Last updated: 21 March 2026
This Privacy Policy explains how slopless.co.uk (“we”, “us”, “our”) collects, uses, stores, and protects personal data when you use our platform.
We are the data controller for the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018).
| Platform | slopless.co.uk |
|---|---|
| Contact | hello@slopless.co.uk |
| Data controller | The operator of slopless.co.uk |
When an account is created for you, we store:
Each time you log in, we record:
We retain the most recent 10 login entries per user. This information is used for security purposes (to detect unauthorised access) and is visible to platform administrators.
When you submit a Bulk Referral job, we store the following on our server:
Your original spreadsheet file is never uploaded to or stored on our server. Only the company names extracted from it are retained as part of the job record. Company names submitted via this tool are business data, not personal data, and are not subject to data subject rights under UK GDPR.
Search queries submitted via the Referral Finder are routed through our server to the Companies House API (this is necessary for rate limiting and API key security). However, no search queries or results from this tool are stored on our server. All results are processed in your browser session only.
When you use the Referrals Watcher tool, we store the following on our server in a per-user file:
This data persists for the duration of your account and is deleted when your account is removed. Your email address (if provided) is used solely to deliver Referrals Watcher alerts and is not used for any other purpose.
The Live Stream tool displays publicly available data sourced from the Companies House API. We do not store your SIC filter selections, keyword watches, or search activity from this tool beyond your current browser session. Presets and keyword sets you save are stored on the server and shared across your organisation.
When you use the click-to-copy feature to copy a company’s details from a stream, we log that action on our server so that platform administrators can monitor usage. Each log entry records your username, the business name and company number copied, which feed it was copied from, and the date and time. This log is retained up to a fixed number of most recent entries, after which older entries are overwritten, and is visible to platform administrators only.
When you use the Incorporation Digest tool, we store the following on our server in a per-user file:
Matched company data is cleared after each weekly compilation. Compiled result files are automatically deleted after 30 days. Your email address (if provided) is used solely to notify you when your weekly digest is ready.
When you use the Website Watcher tool, we store the following on our server in a per-user file:
Watched entries are automatically removed after 30 days. Discovered website results persist until you clear them manually. Your email address (if provided) is used solely to notify you when new websites are discovered and is not used for any other purpose.
When you visit the public landing page (slopless.co.uk), we record:
We retain the most recent 2,000 entries. Known bot and crawler traffic is excluded. This data is used for understanding how visitors find the site and is visible to platform administrators. Visits from logged-in users navigating within the platform are not recorded.
We may collect standard web server access logs (via nginx), which include IP addresses, request paths, and timestamps. These are used for security monitoring and service maintenance and are separate from the landing page analytics described above.
Our stream tools indicate whether a newly formed or established UK company has a public website and, where one is found, may display contact details taken from that publicly accessible website. These details are gathered automatically by visiting the company’s own website (its home page, contact page, and where present its “about” or “team” page) and can include:
This information is collected only from each company’s own publicly accessible website and from the public Companies House register. We do not attempt to guess, verify, or generate email addresses that a company has not itself published, and we do not send any message to a discovered address as part of this process. Where an email address relates to a named individual (for example a company director), it constitutes their personal data, and it is presented to our users to support legitimate business-to-business outreach. Individuals have the rights set out in section 8 in respect of this data. This information reflects what was publicly available on the relevant website at the time it was checked and may become out of date.
We use the data we collect for the following purposes:
We process your personal data under the following lawful bases:
| Data Type | Retention Period | Notes |
|---|---|---|
| Account credentials & permissions | Duration of account | Deleted on account removal |
| Login history (IP, location) | Last 10 entries per user | Visible to administrators |
| Referrals Watcher entries & alert history | Duration of account | Deleted on account removal |
| Alert email address (if provided) | Duration of account or until removed by user | Used for alert delivery only |
| Incorporation Digest preferences & accumulated matches | Duration of account; compiled results auto-deleted after 30 days | Matches cleared weekly after compilation |
| Website Watcher entries & discovered websites | Watched entries expire after 30 days; results persist until cleared by user | Deleted on account removal |
| Bulk Referral job files (input, results, preview) | 7 days from submission | Auto-deleted by the system |
| Landing page visit data (IP, referrer, device) | Last 2,000 entries | Older entries overwritten |
| Web server access logs | Up to 30 days | Used for security monitoring |
| Click-to-copy activity log | Most recent entries only (older entries overwritten) | Visible to administrators |
| Discovered business contact details (third-party companies) | Held while the company remains active in our stream tools; refreshed or aged out over time | Sourced from public websites and the public register |
The operators of slopless.co.uk have administrative access to the server and can view:
This access is used solely for platform operation, support, and security purposes.
Other users of the platform cannot see your Bulk Referral jobs, your Referrals Watcher entries, your Incorporation Digest preferences, your Website Watcher entries, your uploaded company lists, your search activity, or any of your personal account data.
Users within the same organisation share presets and keyword sets. These contain SIC code selections and keyword lists only — no personal data.
We do not sell, rent, or share your personal data with third parties for marketing or commercial purposes.
We may share data with third parties only in the following limited circumstances:
All company data displayed on the platform is retrieved from the Companies House public API. We do not transmit your personal data to Companies House.
If you enable email alerts in the Referrals Watcher, Incorporation Digest, or Website Watcher, notifications are sent via Resend (resend.com), a third-party transactional email service. Only your email address and the content of the notification are transmitted. Resend acts as a data processor under our instructions and does not use this data for its own purposes.
To determine approximate locations from IP addresses (for login history and landing page analytics), we query a third-party IP geolocation service. Only the IP address is transmitted for this lookup; no other personal data is shared.
We operate a public demonstration page that shows a limited, sampled selection of newly formed companies without requiring login. Where a row is revealed on this page, it may display information drawn from the public Companies House register, namely the company name and number, a director’s name, and the town from the registered or correspondence address. This information originates from the public register and is shown to demonstrate the service. Because this page can be accessed without an account and may be indexed by search engines, information shown on it should be regarded as publicly published. Only a small sampled fraction of companies is ever revealed on this page, and the remainder are obscured.
We take reasonable technical measures to protect your data, including:
We intend to implement additional measures including a dedicated non-root server user, UFW firewall configuration, and automated security updates. A full security hardening plan is in progress.
Under UK GDPR, you have the following rights regarding your personal data:
To exercise any of these rights, please contact us at hello@slopless.co.uk. We will respond within 30 days.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk if you believe your data has been handled unlawfully.
The platform uses:
We do not use advertising cookies, analytics cookies, or third-party tracking cookies. No cookie consent banner is required because the only cookies used are strictly necessary for authentication.
This platform is intended for business use only and is not directed at individuals under the age of 18. We do not knowingly collect personal data from children.
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this document. We encourage you to review this policy periodically.
Continued use of the platform after any changes constitutes acceptance of the updated policy.
If you have any questions about this Privacy Policy or how we handle your data, please contact us:
| hello@slopless.co.uk | |
| Website | slopless.co.uk |
This document was prepared on 21 March 2026 and reflects the data handling practices of slopless.co.uk at that time.