Privacy Policy

SweepSquad is operated by SweepSquad Limited ("we", "us"), a company registered in England and Wales under number 17494044, registered office 126 Wish Hill, Willingdon, Eastbourne, East Sussex BN20 9HL. Our correspondence address is SweepSquad, 57 Newtown Road, Brighton, East Sussex, BN3 7BA.

Until 2 October 2026, SweepSquad was run by Simply Beautiful Print Limited. SweepSquad Limited is now the data controller for the personal data SweepSquad holds. Nothing about what we collect or how we use it has changed.

Last updated: 12 October 2026. Version: v1.8.

1. Who is responsible for your data

1.1 For your account and billing data, and for the consent and self-certification records we keep, we are the data controller.

1.2 When an Organiser adds people to a sweepstake, the Organiser decides whose details to add and must have the right to share them, and for that information we act on the Organiser's behalf as a data processor. A separate data processing agreement governs this where required. Where we deal with Participants directly (sending service emails, letting them sign in, and recording their own marketing choices) we are responsible for that data ourselves as data controller, as section 3 explains.

2. What we collect

2.1 Account data: name, work email, organisation, password (stored hashed), role and, if you add one, a profile photo. Participants who sign in to see their sweepstakes have an account with just their name, email and any photo they add.

2.2 Billing data: subscription plan and payment status. Card details are handled directly by our payment provider, Stripe; we do not store full card numbers.

2.3 Sweepstake data you create: sweepstake names, settings, participant entries and allocations, results, and any contribution amounts you choose to record. We do not process any actual entry payments — those are handled by you, outside the service.

2.4 Consent and certification records: the version and exact text of the terms and disclaimers you were shown, your confirmations, and a timestamp and identifier, kept as evidence of agreement.

2.5 Technical data: IP address, device and browser information, and usage logs, collected to run and secure the service. We also keep usage statistics about how the site is used (see section 9).

2.6 Email delivery data: our emails record whether they were delivered, whether they were opened and which links were clicked. We use this to know our emails arrive and to stop sending to addresses that bounce. To judge how engaged someone is, we look at what they do in the app, not at email opens.

3. If an Organiser added you to a sweepstake

3.1 The Organiser gives us your name and, if they choose, your email address.

3.2 We send you only service emails about your sweepstake, such as the draw, results and any sign-in link you ask for. We send you marketing only if you choose it yourself on our pages and then confirm by email. An Organiser cannot agree to marketing on your behalf.

3.3 You can sign in with a link we email you, with no password. When you sign in, we record that you agreed to our terms and this policy.

3.4 A photo next to your name comes from the Organiser, from you, or from Gravatar, but Gravatar is used only if the Organiser's organisation switches it on (see section 5).

4. Why we use it and our lawful bases

• To provide the service and perform our contract with you — performance of a contract.
• To take payment and manage subscriptions — contract and legal obligation (tax/accounting).
• To keep records of consent and self-certification, and to operate the service securely and prevent misuse — legitimate interests (running a lawful, secure product and being able to evidence agreement).
• To produce usage statistics that help us improve SweepSquad — legitimate interests. Linking those statistics to an Organiser's account and recording sessions happens only with consent.
• To meet legal and regulatory obligations — legal obligation.
• For optional marketing emails — consent, which you can withdraw at any time.

Where we rely on legitimate interests, we have considered your rights and will provide details of our assessment on request.

5. Who we share it with

5.1 Service providers who help us run the product, under contracts that require them to protect your data:

• Netlify — website hosting.
• Lovable Cloud / Supabase — application database and backend infrastructure where your account and sweepstake data are stored.
• Stripe — payment processing for subscriptions.
• Resend — delivers the emails the service sends. It processes recipients' email addresses and delivery events (delivered, opened, clicked, bounced).
• Google Workspace — our own mailbox, for messages you send to hello@sweepsquad.co.uk.
• PostHog — usage statistics and, if you allow it, session recordings (see section 9). Our PostHog data is stored in the EU, and PostHog doesn't keep IP addresses with it.
• Gravatar (run by Automattic) — only if an Organiser switches on "Use Gravatar photos". We then share a hashed identifier made from a participant's email address with Gravatar, which Gravatar can match to an address it already holds, and your browser loads any photo from Gravatar. If there's no Gravatar photo, initials are shown instead. Organisers can switch this off at any time, and it is off by default.

5.2 Authorities or advisers where we are legally required to disclose, or to establish or defend legal claims.

5.3 We do not sell your personal data.

6. International transfers

Some of our providers (for example Google, Stripe and PostHog) may process data outside the UK, including in the United States. Where they do, we rely on an adequacy decision or appropriate safeguards such as the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. Details are available on request.

7. How long we keep it

• Account and sweepstake data: while your account is active. If you delete your account we erase it straight away (or at the end of your paid period if you choose that). If you pause your account, we delete it 12 months after it was paused. If you don't sign in for 12 months, we delete your account then. Either way, we email you 30 days beforehand.
• Billing records: as long as required by law (6 years), held by Stripe.
• Consent and self-certification records: for 6 years after the related activity, because they may be needed as evidence. If your data is erased, we keep these records with your name and email removed.
• Technical logs: 12 months.
• Usage statistics: 12 months.
• Session recordings: 30 days.

8. Your rights

Under UK data protection law you can ask to access, correct, delete or port your data, object to or restrict certain processing, and withdraw consent. To exercise these rights contact hello@sweepsquad.co.uk. If you can't sign in, you can ask us to delete your data at sweepsquad.co.uk/account/delete. A request is valid however it reaches us. If you are a Participant, we'll handle requests about your sign-in, emails and marketing choices ourselves; for what the Organiser entered about you, we may need to involve the Organiser.

You can complain to the Information Commissioner's Office (ICO) at ico.org.uk, though we'd appreciate the chance to put things right first.

9. Cookies and usage statistics

We use essential cookies to run the service.

We also keep usage statistics with PostHog, so we can see which pages and steps people use, find where they get stuck and fix it. The law allows this without asking first, as long as we tell you and make it easy to say no. PostHog stores a random identifier on your device and records the pages you visit and the buttons you press. It doesn't record what you type. These statistics aren't linked to your name or email, aren't shared with anyone else and aren't used for advertising. To stop them, choose Reject all in our cookie banner or turn off Usage statistics in Cookie settings, linked at the bottom of every page. If your browser sends a Global Privacy Control signal, we treat that as a no.

If you choose Accept all or switch on Link to my account, and you're signed in as an Organiser, we connect these statistics to your account so we can understand how organisations use SweepSquad. We use your account number for this, never your name or email. We never do this for Participants.

If you also allow Session recordings, we record how you move around the organiser dashboard so we can see where screens confuse people. Everything on screen, including names and anything you type, is blanked out before it leaves your device, and recordings are deleted after 30 days. We never record the pages Participants see.

Before anything reaches PostHog, we remove sign-in email addresses and one-time sign-in links from page addresses. See our Cookie Policy for the full list of cookies and how to change your choices.

10. Children

The service is for users aged 18 and over and is not intended for children. We do not knowingly collect data from under-18s.

11. Changes and contact

We may update this policy and will note the date above. Questions: hello@sweepsquad.co.uk, SweepSquad, 57 Newtown Road, Brighton, East Sussex, BN3 7BA. Data protection contact: Michael Tyrrell.