Privacy Policy

01What we collect

We only collect what we need to talk to you, bill you and produce your work.

• Contact and booking details. When you book an intro call, our scheduling provider (Cal.com) collects your name, email address, the time you choose and anything you write in the booking form, and shares it with us so we can hold the call.
• Payment and billing details. Subscriptions are processed by Stripe. You enter your card or other payment details directly with Stripe — we never see or store full card numbers. Stripe shares with us your name, email address, billing address (if provided), subscription status, invoices and limited payment method details such as card brand and the last four digits.
• Onboarding answers. After you subscribe, you complete a questionnaire — either embedded from Typeform or our own form. It asks for your name, email, company, website or social profile, the kinds of content and platforms you need, expected volume, references and brand guidelines, whether you’re an agency, your goals, how you heard about us and any notes. If you fill it in from the browser you checked out with, the answers are linked to your Stripe subscription.
• Attribution cookie. On your first visit we set one first-party cookie, sw_attr, for 30 days. It stores only campaign parameters from the link you arrived on (utm_source, utm_medium, utm_campaign, utm_term, utm_content), a referral code (ref), the domain of the website that referred you, the page you landed on and the date. It contains no advertising click IDs and no personal information, isn’t used to track you across other websites, and is attached to your checkout so we can see which campaigns lead to subscriptions. If your browser sends a Global Privacy Control signal, we don’t set it.
• Checkout security cookie. When you start checkout we set a second first-party cookie, sw_checkout, for 7 days. It holds only a random key (no personal information) that lets the browser you checked out with — and no one else holding your checkout link — see your welcome details and open billing from the confirmation page. It’s strictly necessary for that security check, so it’s set regardless of Global Privacy Control.
• Server logs. Like most websites, our hosting provider automatically records technical information when you visit — such as IP address, browser type, the pages requested and timestamps — to keep the site secure and running. Our own logs may also record Stripe reference numbers, statuses and amounts for billing events, but not your name, email address, messages or payment details. To limit abuse, we briefly count requests per network address; those counters store only a one-way hash of the address and expire within minutes.
• What you send us. Briefs, references, brand assets, feedback and messages you share while we work together.

The site does not run advertising trackers. We use Cloudflare Web Analytics to count visits: it doesn’t set cookies or track you across other sites, and we only see aggregate figures such as page views, referring sites, countries, device types and page-load speed. If we add another analytics service, we’ll update this policy first.

02How we use it

• To schedule and hold intro calls and reply to your messages.
• To set up and run your subscription: billing, receipts, failed-payment follow-up and account changes.
• To onboard you, set up your request board and produce the work you request.
• To produce deliverables: briefs, references and assets you share may be processed with third-party creative, editing and AI tools as part of our production pipeline.
• To understand, in aggregate, which channels and campaigns bring clients to Slopwell.
• To protect the site and our clients, prevent fraud and abuse, and meet legal, tax and accounting obligations.

03Who processes it

We don’t sell your personal information. We share it only with providers that help us run the service:

• Stripe — payments, subscriptions, invoices and the customer billing portal.
• Cal.com — scheduling intro calls.
• Typeform — the onboarding questionnaire, when we use the embedded version.
• Railway and Cloudflare — hosting, DNS and content delivery for the website, including server and security logs.
• Workflow, messaging and productivity tools we use internally to route onboarding answers and account notifications to our team and to manage your request board.
• Creative and AI software providers used to produce your requests.

Each provider processes data under its own terms and privacy policy. Some are based in, or process data in, the United States and other countries, so your information may be transferred outside the country where you live. We may also disclose information if required by law or to protect our rights and the safety of others.

04How long we keep it

• Billing records: for as long as your subscription runs and afterwards for as long as tax and accounting rules require.
• Onboarding answers, briefs and project files: for the length of our working relationship and a reasonable period after it ends, unless you ask us to delete them sooner.
• Booking details: for as long as they’re useful for following up on the call.
• The sw_attr cookie: expires automatically after 30 days.
• The sw_checkout cookie: expires automatically 7 days after your last checkout.
• Server logs: according to our hosting provider’s retention settings.

05Your choices and rights

Depending on where you live (for example, under the GDPR, UK GDPR or California law), you may have the right to access, correct, delete or export your personal information, and to object to or restrict certain uses. To make a request, contact us at [email protected]. We may need to verify your identity first, and we’ll keep records we are legally required to keep.

You can block or delete cookies in your browser settings at any time; the site works without the attribution cookie. Without the checkout security cookie you can still subscribe and manage billing through Stripe’s own billing login. You can update your payment method or cancel your subscription in the Stripe billing portal. If you believe we’ve mishandled your data, you can also complain to your local data protection authority.

06Security

We use reasonable technical and organizational measures to protect your information, and payment details are handled by Stripe rather than stored by us. No method of transmission or storage is completely secure, so we can’t guarantee absolute security.

07Children

Slopwell is a service for businesses and isn’t directed at children. We don’t knowingly collect information from anyone under 16.

08Changes to this policy

We’ll update this page when our practices change and revise the “last updated” date above. If a change is significant, we’ll let active clients know by email.

09Contact

Questions about privacy or this policy? Contact us at [email protected]. You can also read our terms of service.