Privacy Policy

Tenancy Agreement Service ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains what data we collect, how we use it, who we share it with, and your rights under UK data protection law.

Spring Incubator Ltd (company number 08582887, 44 West Broadway, Bristol BS9 4TB) is the data controller for the personal data we process. Our principal place of business is in the United Kingdom, and our processing is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What data we collect

Data you provide to us

When you contact us through the contact form, we collect: your name, your email address, the content of your message, and any other information you choose to include in your message. When you join the waitlist for legal document templates, we collect: your email address and (optionally) your name. When you purchase a legal document template (after launch), we collect: your name, billing address, and payment information processed by our payment provider (Stripe). We do not store full payment card details on our servers.

Data collected automatically

When you visit the site, our hosting provider and analytics tools collect technical information including: your IP address, browser type and version, device type, operating system, pages visited, time spent on pages, referring URL, and approximate location based on IP geolocation. This data is used in aggregated form to understand site usage and improve content.

We also use Vercel Web Analytics and Vercel Speed Insights, cookie-free services provided by our website host, Vercel Inc., acting as our processor. For each page view they record the page address, referring website, browser, operating system, device type, approximate location derived from your IP address and page-load speed. To count unique visitors, Vercel creates a one-way code from your request, including your IP address and browser details, which is valid for one day and discarded within 24 hours. Your IP address is not stored, and no cookies or cross-site identifiers are used. Legal basis: legitimate interest in understanding and improving the site (UK GDPR Article 6(1)(f)). Vercel processes this data in the United States under the UK Extension to the EU–US Data Privacy Framework, and visit counts are retained for 12 months. You can object at any time, free of charge, by switching off "Visitor counting" in Cookie settings or at Turn off visitor counting. We also honour the Global Privacy Control signal.

Cookies

We use a small number of cookies to make the site work and to understand how it is used. See our Cookies Policy for the full list and how to manage cookie preferences.

How we use your data

We use the data we collect for the following purposes, each on the legal basis indicated:

To respond to your enquiries — legal basis: legitimate interest in providing customer service.
To send you the templates and updates you have asked for — legal basis: consent (which you can withdraw at any time).
To process payments and deliver legal document templates — legal basis: performance of a contract with you.
To improve the site and our service — legal basis: legitimate interest in business improvement.
To comply with legal obligations — legal basis: legal obligation (e.g. tax records, accounting requirements).

Who we share your data with

We share data with the following categories of recipients:

Hosting and technical providers — our website hosting provider (Vercel, which also provides cookie-free visit counting) and email delivery provider, who process data on our instructions and have entered into appropriate data processing agreements.
Payment processor — Stripe, who processes payment information when you purchase a legal document template. Stripe's privacy policy is at stripe.com/privacy.
Analytics providers — we use Google Analytics in a privacy-respecting configuration with IP anonymisation enabled.
Legal authorities — where required by law, court order, or to protect our legal rights.

We do not sell, rent, or otherwise commercially share your personal data with third parties for their own marketing purposes.

How long we keep your data

We retain personal data only for as long as necessary for the purposes for which it was collected, plus any retention period required by law:

Contact form messages: 2 years from the date of your last contact, then deleted.
Waitlist email addresses: until you unsubscribe, plus a short reasonable period for record-keeping.
Customer records (post-launch): 6 years from the end of the calendar year of the transaction (HMRC accounting requirement).
Analytics data: retained in aggregated form indefinitely; individual identifiers deleted after 26 months in line with Google Analytics defaults.
Vercel visit counts: 12 months.

International transfers

Some of our service providers (notably Stripe, Google Analytics and Vercel) are based in the United States. Where data is transferred outside the UK, the transfer is protected by appropriate safeguards including the UK Addendum to the EU Standard Contractual Clauses or the Data Privacy Framework, depending on the recipient.

Your rights

Under UK data protection law you have the following rights in relation to your personal data:

Right of access — you can request a copy of the personal data we hold about you.
Right to rectification — you can ask us to correct inaccurate data.
Right to erasure — in defined circumstances, you can ask us to delete your data.
Right to restrict processing — in defined circumstances, you can ask us to pause processing.
Right to data portability — for data we process by automated means, you can ask for it in a portable format.
Right to object — you can object to processing based on our legitimate interests.
Right to withdraw consent — where processing is based on consent, you can withdraw consent at any time.
Right to complain to the ICO — you can complain to the Information Commission (ICO) at ico.org.uk about our handling of your data.

To exercise any of these rights, contact us through the contact form or by email. We respond to subject access requests within one month of receipt.

Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or damage. These include encrypted data transmission (HTTPS), secure password authentication for our admin systems, restricted access to personal data on a need-to-know basis, and regular review of our security practices. No data transmission over the internet is completely secure, but we take all reasonable steps to protect your data.

Changes to this policy

We review and update this Privacy Policy as our practices change. The "last reviewed" date at the top of the page shows when this policy was most recently updated. Significant changes will be communicated to waitlist subscribers and customers by email; minor changes will be reflected in the updated date.

Contact us about this policy

If you have questions about this Privacy Policy, the data we hold about you, or how to exercise your rights, contact us through the contact form. We aim to respond to privacy enquiries within 5 working days.