Privacy Policy
The short version
- We collect only what we need to sell and deliver Ship Weekend: your contact details, order details, the project access you give us, and newsletter signups.
- Card payments are handled by Stripe. We never see or store your full card number.
- We ask for least-privilege access to your accounts, store any keys encrypted, use them only to deliver your order, and delete them once the job is done.
- We don't sell your data and this website doesn't set tracking cookies.
- You can ask to see, fix or delete your data any time: [Contact email].
1. Who we are
Ship Weekend is a trading name of [Company legal name], a company registered in [England and Wales] under company number [Company number], with its registered office at [Registered address] ("we", "us", "our").
For personal data described in this policy we are the controller under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018. Our ICO registration number is [ICO registration number].
Contact us about privacy at [Contact email] or by post at the address above.
2. What we collect
Information you give us
- Contact and account details: name, email address, and optionally your company name and social handle.
- Order details: which plan you bought, when, how much you paid, your billing country and VAT details if relevant, and your Stripe customer and payment IDs.
- Project information: your app's URL, repository link, a description of what it does, and the messages you send us.
- Access you grant us: invitations to your code repository and hosting team, restricted API keys (for example a Stripe restricted key), and DNS or domain settings. See section 4.
- Newsletter signups: your email address and when and how you subscribed.
Information collected automatically
- Server logs: our website host keeps standard technical logs (IP address, browser type, pages requested, time) for security and to keep the site running.
- Free Quick Check: when you use the free Quick Check tool, we process the URL you enter and your IP address (to prevent abuse with rate limits). Results are cached for up to 10 minutes so repeat checks are fast; we don't keep a database of URLs checked or link them to you.
- Analytics: if we enable analytics, we use a privacy-friendly, cookie-free tool that reports aggregate statistics (see section 10).
Information from others
- Stripe tells us whether your payment succeeded and gives us basic billing details. It does not give us your full card number.
3. How and why we use it
| Purpose | Data | Lawful basis (UK GDPR) |
|---|---|---|
| Taking payment and delivering your Launch Check, Launch Kit or Keep-Live plan | Contact, order, project and access data | Contract (Art. 6(1)(b)) |
| Talking to you about your order and support requests | Contact, project data, messages | Contract (Art. 6(1)(b)) |
| Keeping accounting and tax records | Order and billing data | Legal obligation (Art. 6(1)(c)) |
| Sending the "Patch notes" newsletter | Email address, signup record | Consent (Art. 6(1)(a)). Withdraw any time with the unsubscribe link. |
| Sending service emails to existing customers about similar services | Email address | Legitimate interests (Art. 6(1)(f)) and the PECR "soft opt-in". You can opt out at any time. |
| Running the free Quick Check and rate-limiting it to prevent abuse | URL you enter, IP address | Legitimate interests (Art. 6(1)(f)) |
| Keeping the website and our systems secure, preventing fraud and abuse | Logs, order data | Legitimate interests (Art. 6(1)(f)) |
| Improving our service, checklists and agents (using aggregated or de-identified information) | Order and project metadata | Legitimate interests (Art. 6(1)(f)) |
| Publishing a case study about your launch | Name, app name, quotes you approve | Consent (Art. 6(1)(a)). We only do this with your permission. |
| Handling legal claims | Any relevant data | Legitimate interests (Art. 6(1)(f)) |
We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.
4. Your code, keys and account access
To launch your app we need access to some of your accounts. Here's how we handle it:
- Least privilege: we ask for the narrowest access that works, such as an invitation to a single repository, a restricted Stripe key with only the permissions we need, and a team invite on your hosting platform. We never ask for your passwords and you should never send them.
- Encrypted storage: keys and tokens you give us are stored encrypted in a secrets manager, never in email, chat logs or source code. Secrets your app needs are placed in your hosting provider's environment variables, not committed to your repository.
- Limited use: we use access only to deliver the service you ordered. Changes to your code are made as a pull request you can review.
- AI agents: our AI agents read and modify your code to do the work. Code and configuration may be sent to the AI model providers listed in section 6 under terms that do not allow them to train their models on your data. We don't send your secret keys to AI model providers.
- Handover and deletion: when the job is finished we send you a list of every access we used so you can revoke it. We delete stored keys within [7] days of completion and working copies of your code within [30] days, unless you're on Keep-Live, in which case we keep the access the plan needs until you cancel.
5. Your app's end users
Your app, database or analytics may contain personal data about your own users. When we handle that data while working on your project, we do so as your processor, only on your instructions and only to deliver the service. The data processing terms are in section 16 of our Terms of Service. You remain the controller and are responsible for your app's own privacy notice and lawful basis.
6. Who we share it with
We don't sell your personal data. We share it only with service providers who help us run Ship Weekend, under contracts that require them to protect it:
| Provider | What they do | Location |
|---|---|---|
| Stripe Payments Europe Ltd / Stripe, Inc. | Payment processing, invoicing and subscriptions. Stripe acts as our processor, and as an independent controller for some purposes such as fraud prevention and regulatory compliance. See Stripe's privacy policy. | Ireland / USA |
| [Newsletter provider] | Sending the "Patch notes" newsletter and managing subscriptions (processor). | [Location] |
| [Website host, e.g. Vercel / Netlify / Cloudflare] | Hosting this website and its logs (processor). | [Location] |
| [Email provider] | Business email (processor). | [Location] |
| [AI model providers] | Powering the AI agents that audit and change your code (processor, no training on your data). | [Location] |
| [Secrets manager] | Encrypted storage of keys and tokens you give us (processor). | [Location] |
| [Analytics provider, if used] | Cookie-free, aggregate website analytics (processor). | [Location] |
We may also share data with professional advisers (accountants, lawyers), with authorities when the law requires it, or with a buyer if our business is sold, in which case this policy would continue to apply.
7. International transfers
Some providers are based outside the UK, for example in the USA. Where personal data is transferred outside the UK we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or the ICO's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, together with any extra safeguards needed.
8. How long we keep it
- Stored keys and tokens: deleted within [7] days of completing your order (or when you cancel Keep-Live).
- Working copies of your code: deleted within [30] days of completion (or when you cancel Keep-Live).
- Order, invoice and payment records: 6 years from the end of the financial year they relate to, as required for UK tax purposes.
- Support messages and handover reports: [2 years] after your last order, so we can help with follow-up questions.
- Newsletter: until you unsubscribe. After that we keep a minimal suppression record so we don't email you again.
- Server logs: according to our host's standard retention, typically no more than [30] days.
9. Security
We use encryption in transit and at rest, multi-factor authentication on our accounts, least-privilege access, and logging of who accessed what. No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will tell you and the ICO as the law requires.
10. Cookies and analytics
This website does not set advertising or tracking cookies. If we use analytics, we use a cookie-free tool that counts visits in aggregate without identifying you. If we ever add non-essential cookies, we will ask for your consent first, as required by the Privacy and Electronic Communications Regulations (PECR). When you pay, you're taken to Stripe's checkout, which sets its own cookies for security and fraud prevention under Stripe's policies.
11. Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased in certain cases;
- restrict or object to certain processing, including direct marketing (always);
- data portability for data you gave us under contract or consent;
- withdraw consent at any time, without affecting earlier processing.
To use any of these rights, email [Contact email]. We'll reply within one month. It's free unless a request is clearly unfounded or excessive.
12. Children
Ship Weekend is for people aged 18 and over. We don't knowingly collect data from children.
13. Changes to this policy
We may update this policy as the service changes. We'll change the "last updated" date above and, for significant changes, email customers and subscribers.
14. Contact and complaints
Email [Contact email] or write to [Company legal name], [Registered address]. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We'd appreciate the chance to sort it out first.