Privacy
Privacy policy
What we collect about you, why we have it, and how to make us delete it. Separately: what our crawler collects about websites is covered in the crawler policy.
Last updated 1 September 2026
The short version
We collect the email address you sign up with, the domains you ask us to track, and the usual security and billing records. We do not sell your data, we do not run advertising trackers, and we do not use your tracked-competitor list to train anything. Email hello@claimspy.io to get a copy of your data or have it deleted.
Who we are
ClaimSpy ("we", "us") operates claimspy.io and the application at app.claimspy.io. For the purposes of UK and EU data protection law we are the data controller for the account data described below. Contact: hello@claimspy.io.
What we collect
| What | Why | Lawful basis |
|---|---|---|
| Email address and password hash | To create your account and sign you in | Performance of a contract |
| Team name, seat list, invite emails | So colleagues can share a workspace | Performance of a contract |
| The domains you track and your alert settings | It is the service — we cannot monitor a site you have not named | Performance of a contract |
| Billing records: plan, status, last four digits, invoices | To take payment and meet tax obligations | Contract, and legal obligation |
| Security logs: IP address, user agent, sign-in timestamps | To detect abuse and investigate account compromise | Legitimate interests |
| Product usage: pages opened, exports run, errors hit | To find broken things and decide what to build | Legitimate interests |
What we deliberately do not collect
- No card numbers. Card details go straight to Stripe and never touch our servers. We see a plan, a status and the last four digits.
- No advertising or cross-site trackers. No Google Analytics, no Meta pixel, no ad network of any kind on either the marketing site or the app.
- No session recording. We do not replay your screen.
- No selling or sharing. We do not sell personal data, and we do not share it with anyone but the processors listed below.
Cookies
The marketing site at claimspy.io sets no cookies at all — there is
nothing to consent to, which is why you were not asked.
The app at app.claimspy.io stores a session token in your browser so that you stay
signed in. It is strictly necessary for the service to function, is not used for tracking, and is
cleared when you sign out. Stripe sets its own cookies on the checkout page it hosts; those are
governed by Stripe's privacy policy.
Who processes your data
We use a small number of subprocessors. Each is bound by a data processing agreement.
| Processor | What for | Where |
|---|---|---|
| Supabase | Database and authentication | EU / US |
| Cloudflare R2 | Screenshot and capture storage | Global edge |
| Stripe | Payments and invoicing | EU / US |
| Netlify | Website and application hosting | Global edge |
Where data is transferred outside the UK or EEA, it is covered by the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, as applicable.
How long we keep it
- Account data — for as long as your account is open, then deleted within 30 days of closure.
- Captures and claim history — for the life of the account. This is the point of the product: a record is only useful if it goes back. You can delete a tracked domain and its history at any time from the app.
- Billing records — seven years, because tax law requires it. This survives account deletion and we cannot shorten it.
- Security logs — 90 days.
Your rights
If you are in the UK, the EEA, or a US state with comparable law, you have the right to access a copy of your data, correct it, delete it, restrict or object to processing, and receive it in a portable format. You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office.
To exercise any of these, email hello@claimspy.io from your account address. We respond within 30 days, and usually within two working days. We do not charge for this and we will not ask you why.
Two of these you can do yourself, immediately, without asking us: export your claim data from the app, and delete a tracked domain along with everything collected for it.
Security
Data is encrypted in transit (TLS) and at rest. Access to production data is limited to those who need it. If we discover a breach affecting your personal data we will notify you and the relevant supervisory authority within 72 hours of becoming aware of it.
Children
ClaimSpy is a business tool and is not directed at anyone under 16. We do not knowingly collect data from children.
Changes
If we change this policy materially we will email account holders before it takes effect. The date at the top always reflects the current version.
Contact
Any privacy question, request, or complaint: hello@claimspy.io.