Privacy policy

We’d like to know which pages are useful. Two tools do that, and both wait for your say-so:

• Google Analytics 4 counts visits and pages. Google’s advertising signals and ad personalisation are switched off, so nothing here feeds an ad profile, and Google shortens your IP address before storing it.
• PostHog shows us how the tools get used. It runs on PostHog’s servers in Frankfurt. Session recording is switched off, so no replays of what you typed or clicked.

Neither loads until you press Yes, that’s fine on the banner. If you press No thanks, ignore it, or block JavaScript, nothing loads. That’s enforced in code, not a policy promise. When they do run, each sets cookies: Google’s _ga cookies last up to two years, and PostHog’s ph_ cookie and browser storage the same.

Changed your mind? Change my choice brings the banner back so you can answer again. Clearing your browser storage does the same thing.

Your answer itself is remembered in your browser (swl_consent, with the date and the banner version). That’s strictly functional storage and holds no personal data.

Three other things load from companies we use, whatever you choose:

• Fonts from Google Fonts. Your browser fetches them from Google’s servers, which see your IP address and browser details in that request. Google says it doesn’t use this to profile people or target adverts. Google Fonts privacy
• Cloudflare Turnstile, the spam check on the forms. It runs quietly in the background, looks at signals such as your IP address and browser to tell people from bots, and may set a cookie of its own to remember that you passed. Turnstile privacy
• Webflow, which hosts the site, keeps standard server logs: IP address, time and page requested. Webflow privacy

UK law asks us to name the legal reason for each use of your details. Here they are:

• The monthly email: your consent. Withdraw it any time with the unsubscribe link, or by asking.
• Analytics: your consent, given on the banner. Withdraw it with the “Change my choice” link above.
• Replying to your message: our legitimate interest in answering what you asked.
• The connected-car tool: providing the service you signed up for. The newsletter tick inside the tool is consent, and separate.
• Spam checks and server logs: our legitimate interest in keeping the site working and secure.
• Keeping a record of what you agreed to: a legal obligation.

You can object to anything we do under legitimate interests. Email us and we’ll stop unless there’s a compelling reason we can’t.

Nobody gets your details for their own marketing. These companies handle them on our behalf, and may only use them to provide their service to us:

• Webflow (Webflow, Inc., San Francisco) hosts the site, runs the forms and holds the submissions, so it sees whatever you type into a form. It uses Cloudflare for its spam check and content delivery; Cloudflare also uses the spam-check signals to improve its own service, as its addendum explains. Privacy policy · Data processing agreement
• Pipedream receives every form submission, passes newsletter sign-ups on to SendFox, and keeps a log of each one it handles. Privacy policy
• SendFox (Sumo Group, Inc., Austin, Texas) holds your email address and sends the monthly email. Privacy policy · Data processing agreement
• Google (Google LLC) serves the fonts and, only if you accepted the banner, runs Analytics 4 as our processor under Google’s data processing terms. Privacy policy
• PostHog (PostHog, Inc.) provides product analytics, again only with your consent. Data is held on their EU cloud in Frankfurt. Privacy policy · Data processing agreement

If you use the connected-car tool, four more:

• Tesla provides the connection. Tesla’s own privacy notice covers what Tesla does with your account.
• Vultr provides the London server the tool runs on. Privacy policy
• Cloudflare sits in front of the tool’s address, so it sees the visitor’s IP address and request on the way through. Privacy policy
• Resend (Plus Five Five, Inc., San Francisco) sends the statement emails. Privacy policy · Data processing agreement

That’s the complete list. There are no advertisers, affiliates or data brokers.

Several of these companies are American, so some of your details are processed in the United States. UK law needs a recognised safeguard for that. Here’s what each relies on:

• Webflow and Google are certified under the UK Extension to the EU–US Data Privacy Framework, which UK law recognises for transfers to the US.
• PostHog keeps analytics data in Frankfurt, which UK law treats as adequate. PostHog is also on the Data Privacy Framework list and its data processing agreement carries the UK addendum, for any support access from the US.
• Resend is on the same Data Privacy Framework list, and its data processing agreement also carries the UK addendum to the standard contractual clauses. Cloudflare is on the list too.
• SendFox and Pipedream process in the United States under their terms, linked above.
• Tesla answers the tool from its European servers.
• Vultr’s server is in London, so nothing leaves the UK there.

Want a copy of any of these safeguards? Email us and we’ll send what we have.

• Your email address: until you unsubscribe or ask us to delete it. After you unsubscribe, SendFox keeps a note of your address so we don’t email you again.
• Form submissions: kept in Webflow’s form inbox until we delete them.
• Messages: in our mailbox until we delete them, or straight away if you ask.
• Analytics: Google Analytics keeps visit data for up to 14 months. PostHog keeps events for the retention period of our PostHog plan; ask and we’ll tell you the current figure. Both give us aggregated reports, not a record of you by name.
• The connected-car tool: your access token goes the moment you disconnect. Your account, lease details and readings stay while you use the tool and until you ask us to delete them. Resend keeps its copy of each statement email for 30 days.
• Server logs: Webflow and Cloudflare keep theirs on their own schedules.

You can ask for a copy of everything we hold about you, have it corrected or deleted, restrict what we do with it, get it in a portable format, or withdraw consent. We’ll answer within a month, and there’s no charge.

You also have the right to object, and for marketing that right is absolute: tell us to stop and we stop.

Every newsletter email has a one-click unsubscribe. For anything else, email hello@superwattlabs.com or use the contact form and say what you want. We may ask you to confirm the email address we hold for you, and nothing more.

If you’re unhappy with how we’ve handled your details, you can complain to us: email hello@superwattlabs.com with “complaint” in the subject line, or use the contact form. We’ll acknowledge it within 30 days, usually much sooner, look into it, keep you informed, and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. You don’t need our permission, and you don’t have to come to us first.

Superwatt Labs Ltd is the data controller for this site and its tools. It’s a UK company, number 17442991, with its registered office at 66 Paul Street, London EC2A 4NA. Email hello@superwattlabs.com or use the contact form.