Privacy Policy

1. Introduction

Hillway Property Consultants (trading as Spotter AI) ("we", "us", or "our") is a property consultancy based in Sheffield, United Kingdom (Company Number: 14319867). We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Spotter AI at www.spotterai.uk (the "Service"), our AI-powered business intelligence platform for property professionals.

By using our Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use our Service.

2. Information We Collect

2.1 Information You Provide Directly

When you register and use our Service, you provide:

• Account Information: Full name, email address, password (encrypted), company name, and job title
• Business Profile Data: Company description, services offered, target sectors, geographic focus, certifications, notable clients, and business preferences
• Payment Information: Billing details including company address and VAT number (if applicable). Payment card details are collected and processed directly by Stripe - we never store your full card numbers
• Notification Preferences: Email addresses for notifications, Slack webhook URLs if you choose to integrate
• Feedback Data: Your ratings and feedback on opportunities presented to you
• Communications: Any correspondence when you contact us for support, enquiries, or enterprise sales

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, opportunities viewed, actions taken, search queries performed, and time spent on the platform
• Device Information: Browser type and version, operating system, screen resolution, IP address, and general location (city/region level)
• Technical Data: Session data, timestamps, error logs, and performance metrics
• Cookies: Essential cookies for authentication and session management, and analytics cookies (only with your consent)

2.3 Information from Third Parties and Public Sources

• OAuth Providers: If you sign in with Google, we receive your name, email address, and profile picture
• Companies House: Company information for auto-completing business profiles during onboarding
• Public Data Sources: Our AI processes publicly available information from UK Government tender portals (Find a Tender, Contracts Finder, Public Contracts Scotland, Sell2Wales), property news sources, planning applications, EPC registers, and Land Registry data to identify relevant business opportunities
• Web Search Results: Publicly available information about companies and opportunities gathered via web search APIs

3. How We Use Your Information

We process your personal data for the following purposes:

3.1 To Provide the Service (Contract Performance)

• Create and manage your account
• Authenticate your access to the platform
• Process your subscription payments via Stripe
• Deliver the core service features you have subscribed to

3.2 To Deliver AI-Powered Business Intelligence (Contract Performance)

• Search and aggregate publicly available business opportunities relevant to your business profile
• Use AI (Anthropic Claude) to analyze and score opportunities based on your preferences
• Generate personalized business insights and recommendations
• Create draft outreach communications and action recommendations
• Build a knowledge graph of companies, people, and relationships relevant to your business
• Monitor regulatory changes and market trends that may create opportunities

3.3 To Improve Our Service (Legitimate Interest)

• Learn from your feedback (thumbs up/down) to improve opportunity scoring for your organization
• Analyze usage patterns to understand which features are most valuable
• Identify and fix technical issues
• Develop new features based on user needs

3.4 To Communicate with You (Contract Performance & Legitimate Interest)

• Send weekly or bi-weekly digest emails of opportunities
• Deliver notifications via email or Slack (if configured)
• Respond to your support requests and enquiries
• Send important service updates and security notices
• Send optional product updates and tips (with your consent, which you can withdraw at any time)

3.5 To Manage Billing and Subscriptions (Contract Performance)

• Process subscription payments
• Issue invoices and receipts
• Manage plan upgrades, downgrades, and cancellations
• Apply discount codes and handle billing enquiries

3.6 To Comply with Legal Obligations (Legal Requirement)

• Maintain accounting records as required by UK tax law
• Respond to lawful requests from law enforcement
• Enforce our Terms of Service
• Detect and prevent fraud and abuse

4. Legal Basis for Processing (UK GDPR)

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following legal bases:

• Contract Performance: Processing necessary to provide the Service you have subscribed to (Articles 6(1)(b))
• Legitimate Interest: Processing necessary for our legitimate business interests, such as improving the Service, preventing fraud, and ensuring security (Article 6(1)(f))
• Legal Obligation: Processing required to comply with UK laws, such as tax and accounting regulations (Article 6(1)(c))
• Consent: For optional marketing communications and non-essential analytics cookies (Article 6(1)(a))

5. AI Processing and Third-Party Services

5.1 Anthropic Claude (AI Processing)

We use Anthropic's Claude AI models to analyze opportunities, generate insights, and create draft outreach content. When we send data to Anthropic:

• We send: opportunity descriptions, your business profile, and feedback data
• Anthropic processes this data solely to provide the AI service to us
• Anthropic does not use your data to train their general AI models
• Data sent to Anthropic is processed in accordance with their Privacy Policy
• We use prompt caching to minimize data transmission and processing

5.2 Supabase (Database and Authentication)

We use Supabase for secure data storage, user authentication, and backend infrastructure:

• Data is stored in EU/UK data centers
• All data is encrypted at rest (AES-256) and in transit (TLS 1.3)
• Row-level security ensures your data is isolated from other users
• Regular automated backups are maintained
• Supabase's Privacy Policy applies to their processing

5.3 Stripe (Payment Processing)

We use Stripe to process subscription payments securely:

• Stripe is PCI DSS Level 1 certified
• We never store your full credit card numbers - Stripe handles this securely
• We store only: billing name, address, last 4 digits of card, and payment status
• Stripe's Privacy Policy applies to payment processing

5.4 Tavily (Web Search)

We use Tavily's search API to find publicly available business opportunities:

• We send: search queries based on your business profile
• Tavily returns: publicly available web content and news articles
• No personal user data is sent to Tavily

5.5 Other Services

• Resend: Transactional email delivery (magic links, password resets, digest emails)
• Vercel: Website hosting and edge computing infrastructure
• Sentry: Error monitoring and performance tracking (anonymized)
• Google OAuth (optional): If you choose to sign in with Google
• Slack (optional): If you configure Slack notifications, we send opportunity digests to your webhook URL

5.6 AI Feedback Learning

Your feedback (thumbs up/down on opportunities) helps improve relevance scoring for your organization only. We do not:

• Use your feedback to train general AI models
• Share your feedback or data with other customers
• Use your data for advertising purposes

All feedback learning is organization-specific and keeps your business intelligence private.

6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data. We share your data only in the following limited circumstances:

6.1 Service Providers

We share data with trusted third-party service providers who help us deliver the Service (listed in Section 5 above). These providers are contractually bound to:

• Process data only on our instructions
• Implement appropriate security measures
• Not use your data for their own purposes
• Comply with UK GDPR requirements

6.2 Within Your Organization

If you are part of a multi-user organization subscription, other members of your organization can see:

• Opportunities discovered for your organization
• Business profile information
• Aggregate feedback and usage statistics

Each organization's data is strictly isolated from other organizations using row-level security.

6.3 Legal Requirements

We may disclose your data when required by law to:

• Comply with legal obligations (court orders, subpoenas)
• Respond to lawful requests from law enforcement
• Protect our rights, property, or safety
• Prevent fraud or abuse of the Service
• Enforce our Terms of Service

6.4 Business Transfers

If Hillway Property Consultants is involved in a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data is transferred and becomes subject to a different privacy policy.

6.5 With Your Consent

We may share data with other parties when you give us explicit consent to do so.

We never sell your personal data to third parties or use it for advertising purposes.

7. Data Security

We implement industry-standard technical and organizational measures to protect your personal data from unauthorized access, loss, misuse, or alteration:

7.1 Technical Security Measures

• Encryption in Transit: All data transmitted to and from our servers uses TLS 1.3 encryption
• Encryption at Rest: All database data is encrypted using AES-256 encryption
• Database Security: Row-level security (RLS) policies ensure users can only access their organization's data
• Authentication: Passwords are hashed using bcrypt; magic link authentication uses time-limited tokens
• Network Security: Firewalls, DDoS protection, and network segmentation
• Regular Backups: Automated daily backups with point-in-time recovery

7.2 Organizational Security Measures

• Access Control: Strict access controls limit who can access personal data
• Principle of Least Privilege: Team members have access only to data necessary for their role
• Security Monitoring: Real-time error tracking and security monitoring via Sentry
• Regular Security Reviews: Periodic security audits and vulnerability assessments
• Secure Development: Code reviews, dependency scanning, and security testing

7.3 Data Location

• Primary data storage: UK/EU data centers (Supabase)
• Application hosting: Global edge network with EU regions (Vercel)
• Email delivery: EU data centers (Resend)

7.4 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware
• Notify affected users without undue delay if there is a high risk
• Provide details of the breach, its likely consequences, and measures taken
• Implement immediate remedial actions to mitigate the breach

7.5 No Guarantee

While we implement robust security measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we continuously work to protect your data using industry best practices.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, and resolve disputes.

8.1 Active Account Data

• Account Information: Retained for the duration of your active subscription
• Business Profile: Retained while your account is active
• Usage Data: Retained for 12 months for analytics and service improvement

8.2 Opportunity Data Retention

• Raw Items (Unprocessed Data): Automatically deleted after 30 days
• Structured Items (AI-Processed Opportunities): Retained for 12 months or until you delete them
• Company Research Cache: Retained for 30 days to avoid redundant API calls
• Knowledge Graph Entities: Retained while relevant to your business (you can delete these at any time)

8.3 Financial Records

• Invoices and Payment Records: Retained for 7 years as required by UK tax law
• Subscription History: Retained for 7 years for accounting purposes

8.4 Account Deletion

When you request account deletion or cancel your subscription:

• Your personal data (name, email, business profile) is deleted within 30 days
• Financial records are retained for 7 years for legal/tax compliance
• Anonymized usage analytics may be retained for product improvement
• Backups containing your data are deleted within 90 days as they age out

8.5 Inactive Accounts

If your account remains inactive (no login) for 24 months and your subscription has lapsed, we may delete your account data after providing 60 days' notice via email.

9. Your Rights Under UK GDPR

Under UK data protection law, you have the following rights regarding your personal data:

9.1 Right to Access (Article 15)

You have the right to request a copy of all personal data we hold about you. This is commonly known as a "subject access request." We will provide this information free of charge within 30 days.

9.2 Right to Rectification (Article 16)

You have the right to correct any inaccurate or incomplete personal data. You can update most information directly in your account settings, or contact us for assistance.

9.3 Right to Erasure / "Right to be Forgotten" (Article 17)

You have the right to request deletion of your personal data. We will comply unless we have a legal obligation to retain it (such as financial records for tax purposes). You can delete your account via Settings, or contact us.

9.4 Right to Restriction of Processing (Article 18)

You have the right to request that we restrict processing of your personal data in certain circumstances, such as while we verify its accuracy or assess whether we have legitimate grounds to continue processing.

9.5 Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format (JSON or CSV) and to transmit it to another service provider. This applies to data you provided to us based on consent or contract.

9.6 Right to Object (Article 21)

You have the right to object to processing based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.

9.7 Right to Withdraw Consent (Article 7)

Where processing is based on consent (e.g., marketing emails, analytics cookies), you have the right to withdraw consent at any time. This will not affect the lawfulness of processing before withdrawal.

9.8 Rights Related to Automated Decision-Making (Article 22)

While our AI scores and ranks opportunities, all final decisions (whether to pursue an opportunity) are made by you, not by automated processing alone. You have the right to request human review of any AI-generated scores or recommendations.

9.9 How to Exercise Your Rights

To exercise any of these rights, please contact us at:

• Email: matt@hillwayco.uk
• Subject line: "Data Protection Request - [Your Right]"

We will respond to your request within 30 days. If your request is complex or we receive multiple requests, we may extend this by 60 days and will notify you.

9.10 Verification

To protect your privacy, we may ask you to verify your identity before responding to requests to access or delete personal data.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to provide and improve the Service. A cookie is a small text file stored on your device.

10.1 Essential Cookies (Strictly Necessary)

These cookies are required for the Service to function and cannot be disabled:

• Authentication Cookies: Keep you logged in and secure your session
• Security Cookies: Prevent cross-site request forgery (CSRF) attacks
• Session Cookies: Remember your preferences during your session

Legal basis: Strictly necessary for contract performance (no consent required).

10.2 Analytics Cookies (Optional)

These cookies help us understand how users interact with the Service:

• Pages visited and features used
• Time spent on the platform
• Error rates and performance metrics
• General usage patterns (anonymized)

Legal basis: Your consent (you can opt out at any time).

10.3 No Advertising or Tracking Cookies

We do not use advertising cookies, third-party tracking cookies, or social media tracking pixels.

10.4 Managing Cookies

You can control cookies through:

• Your browser settings (most browsers allow you to block or delete cookies)
• Our cookie preferences (available in your account settings)

Note: Blocking essential cookies will prevent you from using the Service.

10.5 Cookie Lifespan

• Session Cookies: Deleted when you close your browser
• Authentication Cookies: Expire after 30 days or when you log out
• Analytics Cookies: Expire after 12 months

11. International Data Transfers

Your personal data is primarily stored and processed in the United Kingdom and European Union. However, some of our service providers may process data outside the UK/EU.

11.1 Transfers to the United States

We use Anthropic (AI processing) and Stripe (payment processing), which may involve data transfers to the United States. To ensure adequate protection, we rely on:

• Standard Contractual Clauses (SCCs): EU Commission approved contracts that require US processors to provide equivalent data protection
• Supplementary Measures: Encryption, access controls, and technical safeguards
• Data Processing Agreements: Contracts that limit how providers can use your data

11.2 Service Provider Locations

• Supabase: UK/EU data centers
• Stripe: Global (with EU operations)
• Anthropic: United States
• Vercel: Global edge network (EU regions available)
• Resend: EU data centers

11.3 Your Rights Regarding International Transfers

You have the right to request information about the safeguards we have in place for international data transfers. Contact us at matt@hillwayco.uk for details.

12. Children's Privacy

Our Service is intended for business professionals and is not directed at individuals under the age of 18. We do not knowingly collect personal data from children under 18.

If we become aware that we have collected personal data from a child under 18 without parental consent, we will take steps to delete that information as quickly as possible. If you believe we have collected data from a child, please contact us immediately at matt@hillwayco.uk.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

13.1 Notification of Changes

When we make material changes to this Privacy Policy, we will:

• Update the "Last updated" date at the top of this page
• Notify you by email at the address associated with your account
• Display a prominent notice in the Service
• Obtain your consent if required by law (for changes that expand data processing)

13.2 Your Options After Changes

If you disagree with the changes, you may cancel your subscription and request deletion of your account. Continued use of the Service after notification constitutes acceptance of the updated Privacy Policy.

13.3 Review Regularly

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

14. Third-Party Links

The Service may contain links to third-party websites, services, or resources (e.g., tender portals, news sources, company websites). We are not responsible for the privacy practices of these third parties.

When you leave our Service, we encourage you to read the privacy policies of any third-party sites you visit. This Privacy Policy applies only to information collected by Spotter AI.

15. Business Contact Information

Public opportunities displayed in Spotter may include business contact information (names, email addresses, phone numbers of procurement officers, company representatives, etc.). This information is sourced from:

• Official UK Government tender portals (public sector data)
• Publicly published news articles and press releases
• Company websites and public business registries

We display this information as part of the opportunity intelligence service to help you identify relevant contacts. This information is already publicly available and is used solely for the purpose of business development outreach.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Data Protection Contact

Registered Office

17. Supervisory Authority

You have the right to lodge a complaint with the UK's data protection supervisory authority if you believe we have not handled your personal data appropriately:

This Privacy Policy was last updated on 29 January 2026 and complies with UK GDPR and the Data Protection Act 2018.