Last updated: 10/07/2026
Effective: 10/07/2026
________________________________________
1. Introduction and who We are
This Agora Privacy Policy explains how Delphi Communications Ltd (“We”, “Us”, “Our”) processes personal data through Agora, an internal audience-research tool we operate. Delphi Communications Ltd is a company registered in England and Wales under company number 14735139, and is the data controller for personal data processed through Agora for the purpose of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This policy supplements, and should be read alongside, our main Privacy Policy. Where this policy conflicts with the main policy in relation to Agora, this policy governs for Agora. It is a standalone, Agora-specific policy because Agora processes a particular kind of personal data – the public content of Reddit users – that Our general website privacy policy does not address.
Questions, requests, and concerns about this policy or about data processed through Agora may be addressed to the Data Protection Officer, or to the day-to-day contact for Agora:
DPO: Ellie Thompson, Data Protection Officer, [email protected]
Day-to-day contact for Agora: John Crossley, Director, Digital and Content – [email protected]
2. What Agora is, and what this policy covers
Agora is an internal tool used only by our own team. It is not a public-facing product, it has no external user accounts, and members of the public do not sign up for or log into it. Its purpose is to help our analysts understand the public conversations and recurring questions within a defined set of public Reddit communities (subreddits), and to turn those into an internal research summary that informs the content and communication strategy work we carry out for our clients.
This policy covers the personal data Agora processes from Reddit through Reddit’s official Data API. It does not cover our general website, our client relationships, or our marketing activities, which are addressed in our main Privacy Policy.
3. Whose personal data we process
The individuals whose personal data is processed through Agora (“data subjects”) are Reddit users who have posted publicly in the subreddits an analyst has chosen to study. We do not process data about our website visitors or clients through Agora.
4. What personal data we process
Through Reddit’s Data API, Agora reads public content only from a defined, named set of subreddits. The data may include:
the text of public posts and comments;
• the contributing account’s username (e.g. u/example);
• public post and comment metadata – score/upvotes, number of comments, timestamp, flair, and the permalink (link) to the source content; and
• subreddit names.
We do not collect or process:
• private messages, direct messages, or any non-public content;
• account credentials, email addresses, or other contact details of Reddit users;
• any content behind authentication or from private/quarantined communities;
• data we know or believe to relate to children.
We do not set out to process special category data (Article 9 UK GDPR – such as data revealing health, political opinions, religious beliefs, sexual orientation, or racial or ethnic origin). Public Reddit posts may incidentally contain such information because users have chosen to publish it; where this occurs, we do not single it out, target it, or use it to build profiles of individuals, and We apply the safeguards in section 10.
5. Where the data comes from, and how We access it
All Reddit data processed by Agora is obtained directly from Reddit through Reddit’s official Data API, using authenticated, read-only OAuth access under credentials issued to Us by Reddit. Agora’s Reddit access is currently inactive: the tool is a prototype and will not access the Reddit Data API until Reddit has approved Our commercial data access. We do not scrape Reddit, use unofficial endpoints, browser session cookies, proxies, or third-party Reddit archives or data dumps. Agora performs no actions on Reddit – it does not post, comment, vote, message, or moderate. It only reads publicly posted content.
6. How and why We use the data, and Our lawful basis
We use Reddit content for a single purpose: internal audience research. Public posts and comments are passed to a third-party large language model (see section 7), which summarises recurring themes, questions, and pain points across a community. The resulting summary is an internal research brief that informs the content-strategy work We do for clients.
The content is used as input for analysis (inference) only. It is never used to train, fine-tune, or build any machine-learning or artificial-intelligence model, and is never added to any training dataset. This is both Our own commitment and a requirement of Reddit’s terms.
Lawful basis: We rely on Our legitimate interests(Article 6(1)(f) UK GDPR) in conducting market and audience research from publicly available sources to inform Our professional work. We have assessed that this processing is necessary for that interest and is not overridden by the interests or fundamental rights and freedoms of the data subjects, taking into account that: the data is already public; We process the minimum needed; We retain it only briefly; We do not use it to make decisions about, contact, profile, or re-identify individuals; and We do not use it to infer sensitive characteristics. A record of this assessment (a legitimate interests assessment) is held by Us and is available to the DPO on request. We do not rely on consent for this processing, and We do not process the data for direct marketing to the Reddit users concerned.
7. Who We share the data with (sub-processors)
We do not sell, license, publish, syndicate, or otherwise share Reddit content, or any raw dataset derived from it, with any third party for their own purposes. What We share externally is Our own derived analysis — research briefs summarising recurring themes, questions, and pain points, produced by Us to inform the content-strategy work We carry out for individual client organisations. Where such a deliverable reproduces short, attributed excerpts of public Reddit content (shown with a link to the source, the contributing username, and a “Source: Reddit” indicator), We include them only to the extent permitted under Our data access agreement with Reddit; where that permission is not in place, the deliverable contains Our derived findings only. To operate Agora We use a small number of service providers (“processors”), each acting on Our instructions under a written data-processing agreement:
Large language model provider — processes Reddit content to produce summaries (inference only) United States Processes data under its commercial/API terms, which provide that inputs are not used to train its models; transfer covered by appropriate safeguards (see section 8).
Hosts the Agora application and its data store Data stored in the EU (Europe region, EEA); provider US-headquartered Data store located in the EEA; access restricted; encryption at rest. Provider access covered by Standard Contractual Clauses / UK IDTA under a data-processing agreement.
Access-control and network layer in front of the application (authentication gateway) EU edge; provider US-headquartered Enforces single sign-on and transmits traffic to the application. Provider access covered by Standard Contractual Clauses / UK IDTA under a data-processing agreement.
Identity provider for single sign-on — authenticates Delphi staff who access Agora (staff credentials only; does not receive Reddit content) EU/UK tenant Processed under Delphi’s existing software agreement.
We may also disclose personal data where We are under a legal obligation to do so, or to establish, exercise, or defend legal claims, or as required to comply with a lawful request from Reddit (see section 11).
8. International transfers
Agora’s data store is located in the European Economic Area (EEA) – Our hosting provider holds the data in its Europe region. As Delphi is a UK controller, transfers from the UK to the EEA are covered by the UK’s adequacy regulations for the EEA.
Two further transfers are covered by appropriate safeguards:
1. The inference step (section 6) transfers the relevant public Reddit content to Our language-model provider, in the United States.
2. Our hosting and access-layer providers are US-headquartered, so although the data is stored in the EEA, those providers may access it from the United States.
Each of these transfers is made under an appropriate transfer mechanism – the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (or the IDTA) together with each provider’s contractual commitments – supported by a transfer risk assessment. No other routine international transfer of Reddit content takes place.
9. How long We keep it (retention)
We retain Reddit-derived data only for as long as it is needed for the relevant research, up to 30 days by default, after which it is automatically and permanently deleted. We minimise what We store, favouring source links and Our own derived findings over copies of Reddit content. We also delete data on request (see sections 10 and 11) and when We cease operating Agora.
Because stored content expires automatically within this short window, content that an individual later removes or deletes on Reddit, or that Reddit removes, is not retained or re-served by Us beyond that period. We do not maintain long-term copies of Reddit content.
10. Privacy safeguards
In addition to the limits above, We apply the following safeguards, which reflect both Our own standards and Reddit’s Responsible Builder Policy:
• We do not attempt to derive or infer sensitive characteristics about individuals (such as health, political affiliation, religious belief, or sexual orientation).
• We do not attempt to re-identify or de-anonymise individuals, and We do not match Reddit data with off-platform identifiers or other datasets.
• We do not use Reddit data for advertising targeting, for surveillance, for law-enforcement purposes, or to make automated decisions about individuals.
• Our analysis is directed at communities and themes, not at building profiles of identifiable individuals.
11. Security
We protect Reddit-derived data with industry-standard organisational and technical measures, including:
• read-only access to Reddit through Reddit’s official OAuth API;
• access to the Agora application restricted to authorised Delphi personnel, enforced by single sign-on access – there is no public or anonymous access to the application;
• restricted access to the underlying data store; and
• encryption of stored data at rest.
No method of transmission or storage is completely secure, but We take appropriate steps to protect personal data and to address any suspected security incident promptly, including notifying Reddit where a security incident affects Reddit data, as Our agreement with Reddit requires.
12. Your rights
Individuals have rights under UK data protection law in respect of personal data We hold about them, including the right to access it, to have it corrected, to request its erasure, to object to or request restriction of Our processing, and (where applicable) to data portability. Because We hold Reddit content only briefly and identify it by Reddit username and source link, We may ask for information to help Us locate the relevant content.
To exercise any of these rights, contact Our Data Protection Officer, Ellie Thompson, [email protected] or the day-to-day Agora contact at [email protected]. We will respond within the statutory time limit (normally one month) and will verify the identity of the person making the request before acting on it.
If a Reddit user asks Reddit, or asks Us, to remove their content, We will delete Our copy of that content. We also honour deletions and removals that occur on Reddit, as described in section 9.
You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk or by calling its helpline, though We would welcome the chance to address your concern first.
13. Reddit’s terms and attribution
Our access to and use of Reddit data is governed by Reddit’s Developer Terms, Data API Terms, User Agreement, and Responsible Builder Policy, and We operate Agora in compliance with them. Where Reddit content surfaces in Our internal outputs, We attribute it with the contributing username, a link back to the source content on Reddit, and a clear indication that the content is from Reddit. We will delete Reddit data at Reddit’s request and will cease processing it if Our access is withdrawn.
14. Children
Agora is not directed at children and We do not knowingly process the personal data of children through it. Reddit requires its users to be at least 13 years old (and older for certain content).
15. Changes to this policy
We may update this policy from time to time. We will post the revised version at this URL and update the “Last updated” date above. Material changes affecting how We process personal data will take effect from the date We publish them.
16. Contact
Questions, comments, and requests regarding this policy should be addressed to John Crossley at [email protected], or to Delphi Communications Ltd at the address on Our website. Concerns may also be reported to the Information Commissioner’s Office at ico.org.uk.