Privacy policy
Controller: [[trading name]], United Kingdom. Contact: contact@spatialsites.co. ICO registration: [[ICO number]]. Last updated: 29 September 2026.
What we collect. Email address, name if provided, Instagram username if you arrived through an Instagram message, purchase records, download and credit history, licence keys, the source link you arrived from, a salted hash of your IP address and your browser type for fraud prevention and rate limiting, and email delivery events (delivered, bounced, clicked). We do not track whether you open our emails.
Why. To deliver kits you request, manage your account and licences, prevent abuse of free downloads, process payments through Stripe, send transactional emails, and, where you have claimed a free kit or purchased, send occasional emails about new kits. You can unsubscribe from marketing at any time with the link in every email.
Legal bases. Contract (delivering what you asked for), legitimate interests (fraud prevention, product emails to existing customers and claimants under the soft opt-in), legal obligation (tax records), consent where we ask for it.
Processors. Supabase (database and authentication), Vercel (hosting), Cloudflare (file storage for kits and demos), Stripe (payments), Twilio SendGrid (email), ManyChat (Instagram messaging), GitHub (code). Each processes data under its own agreement with us.
Cookies and storage. We use only strictly necessary cookies, to keep you signed in. Your browser also stores which kits you have liked, so the button stays pressed; nothing is sent to us from that. We do not use analytics or advertising cookies.
Retention. Account and purchase records for six years for tax purposes. Free claim records for as long as the free kit programme runs. Newsletter sign-ups are only added once you confirm by email. Marketing emails stop when you unsubscribe; we keep a suppression record so we do not email you again. Rate limiting records are deleted after two days.
Your rights. Access, correction, deletion, restriction, portability and objection. Email us and we respond within one month. You can complain to the ICO at ico.org.uk.
International transfers. Some processors operate outside the UK. Transfers rely on the UK International Data Transfer Agreement or adequacy regulations.
Children. The service is for people aged 18 and over.