Last updated: 13 October 2026
This policy explains what Slopless collects and why. It covers three groups of people: visitors to our public pages, people who sign up for a trial or subscribe, and the directors, owners and businesses that appear in the feed because they are on the public register. It also covers the emails we send.
Slopless is a real-time monitoring service for new UK companies, run from the United Kingdom at slopless.co.uk ("we", "us", "our"). We are the data controller for the personal data described in this policy, under the UK GDPR and the Data Protection Act 2018.
| Service | slopless.co.uk |
|---|---|
| Data controller | The operator of slopless.co.uk |
| Contact | hello@slopless.co.uk |
Slopless is for businesses, so a trial has to be started with a work email address. Personal addresses (Gmail, Outlook, iCloud and similar) are not accepted. When you sign up we ask for:
We send a six-digit verification code to the address you gave. Until you enter it, the sign-up sits in a pending list with the time it was made and the IP address it came from; it is removed when you verify, or after 15 minutes if you do not. We limit how many sign-ups a single IP address can make, and the form has a hidden field that catches automated sign-ups. One trial is available per organisation, which we judge by the domain of your email address, so we check that domain against existing trial accounts.
When you verify, your account is created, your seven-day trial starts, you receive a welcome email, and we are notified by email with the details you entered so that we can keep an eye on new trials and help where needed.
Your account record holds your username, the password hash, your verified email address, your organisation and the answers you gave at sign-up, your account type and trial dates, which tools your account includes, the IP address you signed up from, and a token that identifies your current session. If you turn on two-factor authentication we also hold the secret your authenticator app uses and hashed copies of your recovery codes. Two-factor authentication is optional during a trial and required on paid accounts. If you ask for a password reset, a single-use link is stored against your account for one hour.
Each successful login is recorded with the date and time, the IP address and an approximate location worked out from that address by a third-party lookup service (ip-api.com); only the IP address is sent to that service. We keep the most recent ten logins per account. Failed login attempts are written to a server log with the time, the IP address and the username tried, so that repeated attempts can be blocked automatically. Administrators can see login history. Your account can be signed in on one device at a time: logging in elsewhere ends the earlier session.
Most of your settings live in your browser (see section 11). The following are kept on our server, in files tied to your username or your organisation, so that they survive a change of device and can be shared with colleagues:
While the feed is open, your browser also reports which SIC codes you are watching, with a random viewer identifier and your username, so colleagues in your organisation can see who is online and which industries are covered. This is held in memory only and is shown to nobody outside your organisation.
We email you to verify your address, to welcome you, two days before your trial ends and once when it has ended, to reset your password if you ask, to deliver the alerts you set up (Director Watch, Incorporation Digest, Website Watcher), and to answer anything you send us. These are sent through Resend, a transactional email provider, which receives your address and the content of the message. We do not add trial or paid users to marketing lists, and after the end-of-trial email we do not email you about the trial again.
When a subscription is paid by card, the payment is handled by Stripe. You enter your card details on Stripe's own pages; they never reach our server. We hold a Stripe customer reference, your subscription status and billing history so that we know which accounts are paid up, and we keep invoices for as long as tax law requires.
If your trial ends and you do not subscribe, your account is suspended but not deleted, so your presets, layouts and verdicts are there if you come back. Unused trial accounts are deleted from time to time as part of routine housekeeping, and straight away if you ask. When an account is deleted, everything in sections 2.2 and 2.4 goes with it; entries in the activity logs in section 2.5 age out on their own. The server is backed up nightly and backups are kept for 30 days, so deleted data can remain in a backup for up to 30 days after deletion.
The feed shows newly formed UK companies and changes at existing ones. To do that we process information about businesses and, because a company is run by people, about its directors and owners. This section explains what that information is, where it comes from, and how long we keep it.
Our main source is the public Companies House register, which we read through its official data services. For each company we hold the company name and number, the date of incorporation, the registered office address, the SIC codes, and for its directors and persons with significant control: the name, the role, the occupation, the nationality and country of residence, the town from the correspondence address, the appointment or notification date, and the nature of control. Where a company is owned by another company we may follow the register to the person who ultimately owns it. We also note a director's other current appointments, which is how the feed flags groups of connected companies, and we record new director appointments and changes of ownership at established companies. We do not display or keep dates of birth.
Company records are kept for 45 days and then deleted. The raw feed files we receive from the register, which contain public register data only, are kept for longer for operational reasons.
For each new company we try to find its website by checking domain names that match the company name. If a live site is found we read its home page, its contact page and, where there is one, its about or team page, identifying ourselves as SloplessBot with a link to this site. From those pages we may take:
We do the same for businesses linked to a new company through a shared director or owner, so that their published contact details can be shown alongside it. We only ever use what a company has itself published, we do not generate or verify addresses a company has not published, and we do not send anything to a discovered address as part of this process. Website findings are kept for about 30 days (a week longer where a live site was found, and for as long as a user has the company on a Website Watch), and findings for linked businesses for 60 days.
A website found by name can belong to a different business with a similar name, or to an older business that has just incorporated. To settle that, we send a summary to an AI model (Claude, provided by Anthropic). The summary contains the register facts above, the website address, the identity facts and contact details read from the site, the published details of any linked businesses, similarly named companies on the register, the domain's age, and up to about 1,500 characters of text from the home page and the about page. The model returns a verdict (OWN, ESTABLISHED, DIFFERENT or UNSURE), a confidence score, a one-line reason, a one-line summary of what the business does and, where relevant, one buying signal, which we store with the website findings. Nothing about our users is included. Anthropic processes this to return the answer and, under the terms we use it on, does not use it to train its models.
To work out how old a website is we also look up the domain name with the public registry's RDAP service (Nominet for .uk domains, Verisign for .com and .net, and the rdap.org directory otherwise) and the Internet Archive's Wayback Machine. Only the domain name is sent.
We process this information under our legitimate interests, and those of our users, in finding and contacting businesses: Slopless exists to tell accountants, brokers, agencies and other suppliers which companies have just formed and how to reach them. In weighing that against the interests of the people involved we rely on the fact that the information is already public, that it concerns people in their business capacity, that we take contact details only from the company's own website, that we hold company records for a matter of weeks, and that anyone can object. If you are a director or owner and you do not want your published contact details shown to our users, email hello@slopless.co.uk: we will delete the contact details we hold for you, add your address to our suppression list so that we never email it, and not collect it again. Your name and appointments come from Companies House, so to change those you would need to contact Companies House. Section 10 sets out your rights in full.
Our public live feed and our new-companies-by-town pages can be read without an account and may be indexed by search engines. They show counts by industry and town and, for roughly one in ten companies, the company name, number and industry and, on the live feed, a director's name and town, all drawn from the public register. Which companies are shown in full is fixed per company, so nothing more is revealed by refreshing. Website contact details are never shown on public pages.
We write to businesses whose people we believe would find Slopless useful: accountancy and bookkeeping practices, marketing and digital agencies, web and IT firms, insurance brokers, recruiters, and suppliers to small businesses. We find them through our own feed, in two ways: a company in one of those lines of business has just been formed, or an established company in one of them (over a year old) has just appointed a director or changed hands.
Before anyone is emailed:
Emails are sent on weekdays through Smartlead, an email sending service, which receives the address, the recipient's name where we could match one to a director, the company name, its website, its town, and the wording of the email. Each contact gets a short sequence, no more than a few messages, which stops at the first reply and the moment anyone opts out. Every email includes an opt-out link, and you can also write to hello@slopless.co.uk. We keep a record of each company we have written to (company number, address, outcome) for 180 days so that nobody is contacted twice, and a suppression list of addresses and domains that have asked not to hear from us, which we keep for as long as we send email. We do not sell or share these details with anyone.
We do this under our legitimate interest in promoting Slopless to businesses, and within the rules for business-to-business marketing in the Privacy and Electronic Communications Regulations.
| What | Lawful basis |
|---|---|
| Creating and running your account, providing the feed and the tools, keeping your presets, layouts, verdicts and watches, sending the emails you set up, and taking payment | Performance of a contract (the trial, then the subscription, on our Terms) |
| Login history, failed-login logs, single-session enforcement, server logs | Legitimate interests: keeping accounts and the service secure |
| Copy-activity, feedback and visit logs | Legitimate interests: understanding how the service is used and improving it |
| Holding and showing register data and published contact details about companies and the people behind them (section 3), including the AI checks | Legitimate interests: ours and our users' in finding and contacting businesses, as explained in section 3.4 |
| Emails we send to businesses (section 4) | Legitimate interests: promoting Slopless, within PECR |
| Trial reminder emails | Legitimate interests: telling you when a service you asked for is about to end |
| Keeping invoices and payment records | Legal obligation |
| Data | Kept for |
|---|---|
| Account, settings, presets, layouts, watches and alert addresses | While the account exists; deleted with it |
| Pending sign-ups | Until verified, or 15 minutes |
| Login history | Most recent 10 logins per account |
| Failed-login log | Rotated with the server logs, up to 30 days |
| Your verdicts on websites | 45 days |
| Bulk upload jobs and results | 7 days |
| Incorporation Digest compiled spreadsheets | 30 days; matched companies cleared when each week is compiled |
| Website Watcher entries | 30 days per watched company; results until you clear them |
| Mayhem boards | 30 days |
| Copy-activity log | Most recent 5,000 entries |
| Feedback | Most recent 2,000 messages |
| Public page visits | Most recent 2,000 visits |
| Web server logs | Up to 30 days |
| Company records in the feed | 45 days |
| Website findings, contact details and AI verdicts | About 30 days (37 for live sites; longer while on a Website Watch); linked businesses 60 days |
| Record of businesses we have emailed | 180 days |
| Suppression list | For as long as we send email, so the opt-out keeps working |
| Invoices and payment records | As long as tax law requires (currently six years) |
| Server backups | Taken nightly, kept for 30 days |
The people who run Slopless have administrative access to the server and can see account details, login history, the activity logs, and everything in section 2.4 for every user. This access is used only to operate, support and secure the service.
People in the same organisation share industry presets and keyword sets, layouts marked as shared (labelled with the owner's username), verdicts on websites, buying-signal preferences, Mayhem boards (including who did what on them) and presence (who is online and which SIC codes they are watching). Your Director Watch, Digest, Website Watcher and bulk uploads are private to you. Nobody outside your organisation can see any of it. A trial organisation has one member, so nothing is shared during a trial.
We do not sell, rent or share personal data for anyone else's marketing. These providers process data on our instructions to run the service:
| Provider | What for | What they receive |
|---|---|---|
| Companies House | The public register | Nothing about you; we read from it |
| DigitalOcean | Hosting, in its London data centre | Everything on our server |
| Resend | Sending our emails to you | Your email address and the message |
| Anthropic | AI checks on websites (sections 3.3 and 4) | Public register facts, website text and published contact details; nothing about users |
| Smartlead | Sending the emails in section 4 | The recipient's address, name where matched, company, website, town and the wording |
| Stripe | Card payments | Your name, email address and card details, entered on Stripe's pages |
| ip-api.com | Approximate location for login history and visit logs | The IP address only |
| Domain registries (Nominet, Verisign, rdap.org) and the Internet Archive | How old a website is | The domain name only |
We may also disclose data where the law requires it, or to protect the rights, property or safety of Slopless, its users or others.
Our server is in the United Kingdom. Some of the providers above are based in the United States or process data there (Resend, Anthropic, Smartlead, Stripe, ip-api.com). Where personal data leaves the UK we rely on safeguards recognised under UK data protection law, such as the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or the UK Addendum to the EU standard contractual clauses.
Whether you are a user or someone who appears in the feed, you have the following rights under the UK GDPR:
To exercise any of them, email hello@slopless.co.uk. We will reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk if you think we have handled your data unlawfully; we would rather hear from you first.
We use no advertising cookies, no analytics cookies and no third-party trackers. Because the only cookie is strictly necessary, no cookie banner is needed.
Slopless is for business use and is not directed at anyone under 18. We do not knowingly collect personal data from children.
When we change this policy we update the date at the top. If a change affects how we treat your data in a way you would not expect, we will tell users by email. Continued use of the service after a change means you accept the updated policy.
| hello@slopless.co.uk | |
| Website | slopless.co.uk |
This policy was prepared on 13 October 2026 and describes how slopless.co.uk handles data from that date.