Spindlewise Privacy Policy
DRAFT v0.2 for legal review · not yet in force
| Item | Detail |
|---|---|
| Effective date | {Effective date} |
| Who we are | Yao Shuai, an individual trading as Spindlewise ("we", "us") |
| Privacy contact | [email protected] · Wenjiang District, Chengdu, Sichuan, China |
| Where data is stored | Singapore |
| Representative in the EU (Article 27 GDPR) | {EU representative name, address and email} |
| Representative in the UK (Article 27 UK GDPR) | {UK representative name, address and email} |
Written to follow the Australian Privacy Principles, the New Zealand Privacy Act 2020, the EU and UK General Data Protection Regulation, and Canada's Personal Information Protection and Electronic Documents Act. Placeholders in {braces} must be filled in. Review with a lawyer before publishing.
1. What this policy covers
This policy explains how we handle personal information (called "personal data" in the EU and UK) when you visit our website, sign up for or use the Spindlewise application, ask to get started, download a template, or contact us. Spindlewise is a business service for machine shops; we do not knowingly collect information from anyone under 18.
Our two roles. For account, website, support and billing information we decide how it is used: we are the "controller". Much of the personal information in Spindlewise is different: it is part of the data a shop puts into its workspace, for example contacts at its customers, quote requests a buyer sends through the shop's online form or Spindlewise email address, and a buyer's response to a quote. For that information the shop is the controller and decides what goes in and why; we handle it on the shop's behalf, as its "processor", under our Data Processing Addendum. If you are a buyer who sent a request to a shop, please contact that shop about your information; we will help them answer you.
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account details | Name, work email, business name, role in the workspace, password (stored only as a secure hash by our sign-in provider), two-step verification settings | You, when you sign up or are invited |
| Business details | Business number (such as ABN, NZBN, EIN, VAT or GST number), address, country, currency and tax settings | You |
| Customer Data that includes personal information | Names, emails and phone numbers of contacts at your customers and suppliers; names of your staff on job records; quote requests and attachments sent by buyers through your online form or Spindlewise email address; the name, email and purchase-order number a buyer gives when accepting or declining a quote | You, your Users, and buyers who contact you through Spindlewise |
| Usage and security records | Sign-in times, IP address, browser type, actions taken in the application (audit log), server logs, reports of errors in the web pages (error text, page address and browser, without form contents), anonymous website visit statistics, and, when you start a trial from our website, the first page you visited, the site that linked to it (domain only) and any campaign tags in its address | Automatically, when the website or application is used |
| Messages | Emails and feedback you send us; sign-up requests from our website (name, shop, work email, location, machines, how you quote today); the email you give to download our quote template, and whether you asked for occasional updates; notes from calls while you get started (with your agreement) | You |
| Billing details | Name, email, country, business tax number, Plan and payment status. Card details go to our payment provider and are not seen by us. | You and our payment provider |
Cookies and tracking. Our website sets no cookies and has no advertising or social-media trackers. We count visits with Cloudflare Web Analytics, which does not use cookies or identify individual visitors. To learn which pages lead to trials, the website remembers, for the current browser tab only, the first page you opened and the site that sent you, and passes them to the application when you start a trial; they are stored with your workspace and contain nothing that identifies you. Its fonts are served from our own domain. The application keeps your sign-in session in your browser's local storage, which is needed for the service to work; it does not use advertising cookies.
Trying model measurement on our website. If you drop a 3D model on our website to see it measured, the file is measured on our server and deleted as soon as the result is sent back to your browser; we keep neither the file nor the result. Your IP address is held in memory for up to an hour to limit how often the tool can be used. Please do not upload export-controlled technical data.
3. How we use it, and our legal basis
The legal basis column applies where the EU or UK GDPR applies. Elsewhere we use information for the same purposes, as the local law allows.
| Purpose | Legal basis (EU/UK) |
|---|---|
| Provide the Service: sign-in, workspaces, roles, calculations, quote PDFs, emails your workspace asks us to send (such as quote links and invitations), and support | Performance of our contract with you; for Customer Data, the shop's instructions under the Data Processing Addendum |
| Keep the Service secure: detect misuse, limit abuse of public forms, investigate incidents, keep audit records and logs | Our legitimate interest in a secure, reliable service |
| Service notices: trial and plan reminders, quote follow-up and weekly summary emails (which you can switch off in Settings), changes to terms | Performance of our contract; our legitimate interest in keeping you informed about your account |
| Reply to sign-up requests and questions | Steps you asked for before a contract; our legitimate interest in answering enquiries |
| Occasional product updates to people who asked for them | Your consent, which you can withdraw at any time |
| Bill paid Plans through our payment provider; keep tax and accounting records | Performance of our contract; legal obligation |
| Improve the Service and our website using aggregated or de-identified usage information, including visit counts and which pages lead to trials | Our legitimate interest in improving the Service |
| Meet legal obligations and respond to lawful requests | Legal obligation |
We do not sell personal information, and we do not share it for targeted advertising. We do not use Customer Data to train third-party AI models. Drawings and 3D models are read on our own server; if we add a feature that sends Customer Data to an AI provider, we will describe it here before it is switched on and it will be optional.
Spindlewise calculates costs and prices for the shop. It does not make decisions about individuals that have legal or similarly significant effects on them.
We send marketing emails only with the consent the law requires (for example under Canada's Anti-Spam Legislation and the UK and EU e-privacy rules), we identify ourselves in every message, and every message has a working unsubscribe link.
4. Who we share it with
We use the service providers below to run Spindlewise. They act on our instructions and may only use the information to provide their service to us.
| Provider | What they do | Where data is processed |
|---|---|---|
| Supabase, Inc. | Database and sign-in | Stored in Singapore (provider based in the USA) |
| Oracle Corporation (Oracle Cloud) | Runs the Spindlewise application; stores file attachments and backups | Singapore (provider based in the USA) |
| Cloudflare, Inc. | Hosts the public website and counts visits to it (without cookies), carries the encrypted connection to the application, and forwards email sent to our addresses (including quote requests sent to a shop's Spindlewise address) | Global network (provider based in the USA) |
| Resend, Inc. | Sends sign-in and service emails | USA |
| {Payment provider} | Seller of record for paid Plans: takes payment, charges and pays sales taxes, issues invoices. It handles payment details under its own privacy policy. | {Country} |
We will update this list before adding a provider that handles Customer Data, and give customers on a paid Plan at least 30 days' notice.
When a buyer sends a quote request or responds to a quote through Spindlewise, that information goes to the shop concerned. We may also disclose information if required by law, to protect someone's safety, or to a company we set up to operate Spindlewise (see clause 18 of our Terms of Service).
5. Where your information goes
Spindlewise data is stored in Singapore, for customers in every country we serve. If we move it, we will update this policy and tell customers before we do. Spindlewise is operated by an individual based in China, who may access account and Customer Data remotely, only when needed for support, maintenance or security. Some of our providers are based in the USA and may access data from there to run their services. The laws of these countries may allow government authorities to request access to information held there.
From the EU, UK and Switzerland. Singapore and China do not have an adequacy decision from the European Commission or the UK. For transfers from customers in these places to us, we use the European Commission's standard contractual clauses, with the UK Addendum for UK data, as set out in our Data Processing Addendum. For our providers we rely on the transfer safeguards in their own data processing terms (certification under the EU-U.S. Data Privacy Framework and its UK Extension where the provider holds it, otherwise standard contractual clauses). You can ask us for a copy of the relevant safeguards.
From Canada. Your information is processed outside Canada, as described above, and may be accessible to courts and authorities in those countries. Quebec customers: we will provide the information you need for your own assessment before you transfer personal information to us.
Wherever we access data from, we protect it the same way: encrypted connections, individual accounts with strong authentication, access limited to what the task needs, and records of administrative access.
6. How we protect it
- All connections are encrypted (HTTPS/TLS). Our database provider encrypts stored data.
- Each workspace is isolated in the database, and roles decide who can see costs and who can change data. Two-step verification is available to every user.
- Approved quote versions and audit records cannot be altered by users.
- We back up the database every night and delete each backup after no more than 35 days.
- We review access, keep software up to date, and test security rules automatically before each release.
If a breach is likely to cause serious harm or a risk to people's rights, we will notify the affected people and the regulators as the law requires (in the EU and UK, the supervisory authority within 72 hours of becoming aware where required), and tell affected customers without undue delay.
7. How long we keep it
| Information | Kept for |
|---|---|
| Account and Customer Data (including quote requests and buyer responses) | While the account is open, then 30 days for export, then deleted from the live system within a further 60 days. A shop can delete records sooner. |
| Backups | Deleted after no more than 35 days |
| Security, access and server logs | Up to 12 months |
| Error reports from web pages | 90 days after the error was last seen |
| Sign-up requests from our website | 12 months |
| Template download emails | 12 months, or until you unsubscribe if you asked for updates |
| Billing records | As long as tax and accounting law requires (usually 5 to 7 years) |
8. Your rights
Wherever you are, you can ask to see or correct personal information we hold about you by emailing [email protected]. You can unsubscribe from marketing emails at any time using the link in the email.
EU, UK and Switzerland. You also have the right to have your information erased, to restrict or object to how we use it (including an absolute right to object to direct marketing), to receive it in a portable format, and to withdraw consent at any time without affecting earlier use.
Canada. You can ask about how we use your information and who we have shared it with, and withdraw consent, subject to legal and contractual limits.
United States. We do not sell personal information or share it for targeted advertising. If a US state privacy law gives you rights over your information, we will honour requests made under it.
We may need to check your identity before acting on a request. We will respond within one month (EU and UK), 30 days (Australia and Canada) or 20 working days (New Zealand), and tell you if we need longer and why. If the information is part of a shop's workspace, we will pass the request to that shop and help them answer it.
9. Complaints
Please contact us first at [email protected]. We will acknowledge your complaint within 5 Business Days and aim to resolve it within 30 days.
If you are not satisfied, you can contact your privacy regulator: the Office of the Australian Information Commissioner (oaic.gov.au), the Office of the Privacy Commissioner in New Zealand (privacy.org.nz), the data protection authority in your EU country (edpb.europa.eu lists them), the UK Information Commissioner's Office (ico.org.uk), or the Office of the Privacy Commissioner of Canada (priv.gc.ca). In the EU and UK you can also contact our representative listed above.
10. Changes
We will post changes on this page with a new effective date. If a change materially affects how we use personal information, we will also email account Owners at least 30 days before it applies.