Privacy Policy

1. Data we collect

We collect information you provide directly — name, email address, phone number, company name, and project requirements — when you contact us or use our services. We also collect standard server logs (IP address, browser type, pages visited) for security and performance purposes.

2. Legal basis and purposes

We process your data on the following legal bases under GDPR Article 6:

• Contract (Art. 6(1)(b)): to provide services you have requested and manage client accounts.
• Legitimate interest (Art. 6(1)(f)): to respond to enquiries, improve our services, and maintain security logs.
• Consent (Art. 6(1)(a)): to run analytics cookies (Google Analytics 4) where you have opted in.

3. Cookies

We use strictly necessary cookies for authentication and session management. With your consent, we also use Google Analytics 4 cookies to understand how visitors use our site. You can withdraw consent at any time via the cookie banner. We do not use advertising or profiling cookies.

4. Data retention

• Contact enquiries: 2 years from last interaction, unless converted to a client relationship.
• Client records and invoices: 7 years from the date of the last transaction (Irish tax law requirement).
• Server logs: 90 days, then automatically deleted.
• Account data: retained while your account is active; deleted within 30 days of a verified erasure request.

5. Third-party processors

We share data only with processors under Data Processing Agreements (DPAs). Current subprocessors: Hostinger (primary hosting, EU — all PII at rest), DreamHost (legacy hosting / email infrastructure, USA — EU-US Data Privacy Framework), Revolut (payment processing + payouts, IE/UK — adequacy decision), Anthropic (AI assistant features, USA — Standard Contractual Clauses + supplementary measures per Schrems II), Meta (Facebook + Instagram integrations, USA — SCCs, opt-in only), GoDaddy (domain registry, USA — opt-in only), Google Tag Manager + Google Analytics (analytics, USA — EU-US Data Privacy Framework, opt-in only), SMTP delivery provider (transactional email). We do not sell your data. Cookie-based processors load only after consent.

5b. International transfers

Where personal data is transferred outside the EEA we rely on (a) the EU-US Data Privacy Framework where the recipient is certified, or (b) Standard Contractual Clauses (Module 2: Controller→Processor) under Commission Decision 2021/914 together with a Transfer Impact Assessment per Schrems II. The DPA template that we sign with B2B clients incorporates the same SCCs and is available on request. We do not transfer data to jurisdictions without adequate safeguards.

6. Your rights (GDPR)

As a data subject you have the right to:

• Access a copy of your personal data (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure ("right to be forgotten") where applicable (Art. 17)
• Restriction of processing in certain circumstances (Art. 18)
• Data portability in a machine-readable format (Art. 20)
• Object to processing based on legitimate interests (Art. 21)
• Withdraw consent at any time without affecting prior processing

To exercise any right, email contact@slothsphere.com. We will respond within 30 days.

7. Supervisory authority

You have the right to lodge a complaint with the Irish Data Protection Commission (DPC): www.dataprotection.ie · +353 (0)57 868 4800.

8. Contact

Data controller: SlothSphere, Ireland. Email: contact@slothsphere.com

9. Data security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. These include TLS encryption in transit, access controls, and regular security reviews. No method of transmission over the Internet is 100% secure; we cannot guarantee absolute security.

10. Social media integrations

SlothSphere connects to Meta platforms (Facebook, Instagram, Threads) solely to publish content on behalf of SlothSphere's own accounts. We do not collect or store your personal data from these platforms beyond what is strictly necessary for the connection. Meta's own Privacy Policy governs data processed on Meta's servers.

11. Children's privacy

Our services are not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us immediately so we can delete it.

12. Changes to this policy

We may update this policy periodically. We will notify active clients by email and display the updated date at the top of this page. Continued use of our services after changes constitutes acceptance of the updated policy.

13. Data deletion

You can request the deletion of your personal data at any time. See our Data Deletion page for full instructions. We will action all verified requests within 30 days.