Privacy policy
What we collect, why we collect it, who else touches it, how long we keep it, and what you can make us do about it.
Last updated 29 September 2026
Who we are
Second Shadow Ltd is the data controller, the company that decides what happens to your personal data. We are registered in England & Wales, company number 17466353, with our registered office at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.
For anything about your data, email contact@secondshadow.com. For anything security-related, email security@secondshadow.com.
We are in the process of registering with the Information Commissioner's Office.
What we collect
When you join the early-access list
Your name, work email address and company, and a password you choose. Optionally, which CRM you use today and roughly how big your team is. You choose separately whether to receive marketing email; it is not a condition of joining.
The longer application form, which also asks your job role, your industry and a free-text note about what you need, is not open at the moment. If it reopens, those three are the only additions.
When you have an account
Your email address and a hashed password. If you turn on two-factor authentication, the secret that makes it work. Sign-in times and session records.
If you set up a passkey, we store a public key, an identifier for it, the name of the app holding it (your password manager, usually) and when it was created. The private half never leaves your device. We do not collect, receive or store any biometric data. Your fingerprint or face unlocks the key on your own device; what reaches us is a signature, never a measurement of you. You can remove a passkey from your account at any time.
If you become a customer
Billing contact details, billing address, VAT number where you give one, and the plan you chose. We do not hold your card number . When payments start, a payment provider will handle that and we will update this policy before it does.
If you book a demo
Demo bookings happen on a page behind your sign-in, through a calendar hosted by Google that loads only when you ask it to. The name, email and notes you type into that calendar go to Google directly and reach us as a calendar event; we deliberately do not pre-fill any of it. If you would rather Google were not involved, email us and we book the slot by hand.
Where you came from
If you agreed to analytics cookies, we record which campaign or website brought you to us the first time you visited: the campaign tags in the link, the site that referred you, and which page you landed on. We keep this against your account so we know which channels actually reach people like you.
Before you sign up, that information sits in a cookie on your own device for 90 days and we never see it. If you never sign up, it expires there. If you decline analytics cookies, none of it is collected at all.
When you visit the site
We count visits with SecondShadow's own web tracker, on our public pages (never on a page behind a sign-in). It records the page you are on, the site that sent you and how long the page was open. Until you agree to analytics in the cookie banner it stores nothing on your device; if you agree, it keeps a random code in your browser so we can tell a return visit from a new one, and withdrawing consent deletes it. Anything in the page address that looks like an email address or a token is removed, and so is everything after the ? except campaign tags. Your IP address and browser are turned into a code that changes every day and are not kept, so we cannot recognise you from one day to the next.
When you submit a form that asks for your email address, the “Request access” box or the contact form, it passes us that email address, and your name if the form asked for it, as an enquiry. That happens when you press the button, whatever you chose in the cookie banner, and even if you do not finish signing up. It never reads a password or anything else you type, and never reads the sign-in form. A person on our team decides what, if anything, becomes of an enquiry. The details are in the cookie policy.
If you play the game
The waitlist page ends on a small game. If you play it signed in, we keep your best distance, how many runs you have had, and the moments you jumped on your best run, against your account, so the game can replay that run as your shadow. The public leaderboard shows scores under made-up names that we derive from your account and that you cannot be identified from; nobody's real name, email or company appears on it. If you play signed out, your best score stays in your own browser, and reaches us only if you later sign in and open the game again. Scores are deleted with your account.
Our own staff can see your best distance and how many times you have played, next to your name on our internal signup list - it tells us how interested people on the waitlist are. They cannot see the recording of your run: that is kept so the game can draw your shadow for you, and nobody but you can read it.
Automatically
Our hosting and database providers log IP addresses and request details as part of running the service. We count sign-in and form attempts against a one-way hash of the identifier, so we can stop abuse without keeping a list of who tried what.
Why we are allowed to
| What | Basis |
|---|---|
| Creating and running your account | Performing our contract with you |
| The qualification questions at signup | Our legitimate interest in understanding who is asking for the product |
| Email about your own account | Performing our contract. Not marketing, so there is no opt-out; you cannot have an account and refuse the sign-in link |
| Marketing email | Your consent |
| Analytics and attribution cookies | Your consent |
| Recognising a return visit, with a code kept in your browser | Your consent |
| Counting visits without storing anything on your device | Our legitimate interest in understanding how the site is used |
| Your email address from “Request access” or the contact form, as an enquiry | Our legitimate interest in replying to people who ask to hear from us |
| Invoices and tax records | A legal obligation we cannot waive |
| Security, rate limiting, audit logging | Our legitimate interest in not being defrauded |
Who else touches it
We use other companies to run the service. They act on our instructions and cannot use your data for their own purposes.
| Who | What for | Where |
|---|---|---|
| Supabase | Our database and sign-in system | London (UK) |
| Vercel | Hosting the website | Global, US company |
| Resend | Sending email. Ours goes out from mail.secondshadow.com | US |
| Cloudflare | DNS and protecting our staff console | Global |
| Analytics and tag management, only if you consent; the demo-booking calendar, only if you load it | US | |
| CookieYes | Recording your cookie choice | EU / US |
| Amazon Web Services | Running SecondShadow's own product, where what our page counter collects is kept | London (UK), behind a global delivery network |
Your account and everything in it is stored in London. The substantive personal data does not leave the UK. Where a provider above is outside the UK, the transfer is covered by the standard contractual clauses and the UK addendum.
We do not sell your data. We do not share it with anyone for their own marketing.
How long we keep it
| What | How long |
|---|---|
| Your account and everything attached to it | Until you delete the account |
| Where you came from | Deleted with the account |
| Invoices and tax records | Six years after the tax year. This outlives account deletion, because HMRC requires it |
| Our record of staff actions | Kept while we are trading |
| Analytics | 14 months |
| Our page counter's visit records | 13 months |
| An email address or name from a form, kept as an enquiry | Cleared 90 days after we have dealt with it, unless you become a contact of ours |
Worth saying plainly, because policies often skate over it: deleting your account does not delete your invoices. We are required to keep those.
What you can make us do
You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to how we use it, or ask us to send it elsewhere. Email contact@secondshadow.com and we will respond within one month.
Some of this is self-service and some is not, and we would rather say so than imply a button exists:
- Marketing email: turn it off in your account, or from the unsubscribe link in any marketing email. No sign-in needed for the link.
- Cookies: change your choice any time from the cookie settings on this site.
- Your account: email, password and passkeys are self-service.
- The qualification answers from signup have no edit screen yet. Email us and we will change them.
- A copy of your data has no download button yet. Email us and we will put one together.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first, but it is your right either way.
Cookies
Nothing but strictly necessary cookies is set until you agree. The detail is in the cookie policy.
Children
This is a business product and is not intended for anyone under 18. We do not knowingly collect data about children.
Changes
If we change this policy we will update the date at the top. If the change materially affects you, we will tell you rather than relying on you noticing.