Privacy Policy
Version 3
Last updated: 20 July 2026
1. Who we are
CompsPilot is operated by Ginger Squid Ltd, a company registered in England and Wales under company number 17259111, with registered office at 86-90 Paul Street, London, EC2A 4NE. Ginger Squid Ltd is registered with the Information Commissioner's Office under registration number ZC176678.
Ginger Squid Ltd is the data controller for the personal data described in this policy, except where this policy states that a third party acts as an independent controller for its own processing. We are based in the United Kingdom and comply with the UK GDPR and the Data Protection Act 2018.
If you have any questions about this policy or how we handle your personal data, contact us at privacy@compspilot.co.uk. Emails sent to privacy@compspilot.co.uk and support@compspilot.co.uk are received and handled by Ginger Squid Ltd, the operator of CompsPilot.
2. What this policy covers
This policy explains what personal data we collect when you use CompsPilot, why we process it, who we share it with, how long we keep it, and the rights you have. Our use of cookies and similar technologies is described in our Cookie Policy (https://compspilot.co.uk/cookies), which should be read alongside this policy.
3. The information we collect
- Account and profile information - your name, email address, and account credentials managed through our authentication provider (Clerk), together with any profile details you provide. If you sign in using Google or Apple, we receive basic profile information, such as your name and email address, from that provider.
- Household and member information - where you use household accounts, information about the members you invite and your selected member view.
- Competition activity - the competitions you save, enter, hide and track, and the wins you record.
- Win Scanner information - where you use the Win Scanner, we process the emails you forward to your unique scanner address. For emails accepted for processing, we store the sender's email address; the subject line; a short excerpt of the email body; message metadata, such as approximate size, a message identifier, whether the email contains an unsubscribe link, and the promoter or organiser domain; keyword matches; the AI classification result; confidence score; extracted structured details, such as competition name, prize description, promoter name, claim deadline and any required action; and processing timestamps. We do not store the full body of your forwarded emails or their attachments.
- Payment and subscription information - where you subscribe to a paid plan, billing information processed through Stripe. We do not store your full card details; these are handled by Stripe.
- Support information - the content of any support requests and related correspondence.
- Technical, security and usage information - your IP address, device and browser information, page requests, timestamps, security logs, error logs, and similar technical records.
- Analytics information - where you consent, analytics data from Microsoft Clarity and PostHog. This may include page views, clicks, scrolling, feature usage, device and browser information, approximate location derived from IP address, heatmaps, and session recordings where those tools are enabled. We mask sensitive areas and do not use analytics for advertising.
4. How we use your information and our lawful bases
| Purpose | Personal data used | Lawful basis |
|---|---|---|
| To create and operate your account and provide the CompsPilot service | Account, profile, household, competition activity and settings | Performance of our contract with you |
| To provide competition discovery, tracking, entries, wins tools and the Win Scanner | Competition activity, scanner records and related account data | Performance of our contract with you |
| To process subscriptions, billing and invoices | Payment, subscription and account data | Performance of our contract with you and compliance with legal obligations |
| To maintain security, prevent fraud or abuse, diagnose faults and ensure service reliability | Technical, security, account and usage records | Our legitimate interests in operating a secure and reliable service |
| To respond to support requests | Support correspondence and account information | Performance of our contract with you and our legitimate interests in providing support |
| To understand and improve how people use CompsPilot through analytics | Analytics information from Microsoft Clarity and PostHog | Your consent |
| To send service messages | Account and subscription information | Performance of our contract with you |
| To send marketing communications | Contact details and marketing preferences | Your consent, or the soft opt-in where legally available and you have been given an easy opt-out |
| To comply with legal obligations and respond to lawful requests | Relevant account, billing, security or correspondence records | Compliance with legal obligations |
Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect processing already carried out lawfully before withdrawal.
5. The Win Scanner
The Win Scanner is an optional paid-plan tool that helps you spot likely winning emails and related competition correspondence. It does not access your email account. It only processes emails that you actively forward to your unique CompsPilot scanner address. It is a supplementary tool and is not a substitute for monitoring your own inbox.
5.1 How emails are processed
Forwarded emails are processed in three automated stages:
- Initial filtering - validity, size and approved-sender checks.
- Content filtering - keyword and pattern matching for competition-related content.
- AI classification - automated analysis to detect win notifications and extract structured details.
Emails that fail the initial checks, for example emails over 5 MB or from senders not on your approved list, are rejected on receipt and are not stored. Emails that are accepted are stored while they are processed and classified. We do not retain the full body or attachments of forwarded emails.
5.2 What we store
For emails that pass processing, we store the limited set of information listed in section 3, including a short excerpt of the email body, but not its full body or attachments. You control which senders are processed through an approved-senders list in your scanner settings, which you can change at any time.
5.3 Lawful basis and disabling the scanner
When you enable the Win Scanner, you request that we process emails you forward to your scanner address for the purpose of providing that feature. Our lawful basis is performance of our contract with you. You control which senders are scanned through your approved-senders list, and you can stop using the Win Scanner at any time — by removing your approved senders, or by contacting us to turn the feature off. This stops further scanner processing but does not affect processing already carried out lawfully.
5.4 Who processes scanner emails
Scanner emails may be processed by our mail-handling and automation environment, our database and storage provider (Supabase), and our AI classification provider (OpenAI). We use OpenAI through our automation pipeline to classify scanner emails. We do not use scanner emails to train our own AI models. OpenAI's handling of API data is governed by its applicable business terms and data processing terms.
5.5 Sender and promoter-domain metadata
We treat organiser-domain information, such as the promoter or source domain associated with a scanned email, as promoter/source metadata used to help classify scanner emails. It is not used to make decisions about you. In most cases it will be business metadata, although we will handle it as part of the scanned-message record where it relates to an identifiable person.
5.6 Sensitive and unrelated information
The Win Scanner is not designed to process special category data or confidential third-party information. Please do not forward emails containing health, financial, employment, family, criminal offence, or other sensitive information. If we identify such information, we may delete it and may disable scanner processing to protect you and others.
Please forward only competition-related emails, ideally from a dedicated comping email address. Do not forward entire mailboxes, and do not forward sensitive, confidential or unrelated third-party information. Forwarded emails may contain other people's personal data, and you are responsible for ensuring you have the right to forward what you send.
5.7 Important safety notice
The Win Scanner is an automated detection tool. It does not verify that an email is genuine or that you have won. You should always check the original email and the promoter's own instructions before replying, clicking links, paying fees or sharing information. Scanner labels such as "likely win" or "needs checking" are guidance only.
Emails over 5 MB are rejected, and large attachments may not be processed. If you are expecting an important message with attachments, check your original mailbox.
6. Cookies and analytics
We use Microsoft Clarity and PostHog to understand how people use CompsPilot, but only where you have consented to analytics. These tools help us identify usability problems, improve the product, and understand feature use. Analytics is not used for advertising.
Clarity and PostHog are loaded only after you choose "Allow analytics". You can withdraw your consent at any time using "Manage cookie preferences". Our full use of cookies and similar technologies is set out in our Cookie Policy (https://compspilot.co.uk/cookies).
Microsoft Clarity may process analytics data as an independent controller for its own purposes. PostHog acts as an analytics provider under its applicable terms. See the relevant provider privacy statements for more information.
7. Service providers and other recipients
We do not sell your personal data. We share personal data with the providers and recipients below. Where a provider acts on our documented instructions it is our processor, under appropriate data processing terms; some providers act as independent controllers for their own processing, as noted.
| Provider | Role | What they do |
|---|---|---|
| Clerk | Processor, under data processing terms | Authentication and account/session management. Google and Apple are third-party login providers and are likely independent controllers for their own account/authentication processing. |
| Supabase | Processor | Database and file storage. |
| Stripe | Independent controller for core payment, fraud-prevention, regulatory and compliance processing; processor where its terms so provide | Payments and subscriptions. |
| Microsoft Clarity | Independent controller / analytics provider | Consent-based analytics, including session recordings and heatmaps. |
| PostHog | Processor / analytics provider, subject to its applicable terms and account configuration | Consent-based product analytics and feature-usage analysis. |
| Cloudflare | DNS, security and infrastructure provider; processor for many services | Domain management, security and content delivery. |
| OpenAI | Processor / service provider, under OpenAI's data processing terms | AI classification of Win Scanner emails. |
| Resend | Processor | Sending service and notification emails, such as alert digests. Resend uses infrastructure providers, including Amazon SES, to deliver those emails. Account and authentication emails are sent through Clerk. |
| Hostinger | Processor | Hosting and infrastructure. |
| n8n | Self-hosted within our own environment | Automation. Hostinger provides the underlying infrastructure. |
We may also disclose personal data where required by law, court order or a government authority, to establish or defend legal claims, or in connection with a business sale or reorganisation. We would notify you before your data became subject to a materially different privacy policy.
8. International transfers
Some of our providers keep personal data in the UK; others process it abroad. Data held in our database and file storage, and in our hosting and self-hosted mail and automation environment, is intended to remain in the UK where those services are configured in UK regions. Outbound email may be delivered through providers in the UK, EEA or other locations depending on the delivery route.
Several providers, including Clerk, Stripe, Microsoft/Clarity, OpenAI, Cloudflare, Resend and PostHog, are US-based or may process data in the US or other countries. Where a restricted transfer arises, we rely on the UK-US Data Bridge where the provider is certified under the UK Extension to the EU-US Data Privacy Framework, and otherwise on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with any required transfer risk assessment.
We keep a record of the transfer safeguards used for each provider and will provide relevant information on request. You can ask us for more information about the safeguards that apply by contacting privacy@compspilot.co.uk.
9. How long we keep your information
We keep personal data only for as long as we need it for the purposes described in this policy. We make sure our systems and automated workflows enforce the periods below where technically available.
| Data type | How long we keep it |
|---|---|
| Account / profile | While your account is active, then deleted or anonymised within 30 days of closure, unless needed for legal, billing, dispute or security reasons. |
| Competition entries | Until account deletion, unless retained in anonymised or aggregated form. |
| Wins | Until you delete them or your account closes. |
| Win Scanner records | Records the scanner classifies as a win, including possible wins, are kept until you delete them or your account closes. All other records, including messages classified as not a win, as spam, or that could not be classified, are automatically deleted 30 days after processing. Emails rejected on receipt, and the full body and attachments of forwarded emails, are not stored. |
| Support tickets | 24 months after the ticket is closed, unless needed for dispute, security or legal reasons. |
| Billing records | 6 years after the end of the relevant financial year, or longer where legally required. |
| Microsoft Clarity analytics | Playback data is retained for 30 days. Click data, heatmaps and labelled or favourited sessions are retained for up to 13 months, subject to Microsoft's current retention controls. |
| PostHog analytics | Retention depends on our PostHog account configuration and the type of data. We review PostHog retention settings periodically and aim to keep identifiable analytics data only for as long as needed for product improvement, support, security and compliance. |
| Security logs | 90 days rolling, unless needed for investigation or security/legal reasons. |
10. Automated processing
The Win Scanner uses automated processing, including AI classification, to label and prioritise the emails you forward. This processing is fully automated - no human reviews your forwarded emails as part of ordinary scanner processing. These labels and scores are informational only.
We do not make decisions that produce legal effects concerning you, or that similarly significantly affect you, based solely on automated processing. You remain responsible for verifying any win notification and deciding what action to take, and you can review, delete or report scanner results.
11. How we keep your information secure
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse, including encryption in transit and at rest where available, secure authentication and password hashing, access controls, audit logging, secure backups, and regular security review.
No system can be guaranteed completely secure, and you also play a part, for example by keeping your login details safe and following the guidance in section 5 when using the Win Scanner. If you believe your account has been compromised, please contact us immediately.
12. Your rights
Under UK data protection law you have the right to:
- access your personal data;
- have inaccurate data corrected;
- have your data erased in certain circumstances;
- restrict or object to certain processing;
- data portability;
- object to direct marketing; and
- withdraw consent where we rely on it, for example analytics or marketing.
For the Win Scanner, you can stop scanning at any time by removing your approved senders, or by contacting us to turn the feature off, which stops all further scanner processing.
To exercise any of these rights, contact privacy@compspilot.co.uk. We will respond within one month of receiving your request. You also have the right to complain to the Information Commissioner's Office (see section 16), though we would ask that you contact us first so we can try to put things right.
13. Age of users
CompsPilot is intended for adults. You must be at least 18 to create an account and use the Service. It is not intended for anyone under 18, and we do not knowingly collect personal data from anyone under 18.
If you believe we have inadvertently collected data from someone under 18, please contact us and we will delete it.
14. Changes to this policy
We may update this policy from time to time to reflect changes in our practices or legal requirements. Where changes are significant, we will take reasonable steps to bring them to your attention, for example by email or a prominent notice on the platform. The date at the top shows when it was last updated.
15. Contact us
Ginger Squid Ltd, 86-90 Paul Street, London, EC2A 4NE, United Kingdom. Email: support@compspilot.co.uk. Privacy email: privacy@compspilot.co.uk. ICO registration number ZC176678.
16. Complaints and supervisory authority
If you are not satisfied with our response to your data protection concerns, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO): Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Phone: 0303 123 1113. Website: www.ico.org.uk.