Privacy

Last updated: 30 October 2026

This page explains what Workspotted ("we") keeps about you and why. Questions: [email protected]. Our legal details are at the end.

The short version

• We keep only what we need to send you the right contracts: your email address, the first half of your postcode and your settings.
• We count clicks on the links in our emails, so we can tell whether they're useful; you can switch this off in your settings. We only count when you open an email if you tick the box to let us.
• We don't use advertising cookies or ad tracking code on our site.
• You can delete your account from your settings page at any time, and we erase it straight away.

What we keep, and why

• Your email address, to send the emails you signed up for and the sign-in links you ask for. Lawful basis: to provide the service you signed up for (contract).
• Your settings: the first half of your postcode (for example SG6), how far you'll drive, how far to look for planning schemes, the kinds of work you want, whether you want an email every weekday morning or once a week, any pause you've set, whether you want a short note on quiet days, and your firm's name if you add it. These choose what we send you. Lawful basis: contract.
• Your sign-up record: when and where you signed up, when you confirmed your address and, if you do, when you unsubscribed. This shows we only email people who asked us to. Lawful basis: our legitimate interest in proving that, and in never emailing you after you've said no.
• Your plan: which plan you're on, your trial or free-period dates, whether you have a founding place and at what price, Stripe's reference numbers for you, and when payments were taken or stopped. Lawful basis: contract, and our legal duty to keep tax records.
• A list of the emails we've sent you: the type of email, the day it covers, and whether our email provider accepted it. This stops us sending anything twice. Lawful basis: contract.
• Clicks: when the links in each email are clicked. Our links pass through our own site first to record this. You can switch it off in your settings ("Count when I click links in these emails"). Lawful basis: legitimate interests.
• Opens, only if you agree: if you tick "Also count when I open your emails" when you sign up or in your settings, our emails carry a tiny image that records when each one is opened. Untick it at any time and we stop. Opens are approximate: some email apps open every message automatically. Lawful basis: your consent.
• For clicks and opens we keep only the times and counts, not your IP address or device, and we use them to see whether the emails are useful and to improve them.
• Your "Useful?" answers (founding members only): the yes or no you tap on a contract. We use them to make our verdicts better. Lawful basis: legitimate interests.
• Where you found us: if you arrive from one of our ads, the campaign tags in the web address (for example "utm_source=facebook") are saved with your account when you sign up. No cookie is used. Lawful basis: our legitimate interest in knowing which ads work.
• Security checks: our forms are checked by Cloudflare Turnstile, which looks at your IP address and browser to tell a person from a bot. To stop repeated attempts we keep a scrambled form of your IP address (a salted hash, which can't be turned back into the address) for 48 hours. Lawful basis: our legitimate interest in protecting the service and our members.

Payment card details are entered on Stripe's own pages. We never see or store your card number.

The postcode checker on our home page runs in your browser. The postcode you type isn't sent to us or anyone else. We only count that a check happened.

What we don't do

• We don't set advertising or analytics cookies, and we don't put Meta's or Google's ad tracking code on our site. If you click one of our ads, Meta or Google knows that under their own privacy policies.
• We never sell or share your details for anyone else's marketing.
• We don't show or pass on private homeowners' details. The planning schemes we show are business and developer applications only, and we never store personal names from them.

Cookies

We don't set cookies. Cloudflare, which protects the site, may set a strictly necessary security cookie. Stripe's checkout and billing pages are Stripe's own and follow Stripe's cookie policy.

Who else handles your data

We use these providers to run the service. Each acts only on our instructions, under a data processing agreement:

• Supabase: our database, which holds your account and settings (in London).
• Google Cloud: the server behind our website (London) and the timer that starts our daily jobs.
• GitHub (part of Microsoft): runs our scheduled jobs, which match contracts to members and send the emails.
• Resend: sends our emails (from its EU region, in Ireland).
• Stripe: takes payments and runs the billing pages.
• Cloudflare: hosts the website, runs the Turnstile checks and forwards email sent to [email protected].
• Google (Gmail): the mailbox where we read email sent to [email protected].
• Anthropic: the AI that writes our verdicts. It reads only public contract notices and public planning descriptions of business and development sites, never your details.

Some of these providers are based in the United States or may handle data there. Where they do, we rely on the safeguards UK law approves, such as the UK Extension to the EU-US Data Privacy Framework or the ICO's international data transfer agreement.

How long we keep it

• While you have an account, we keep what's listed above.
• If you delete your account from your settings page, we erase it straight away, with your settings, your email list, your opens and clicks and your "Useful?" answers. Any payments stop at the same time.
• If you never confirm your address, we delete the sign-up after 30 days.
• If you unsubscribe, we keep your account for 12 months in case you come back, then delete it.
• Payment records are kept by Stripe for 6 years, because the law requires us to keep tax records.
• Emails you send us are kept as long as we need them to deal with what you asked, and no longer than 2 years.
• The scrambled IP addresses used for security checks are deleted after 48 hours.

Your rights

You can ask to see, correct, delete or move your data, object to how we use it, or withdraw consent at any time. Most of this you can do yourself from your settings page. Otherwise email [email protected] and we'll reply within a month. If you're unhappy with how we've handled your data, you can complain to the ICO (ico.org.uk).

Contract and planning data

The contract notices we show are published by public bodies on Find a Tender and Contracts Finder, under the Open Government Licence v3.0. We remove named individuals' contact details from them before storing anything. Planning schemes come from public planning registers via PlanIt. We keep only business and development sites, never homes, and we store no personal names or house numbers.

Changes to this notice

If we change how we use your data, we'll update this page and, for anything that affects you, tell you by email first.

Legal details

Workspotted is a trading name of Tom Millson, a sole trader, who is the data controller for the information on this page. Address: 27 The Crescent, Letchworth, SG6 1SN. Registration with the Information Commissioner's Office: in progress.