Privacy policy
What we collect, why we collect it, who else touches it, how long we keep it, and what you can make us do about it.
Last updated 29 October 2026
Who we are
Second Shadow Ltd is the data controller, the company that decides what happens to your personal data. We are registered in England & Wales, company number 17466353, with our registered office at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.
For anything about your data, email contact@secondshadow.com. For anything security-related, email security@secondshadow.com.
We are registered with the Information Commissioner's Office as a data controller, registration number ZC260396.
What this policy covers
This website, your SecondShadow account and sign-in, and billing. The records your company keeps inside a SecondShadow workspace (its customers, deals, quotes and so on) belong to your company: there, your company decides what happens to the data and we process it on its behalf, under our agreement with it.
What we collect
When you request access
Your name, work email address and a password you choose. You choose separately whether to receive marketing email; it is not a condition of requesting access. Your company's details come later, when you ask us for a workspace: see “If you become a customer” below.
If you joined before 22 October 2026, we may also hold what our earlier forms asked: your company, which CRM you used, roughly how big your team was, and, on the longer form, your job role, your industry and a note about what you needed.
When you have an account
Your email address and a hashed password. If you turn on two-factor authentication, the secret that makes it work. Sign-in times and session records.
If you set up a passkey, we store a public key, an identifier for it, the name of the app holding it (your password manager, usually) and when it was created. The private half never leaves your device. We do not collect, receive or store any biometric data. Your fingerprint or face unlocks the key on your own device; what reaches us is a signature, never a measurement of you. You can remove a passkey from your account at any time.
If you become a customer
Billing contact details, billing address, VAT number where you give one, and the plan you chose. If you add a card, you type it into a field served by our payment provider, Stripe, and it goes straight to them: your card number never reaches us. Your billing page shows the card's brand and last four digits, which it reads from Stripe when you open it; we do not store them.
From Stripe we also keep a record of your invoices: the amounts, whether each was paid, how many times a payment was tried and when it will be tried next, and, if a payment failed, Stripe's short reason code (such as “insufficient funds”). We also note whether a card is on file, yes or no. We keep these with our billing records.
If you book a demo
You book a demo on our own booking page, with or without an account. The name, work email, and any company and note you give us, with the time you pick, go from our server into our demo calendar, which Google hosts for us, and Google sends you the invite with a video link. If you are signed in, we fill in your name and email from your account; you can change either. Nothing on the page loads from Google. If you would rather Google were not involved, email us and we book the slot by hand.
If you join the mailing list
When you press Join on the mailing list button, on the home page or at the foot of any page, we keep your email address, when you asked, which of the two buttons you used, and the exact words you agreed to beside it, and we email you a link to confirm. You are on the list only once you press it. Until then we send you nothing else, and if you never confirm we delete your address 30 days after you asked.
When you confirm, we record when, send you a welcome with a link to unsubscribe, and tell our own team that you joined. After that we email you now and then with product updates, launch news and offers. Our email provider, Resend, sends them.
Every email from the list has a one-click unsubscribe link, and you do not need an account to use it. When you unsubscribe we keep your address marked as unsubscribed, with the date, as our record that we stopped; email us if you would like it deleted altogether. The mailing list is separate from any account you have with us, and unsubscribing from one leaves the other as it was.
Where you came from
If you agreed to analytics cookies, we record which campaign or website brought you to us the first time you visited: the campaign tags in the link, the site that referred you, and which page you landed on. We keep this against your account so we know which channels actually reach people like you.
Before you sign up, that information sits in a cookie on your own device for 90 days and we never see it. If you never sign up, it expires there. If you decline analytics cookies, none of it is collected at all.
When you visit the site
We count visits with SecondShadow's own web tracker, on our public pages (never on a page behind a sign-in), only if you agree to analytics in the cookie banner. Until you do, it does not run at all. Once you agree, it records the pages you visit, the site that sent you and how long each page was open, and keeps a random code in your browser so we can tell a return visit from a new one. Anything in the page address that looks like an email address or a token is removed, and so is everything after the ? except campaign tags. Withdrawing consent stops it and deletes the code.
With your agreement, when you submit a form that asks for your email address (the “Request access” box, the mailing list button or the contact form), it also passes us that email address, and your name if the form asked for it, as an enquiry. It never reads a password or anything else you type, and never reads the sign-in form. A person on our team decides what, if anything, becomes of an enquiry. The details are in the cookie policy.
If you play the game
The waitlist page ends on a small game. If you play it signed in, we keep your best distance, how many runs you have had, and the moments you jumped on your best run, against your account, so the game can replay that run as your shadow. The public leaderboard shows scores under made-up names that we derive from your account and that you cannot be identified from; nobody's real name, email or company appears on it. If you play signed out, your best score stays in your own browser, and reaches us only if you later sign in and open the game again. Scores are deleted with your account.
Our own staff can see your best distance and how many times you have played, next to your name on our internal signup list - it tells us how interested people on the waitlist are. They cannot see the recording of your run: that is kept so the game can draw your shadow for you, and nobody but you can read it.
Automatically
Our hosting and database providers log IP addresses and request details as part of running the service. We count sign-in and form attempts against a one-way hash of the identifier, so we can stop abuse without keeping a list of who tried what.
Why we are allowed to
| What | Basis |
|---|---|
| Creating and running your account | Performing our contract with you |
| The qualification questions at signup | Our legitimate interest in understanding who is asking for the product |
| Email about your own account | Performing our contract. Not marketing, so there is no opt-out; you cannot have an account and refuse the sign-in link |
| Marketing email | Your consent |
| Analytics and attribution cookies | Your consent |
| Recognising a return visit, with a code kept in your browser | Your consent |
| Counting visits with our own page counter | Your consent |
| Your email address from “Request access” or the contact form, as an enquiry | Your consent to analytics for passing it on; then our legitimate interest in replying to people who ask to hear from us |
| Invoices and tax records | A legal obligation we cannot waive |
| Security, rate limiting, audit logging | Our legitimate interest in not being defrauded |
Who else touches it
We use other companies to run the service. They act on our instructions and cannot use your data for their own purposes.
| Who | What for | Where |
|---|---|---|
| Supabase | Our database and sign-in system | London (UK) |
| Vercel | Hosting the website | Global, US company |
| Resend | Sending email. Ours goes out from mail.secondshadow.com | US |
| Cloudflare | DNS and protecting our staff console | Global |
| Analytics and tag management, only if you consent; the calendar demo bookings go into | US | |
| CookieYes | Recording your cookie choice | EU / US |
| Stripe | Taking card payments, subscriptions and invoices. Stripe also screens payments for fraud, and for that it decides for itself, under its own privacy policy | US / EU |
| Amazon Web Services | Running SecondShadow's own product, where what our page counter collects is kept | London (UK), behind a global delivery network |
| Sentry | Spotting errors and outages in SecondShadow's product. It sees technical details such as error messages, cleaned of names, email addresses, IP addresses, keys and amounts of money before they are sent, and never who you are, your cookies or what you typed | EU (Frankfurt, Germany), US company |
Your account and everything in it is stored in London. The substantive personal data does not leave the UK. Where a provider above is outside the UK, the transfer is covered by the standard contractual clauses and the UK addendum, or by the UK's data bridge with the US where the provider is certified under it.
The full list, including the companies the SecondShadow product uses to run your company's workspace, is on our sub-processors page.
We do not sell your data. We do not share it with anyone for their own marketing.
How long we keep it
| What | How long |
|---|---|
| Your account and everything attached to it | Until you delete the account |
| Where you came from | Deleted with the account |
| The mailing list | If you never confirm, 30 days after you asked. Otherwise while you are subscribed; after you unsubscribe, your address is kept, marked as unsubscribed, until you ask us to delete it |
| Invoices and tax records | Six years after the tax year. This outlives account deletion, because HMRC requires it |
| Our record of staff actions | Kept while we are trading |
| Analytics | 14 months |
| Our page counter's visit records | 13 months |
| An email address or name from a form, kept as an enquiry | Cleared 90 days after we have dealt with it, unless you become a contact of ours |
Worth saying plainly, because policies often skate over it: deleting your account does not delete your invoices. We are required to keep those.
What you can make us do
You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to how we use it, or ask us to send it elsewhere. Email contact@secondshadow.com and we will respond within one month.
Some of this is self-service and some is not, and we would rather say so than imply a button exists:
- Marketing email: turn it off in your account, or from the unsubscribe link in any marketing email. No sign-in needed for the link.
- Cookies: change your choice any time from the cookie settings on this site.
- Your account: email, password and passkeys are self-service.
- The qualification answers from signup have no edit screen yet. Email us and we will change them.
- A copy of your data has no download button yet. Email us and we will put one together.
If you want to complain
Tell us first, at contact@secondshadow.com or any other way you reach us. We will confirm we have it within 30 days, look into it properly, keep you told how it is going, and tell you what we found and what we did about it.
If you are still unhappy, or would rather not come to us, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. It is your right either way.
Cookies
Nothing but strictly necessary cookies is set until you agree. The detail is in the cookie policy.
Children
This is a business product and is not intended for anyone under 18. We do not knowingly collect data about children.
Changes
If we change this policy we will update the date at the top. If the change materially affects you, we will tell you rather than relying on you noticing.