Privacy Policy

1. Who we are

This Privacy Policy describes how DSA LTD ("Spodwise", "we", "us", "our") collects, uses, and protects your personal data when you visit spodwise.com or use our services.

Spodwise is operated by DSA LTD, a company incorporated in England and Wales under company number 14939682, with its registered office at (C/O) Salvares Jbs UK Ltd, Niddry Lodge, 51 Holland Street, London, England, W8 7JB. We are the data controller responsible for your personal data under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

Contact: hello@spodwise.com

2. What data we collect

Information you give us directly

• Email address — when you sign up for the waitlist or contact us
• Referral code — if you join via someone else's referral link

Information collected automatically

• Technical data — IP address, browser type, device type, operating system
• Usage data — pages visited, time spent, signup source
• Cookies — see Section 7 below

We do not collect: your name, phone number, payment information, precise location data, or any special category data (such as health, religion, or political beliefs).

3. How we use your data

We use your data for the following purposes:

• Service delivery — to send you waitlist confirmation, product updates, and launch notifications
• Communication — to respond when you contact us directly
• Product improvement — to understand how our website is used and improve user experience
• Legal compliance — to meet our legal and regulatory obligations

Legal basis (UK GDPR Article 6): We process your data based on your consent (when you submit your email) and our legitimate interests in operating and improving Spodwise. You can withdraw consent at any time by unsubscribing or emailing us.

4. Who has access to your data

We share your data only with the following third-party service providers, who process it solely on our behalf as our data processors:

• Resend (privacy policy) — sends our transactional and marketing emails
• Vercel (privacy policy) — hosts our website and serverless functions
• Upstash (privacy policy) — provides the Redis database backend
• Google Ireland Limited / Google LLC (privacy policy) — provides Google Analytics 4 for site analytics. Only activated with your explicit consent.

All providers have Data Processing Agreements in place and are bound to process data only on our instructions and in compliance with UK GDPR. We do not sell or rent your personal data to anyone, ever.

5. International data transfers

Some of our service providers process data outside the United Kingdom. When transferring data internationally, we ensure appropriate safeguards under UK GDPR, including:

• The UK International Data Transfer Agreement (IDTA), or
• The EU Standard Contractual Clauses with the UK Addendum, or
• The EU-US Data Privacy Framework (for transfers to certified US providers such as Google), or
• Transfers to countries with UK adequacy decisions (including the European Economic Area)

Your data is primarily stored on servers in the European Economic Area (Frankfurt, Germany and Dublin, Ireland), which the UK recognises as having adequate data protection. Google Analytics data may be processed in the United States under the EU-US Data Privacy Framework, with anonymization applied.

6. How long we keep your data

We retain your data:

• Waitlist data — until you unsubscribe or request deletion
• Email logs — up to 90 days for technical operations
• Analytics data — up to 24 months in aggregated form
• Records required by law — for as long as we are legally required to keep them (typically up to 6 years for tax records)

You can request deletion at any time by emailing hello@spodwise.com.

7. Cookies and tracking

We use two categories of cookies, both governed by your explicit consent shown in our cookie banner:

Essential cookies (always on, no consent required)

• Functional — remember your waitlist position, cookie consent choice, and session state
• Stored in your browser's localStorage. Not shared with third parties.

Analytics cookies (optional, requires your consent)

With your explicit consent, we use Google Analytics 4 (GA4), provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC. GA4 helps us understand how visitors use Spodwise so we can improve the product.

• Data collected: page views, session duration, traffic source, anonymized IP address, device type, browser, country (no city), and custom events (waitlist signup, signal view, outbound link clicks).
• IP anonymization: enabled (last octet of your IP is removed before storage).
• Data retention: 14 months in GA4, then automatically deleted.
• Cross-site tracking: none. We do not use Google Ads, Google Signals, or remarketing audiences.
• Personal identification: we do not link analytics data to personally identifiable information.
• Data transfer: data is processed by Google. As a US-based provider, Google relies on the EU-US Data Privacy Framework as legal basis for transfer.

How to opt out

• Decline at first visit: click "Reject non-essential" in the cookie banner.
• Change your choice later: click "Customize" in the cookie banner, or clear your localStorage in browser settings.
• Google opt-out browser add-on: install Google Analytics Opt-out Browser Add-on to disable GA tracking across all sites.
• Google's privacy policy: policies.google.com/privacy

We do not use: advertising trackers (Facebook Pixel, Google Ads tags, TikTok Pixel, LinkedIn Insight Tag), social media pixels, or any technology that tracks you across other websites. We comply with the UK Privacy and Electronic Communications Regulations (PECR) and UK GDPR.

8. Your rights under UK GDPR

You have the following rights regarding your personal data:

• Right of access — request a copy of your personal data
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure — request deletion ("right to be forgotten")
• Right to restrict processing — limit how we process your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — at any time, with no impact on past lawful processing
• Rights relating to automated decision-making — we do not make solely automated decisions about you

To exercise any of these rights, email hello@spodwise.com. We will respond within one month, as required by UK GDPR. We will not charge a fee unless your request is manifestly unfounded or excessive.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint. If you are based in the EEA, you can also contact your local supervisory authority.

9. Security

We use industry-standard security measures, including HTTPS/TLS encryption, secure password practices for our service providers, and access controls. However, no online service is 100% secure, and we cannot guarantee absolute security. If a personal data breach occurs that poses a risk to your rights, we will notify the ICO within 72 hours and inform affected users without undue delay, as required by UK GDPR.

10. Children's privacy

Spodwise is not directed at children. Our services are intended for adults aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to existing subscribers or a prominent notice on our website. The "Last updated" date at the top reflects the most recent version. Continued use of Spodwise after changes indicates acceptance of the updated policy.

12. Contact us

Questions, concerns, or requests about your data? Email us at hello@spodwise.com. We aim to respond within 2 business days for general queries, and within one month for formal data rights requests.

Data Controller:
DSA LTD
Company number: 14939682
Registered office: (C/O) Salvares Jbs UK Ltd, Niddry Lodge, 51 Holland Street, London, England, W8 7JB
Email: hello@spodwise.com