Privacy policy

Last updated: 7 September 2026

This policy explains what personal information spawncamp handles, where it comes from, and what you can do about it. We've tried to write it in plain English rather than legal boilerplate.

Who we are

spawncamp is operated by Completa of Derby, United Kingdom. We are the data controller for the information described below.

You can reach us at contactspawncamp@gmail.com.

Two different groups of people

We handle information about two separate groups, and the rules differ for each. Please read the section that applies to you.

If you create a spawncamp account

What we hold

• Your email address and verified account identifier, used to sign you in through Supabase Auth.
• Your subscription status, checked with Stripe; an account record may also hold the last observed plan.
• Hashed account or network identifiers and counters used to limit abuse; hosting and email providers may also maintain security logs.

We do not hold your card details. Payments are handled entirely by Stripe and we never see your card number.

Your search settings, notes and contact stages are stored in your own browser, not on our servers. Notes and stages are separated by signed-in account, but this is not encryption or protection from another person with access to the browser. Contact enrichment remains in the current page session. If you clear your browser data, they're gone and we cannot recover them.

Why we hold it

To provide your free or paid account — that's performance of a contract. IP-based rate limiting is a legitimate interest in keeping the service secure and available.

How long

Account records are kept while you maintain an account; you may contact us to request deletion. Financial records may be retained where required for tax and accounting. The scheduled cleanup removes application rate-limit records older than one day. Provider logs and financial records have separate retention periods.

If you're a company director whose details appear in spawncamp

What we show, and where it comes from

Most of this is company information rather than personal data. But we recognise that for a small company the registered office is often the director's home address, and the listed phone number is often a personal mobile. Where that's the case, it is personal data and we treat it as such.

Our lawful basis

We rely on legitimate interests — specifically, enabling businesses to make lawful business-to-business contact using information that is already published on a public register.

Public availability does not remove your data-protection rights. You can ask about our processing, challenge an association or object to your details being provided for contact research using the address above.

Why we haven't contacted you individually

Data protection law normally requires us to tell you when we obtain your information from somewhere other than you. Where information is drawn from a public register covering hundreds of thousands of companies, contacting each person individually would involve disproportionate effort. The law recognises this, and requires us instead to publish a clear public notice — which is this page.

Your rights

• Object to us holding your details. We will stop unless we have compelling grounds not to, and in practice we simply remove you.
• Access a copy of what we hold about you.
• Correct anything inaccurate. Note that we can't change the public register itself — for that, contact Companies House.
• Erasure of your details from our systems.
• Complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd rather you came to us first, but it's your right either way.

We respond within one month and there's no charge.

Who we share information with

The service makes research results available to users, including paid subscribers. We use the following providers to operate it:

Subscribers can export search results, which means information may pass to them. They agree in our terms to handle it lawfully and to follow direct marketing rules.

Cookies and tracking

We use no advertising cookies, no analytics and no tracking pixels. spawncamp stores a sign-in token and your own settings in your browser's local storage, which is strictly necessary for the service to function. That's why you won't see a cookie banner here.

Our pages load fonts from Google Fonts and an animation library from jsDelivr. Doing so reveals your IP address to those providers. If you'd rather avoid that, a content blocker will stop it and the site still works.

Security

All traffic is encrypted. API keys are held server-side and never reach your browser. Sign-in tokens are cryptographically signed and expire after one hour. Your email must be verified with a one-time code before ordinary account access is issued; active sessions periodically refresh their access. Sign-in attempts are rate limited. If a personal data breach occurs, we assess the risk and make the notifications required by law, including notifying the ICO where required within 72 hours where feasible, and affected people without undue delay where the risk is high.

Changes

If we change this policy meaningfully we'll update the date at the top and, for subscribers, email you.