Privacy Policy – SpamSlap AI

1. Who We Are

SpamSlap AI is a product of FIXFLEX LTD, registered in England and Wales, company no. 08944523, registered office: 170 Connell Crescent, London, W5 3BP.

For your own account data we are the controller. For the messages that visitors send through your website's forms, you are the controller and we act as your processor (see section 10 of the Terms).

Contact: [email protected]

2. What Data We Collect

Customer data (you, our subscriber):

Name (optional), email address and website domain — for your account, API key and billing emails
Payment data — processed entirely by Stripe; we never see or store card details
API key and usage statistics (checks today, total checks, daily limit), your whitelist
At checkout, the time you asked us to start the service immediately (stored with your Stripe subscription)

Form submissions checked by SpamSlap (your website visitors):

What is checked: the sender's name, email address and full message are sent to our AI provider to classify the message. They are not kept by us in full unless the message is held for review (below).

Spam submissions: we log the sender's email address, the first 200 characters of the message, IP address, domain, AI result and rejection response, as evidence of the attack.

Genuine submissions: we log only metadata — time, domain, IP address and result. No email address, no message content.

Held messages: if the AI check cannot be completed, the full message (name, email, text, IP) is held in a moderation queue so it can be reviewed instead of being lost or delivered unchecked.

We never store passwords in plain text or any card or bank details.

3. How We Use Your Data

To provide spam detection, the whitelist and the moderation queue
To show your dashboard statistics
To send account emails (API key, billing and cancellation information)
To show anonymised spam examples in the public Hall of Shame (spammer emails are masked, e.g. s***@domain.com)
To keep the service secure and comply with legal obligations

Legal bases (UK GDPR): performance of our contract with you, our legitimate interests in preventing spam and abuse, legal obligations (tax records), and your consent for optional analytics cookies.

4. Data Retention

Spam and check logs: 90 days from creation, then automatically deleted
Held messages: until reviewed, then deleted automatically 90 days after they were received
Server logs with IP addresses: 90 days
Customer account data: duration of the subscription + 30 days after cancellation
Payment records: 7 years (UK tax and accounting requirement)

5. Your Rights (UK GDPR & Data Protection Act 2018)

You have the right to:

Access the personal data we hold about you
Request correction or deletion of your account and associated data
Export your data in a portable format
Restrict or object to processing of your personal data
Withdraw consent at any time

To exercise any of these rights, email us at [email protected]. We respond within one month. If you are a visitor to one of our customers' websites, you can also contact that website owner.

6. Third-Party Processors

Stripe — payment processing and the customer portal for managing or cancelling subscriptions. stripe.com/privacy
OpenRouter (United States) — AI routing. It passes the sender's name, email address and full message to Google's Gemini model, which classifies it in real time. OpenRouter states it does not use inputs for model training and uses Standard Contractual Clauses for international transfers. If OpenRouter is unavailable, a model running on our own server is used and nothing leaves our infrastructure. openrouter.ai/privacy
Google Analytics — only on our marketing pages, and only if you click "Accept" on the cookie banner. Not used in the dashboard. Google Privacy Policy
Cloudflare — DNS, CDN and security protection for our websites; it processes IP addresses to deliver and protect them

Transfers outside the UK rely on UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as offered by each provider.

We do not sell your data to anyone.

7. Cookies

The customer dashboard and admin panel use a session cookie for sign-in only; it expires when you close your browser.

Our marketing pages use Google Analytics cookies (_ga, _ga_<ID>, 2 years) only after you click "Accept". You can change your choice at any time with "Cookie Settings" in the footer. We do not use advertising cookies. More detail: FixFlex Privacy & Cookie Policy.

8. Contact & Complaints

For privacy questions or to exercise your rights:

FIXFLEX LTD
Registered in England and Wales, company no. 08944523
Registered office: 170 Connell Crescent, London, W5 3BP
[email protected]

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk