Privacy policy
What we collect, why we collect it, who else touches it, how long we keep it, and what you can make us do about it.
Last updated 18 August 2026
Who we are
Second Shadow Ltd is the data controller, the company that decides what happens to your personal data. We are registered in England & Wales.
For anything about your data, email contact@secondshadow.com. For anything security-related, email security@secondshadow.com.
We are in the process of registering with the Information Commissioner's Office.
What we collect
When you join the early-access list
Your name, work email address and company, and a password you choose. Optionally, which CRM you use today and roughly how big your team is. You choose separately whether to receive marketing email; it is not a condition of joining.
The longer application form, which also asks your job role, your industry and a free-text note about what you need, is not open at the moment. If it reopens, those three are the only additions.
When you have an account
Your email address and a hashed password. If you turn on two-factor authentication, the secret that makes it work. Sign-in times and session records.
If you become a customer
Billing contact details, billing address, VAT number where you give one, and the plan you chose. We do not hold your card number . When payments start, a payment provider will handle that and we will update this policy before it does.
If you book a demo
Demo bookings happen on a page behind your sign-in, through a calendar hosted by Google that loads only when you ask it to. The name, email and notes you type into that calendar go to Google directly and reach us as a calendar event; we deliberately do not pre-fill any of it. If you would rather Google were not involved, email us and we book the slot by hand.
Where you came from
If you agreed to analytics cookies, we record which campaign or website brought you to us the first time you visited: the campaign tags in the link, the site that referred you, and which page you landed on. We keep this against your account so we know which channels actually reach people like you.
Before you sign up, that information sits in a cookie on your own device for 90 days and we never see it. If you never sign up, it expires there. If you decline analytics cookies, none of it is collected at all.
Automatically
Our hosting and database providers log IP addresses and request details as part of running the service. We count sign-in and form attempts against a one-way hash of the identifier, so we can stop abuse without keeping a list of who tried what.
Why we are allowed to
| What | Basis |
|---|---|
| Creating and running your account | Performing our contract with you |
| The qualification questions at signup | Our legitimate interest in understanding who is asking for the product |
| Email about your own account | Performing our contract. Not marketing, so there is no opt-out; you cannot have an account and refuse the sign-in link |
| Marketing email | Your consent |
| Analytics and attribution cookies | Your consent |
| Invoices and tax records | A legal obligation we cannot waive |
| Security, rate limiting, audit logging | Our legitimate interest in not being defrauded |
Who else touches it
We use other companies to run the service. They act on our instructions and cannot use your data for their own purposes.
| Who | What for | Where |
|---|---|---|
| Supabase | Our database and sign-in system | London (UK) |
| Vercel | Hosting the website | Global, US company |
| Resend | Sending email. Ours goes out from mail.secondshadow.com | US |
| Cloudflare | DNS and protecting our staff console | Global |
| Analytics and tag management, only if you consent; the demo-booking calendar, only if you load it | US | |
| CookieYes | Recording your cookie choice | EU / US |
Your account and everything in it is stored in London. The substantive personal data does not leave the UK. Where a provider above is outside the UK, the transfer is covered by the standard contractual clauses and the UK addendum.
We do not sell your data. We do not share it with anyone for their own marketing.
How long we keep it
| What | How long |
|---|---|
| Your account and everything attached to it | Until you delete the account |
| Where you came from | Deleted with the account |
| Invoices and tax records | Six years after the tax year. This outlives account deletion, because HMRC requires it |
| Our record of staff actions | Kept while we are trading |
| Analytics | 14 months |
Worth saying plainly, because policies often skate over it: deleting your account does not delete your invoices. We are required to keep those.
What you can make us do
You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to how we use it, or ask us to send it elsewhere. Email contact@secondshadow.com and we will respond within one month.
Some of this is self-service and some is not, and we would rather say so than imply a button exists:
- Marketing email: turn it off in your account, or from the unsubscribe link in any marketing email. No sign-in needed for the link.
- Cookies: change your choice any time from the cookie settings on this site.
- Your account: email and password are self-service.
- The qualification answers from signup have no edit screen yet. Email us and we will change them.
- A copy of your data has no download button yet. Email us and we will put one together.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first, but it is your right either way.
Cookies
Nothing but strictly necessary cookies is set until you agree. The detail is in the cookie policy.
Children
This is a business product and is not intended for anyone under 18. We do not knowingly collect data about children.
Changes
If we change this policy we will update the date at the top. If the change materially affects you, we will tell you rather than relying on you noticing.