Privacy Policy – SpamSlap AI

1. Who We Are

SpamSlap AI is a product of FixFlex LTD, registered in England and Wales.

Contact: [email protected] · West London, UK

2. What Data We Collect

Customer data (you, our subscriber):

Email address — for account registration and billing communications
Payment data — processed entirely by Stripe; we never store card details
API key and usage statistics (checks today, total checks, daily limit)

Operational data — spam detection logs:

Spam submissions: email address of the spammer, first 200 characters of the message, IP address, domain, AI classification result and rejection response. Retained as evidence of attack.

Legitimate submissions: we store only metadata — timestamp, domain, IP, and classification result. No email address. No message content.

We do NOT store:

Full message content of any submission
Email addresses of people who sent legitimate messages
Passwords (hashed only, never plaintext)
Credit card numbers or banking details

3. How We Use Your Data

To provide the spam detection service
To display your dashboard statistics
To send account emails (API key delivery, billing receipts)
To improve spam detection accuracy
To comply with legal obligations

4. Data Retention

Spam logs: 90 days from creation, then automatically deleted
Customer account data: duration of subscription + 30 days after cancellation
Payment records: 7 years (UK legal requirement)

5. Your Rights (GDPR & UK Data Protection Act 2018)

You have the right to:

Access the personal data we hold about you
Request deletion of your account and associated data
Export your data in a portable format
Object to processing of your personal data
Withdraw consent at any time

To exercise any of these rights, email us at [email protected]. We respond within 30 days.

6. Third-Party Processors

Stripe — payment processing. Data processed under Stripe's privacy policy: stripe.com/privacy
OpenRouter / Google Gemini — AI classification. Message previews (first 200 chars) are sent for real-time classification only. OpenRouter does not permanently store submitted messages. See: openrouter.ai/privacy

We do not sell your data to anyone.

7. Cookies

We use session cookies only for authentication in the customer dashboard and admin panel. These cookies contain no personal data and expire when you close your browser.

We do not use tracking cookies, advertising cookies, or any third-party analytics.

8. Contact & Complaints

For privacy questions or to exercise your rights:

FixFlex LTD
[email protected]
West London, UK

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk