Legal
Privacy policy
This explains what we collect, why we collect it, who else touches it, and how to make us delete it. It describes what the product does today, not what we hope it will do later.
1. The short version
If you only read one section, read this one. The rest of the page is the same thing said carefully.
- If you join the waitlist or apply as a founding partner, we keep what you typed into the form so we can contact you about SpendTower. Nothing else.
- We do not sell your information, and we do not share it for advertising.
- We use one analytics tool to understand which parts of this site work. We do not run advertising trackers.
- When the product launches, it reads usage and billing metadata from your AI providers. It does not read your prompts or your model outputs.
- Email hello@spendtower.com and we will delete your details. You do not need to give a reason.
2. Who we are
SpendTower is a product operated by [LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS]. For the purposes of data protection law we are the controller of the information described in this policy.
You can reach us about anything on this page at hello@spendtower.com.
3. What we collect
Information you give us
Our forms ask for the minimum we need to have a conversation with you.
| Where | What |
|---|---|
| Waitlist form | Your email address. |
| Founding partner form | Your name, email address, company, and anything you choose to write in the free-text field about your current AI spend. |
| Email to us | Whatever you send, and our reply. |
| Booking a call | Handled by our scheduling provider. See section 5. |
Please do not put confidential information, credentials, or personal information about other people into the free-text field. It is not the right place for it, and we would rather you told us on a call.
Information collected automatically
- Analytics events. Page views, clicks on buttons and links, and which headline variant you were shown. These are tied to a randomly generated identifier, not to your name.
- Server and request data. Our host processes standard request information such as IP address, user agent, and timestamp in order to serve the page and to protect the site from abuse.
- Abuse prevention. Our signup endpoints apply a short-lived, in-memory rate limit keyed on IP address. This is held only in the memory of a running server instance and is never written to storage.
We do not use advertising cookies, cross-site trackers, session recording, or heat mapping, and we do not buy contact lists.
4. How we use it
| Purpose | Basis |
|---|---|
| Contacting you about early access, founding partnership, or a reply you asked for | Your consent, given when you submit the form. |
| Understanding which parts of the site work, so we can improve it | Our legitimate interest in running and improving our own website. |
| Keeping the site available and protecting it from spam and abuse | Our legitimate interest in security. |
| Meeting legal and accounting obligations | Compliance with a legal obligation. |
We will not use your details for an unrelated purpose without telling you first. Joining the waitlist signs you up for news about the launch, not for a marketing newsletter.
5. Who else processes it
We keep the list of third parties short on purpose, and we would rather name them than describe them vaguely as trusted partners.
| Provider | What it does for us |
|---|---|
| Vercel | Hosts this website and runs the functions behind our forms. Processes request data such as IP address in the course of serving pages. |
| Waitlist and founding partner submissions are appended to a Google Sheet that only we can access, through a service account limited to that spreadsheet. | |
| PostHog | Product analytics for this website, as described in section 7. |
| Cal.com | Scheduling, if you choose to book a call. What you give the booking page is processed by them under their own privacy policy. |
We may also disclose information where the law requires it, or where it is necessary to establish or defend a legal claim. If our business is ever transferred to another company, information would move with it and we would tell you before it did.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
6. Product data and provider credentials
This section describes SpendTower the product rather than this website. It is written now so it is clear before you connect anything, and it reflects a design decision we do not intend to reverse.
- We do not read your prompts or your model outputs. SpendTower connects through each provider's usage and billing APIs, which return metadata: model name, token counts, cost, key or project identifier, and timestamp. Prompt content is not requested and is not stored.
- We do not sit in your request path. Nothing is installed in your application and no traffic is proxied through us, so an outage on our side cannot affect your production traffic.
- Credentials are read only. We ask for keys scoped to usage and billing. They are encrypted at rest, decrypted only within the ingestion path, and never written to logs. You can revoke a key in your provider's console at any time.
- Tenancy is enforced at the query layer. Every record is scoped to an organisation, and that scope is never taken from the client.
If we ever offer an optional inline gateway that does sit in the request path, it will be something you deliberately opt into, with its own disclosure, and it will not be switched on for you.
7. Cookies and analytics
We use PostHog to understand how this site is used. It sets first-party cookies or equivalent local storage to recognise a returning browser using a random identifier. We have configured it to create person profiles only for identified users, so ordinary browsing is counted without building a profile of you.
The analytics script is loaded only when analytics is configured for the deployment you are visiting. If it is not configured, no request is made to the analytics provider at all.
We set no advertising cookies. You can block analytics with your browser settings, an extension, or Do Not Track, and the site will work exactly the same.
8. How long we keep it
| What | How long |
|---|---|
| Waitlist and founding partner submissions | Until you ask us to delete them, or until we stop pursuing the opportunity and no longer need them. |
| Email correspondence | For as long as it is useful for the relationship, then deleted. |
| Analytics events | Per our analytics provider's retention settings. |
| Rate limiting records | Minutes. They exist only in the memory of a running server instance. |
9. Your rights
Depending on where you live, you may have the right to:
- Ask what we hold about you and get a copy of it.
- Have inaccurate information corrected.
- Have your information deleted.
- Object to or restrict how we use it, including withdrawing consent at any time.
- Receive your information in a portable format.
- Complain to your local data protection authority.
Email hello@spendtower.com and we will action it. We will not ask you to justify the request, and we will not make the process deliberately difficult. We aim to respond within thirty days.
10. International transfers
Our providers listed in section 5 may process information in countries other than yours, including the United States. Where information is transferred out of the United Kingdom or the European Economic Area, we rely on the safeguards those providers offer, such as standard contractual clauses.
11. Security
Everything is served over HTTPS. Secrets live in environment variables and a secret manager, never in our source repository. Access to signup data is limited to the people who need it. The forms are protected against automated abuse by rate limiting, origin checks, and input validation.
We are not SOC 2 certified today. SOC 2 readiness is on our roadmap and we would rather say this plainly than let a badge-shaped gap imply otherwise. If your security review needs something specific, ask and we will tell you honestly whether we have it.
No system is perfectly secure. If you believe you have found a vulnerability in this site, please write to hello@spendtower.com and give us a reasonable chance to fix it before disclosing it publicly. We will not pursue you for reporting something in good faith.
12. Children
SpendTower is a business product and is not directed at anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, tell us and we will delete it.
13. Changes to this policy
If we change this policy we will update the date at the top of the page. If a change materially affects how we handle information you have already given us, we will contact you directly rather than relying on you noticing a changed date.
14. Contact us
Email hello@spendtower.com, or write to [LEGAL ENTITY NAME] at [REGISTERED ADDRESS].