PostHog. We'll post the latest version here and update the “last updated” date. Where changes are significant, we'll let you know directly.

14. Complaints

If you're unhappy with how we've handled your data, please get in touch at Divya@legaci-ai.com so we can put things right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk, though we'd appreciate the chance to help first.