Privacy Policy

Last updated September 8, 2026

This policy explains what personal information Spencer Labs collects, why we collect it, who we share it with, and the choices you have. It covers spencerlabs.co and the services we provide from it. HostRev has its own privacy policy published at hostrev.co.

1. Who is responsible for your data

Spencer Labs Ltd. Co., trading as Spencer Labs, is the controller of the personal information described in this policy. Contact us at spencerlabsco@gmail.com or by post at 128 S 1st W St, Paris, ID 83261 with any privacy question or request.

2. Information we collect

Information you give us

Contact details — your name, email address, phone number, company name, and postal address when you contact us or become a client.
Engagement information — what you tell us about your business, systems, and requirements so we can scope and deliver the work.
Correspondence — the content of emails, messages, and calls, including recordings of strategy sessions where we have told you the session is recorded.

Payment information

Payments are processed by Stripe, Inc. Card numbers are entered directly with Stripe and are never received or stored on our systems. We receive only what Stripe passes back to us: the billing name and email, the last four digits of the card, its expiry, the amount, and whether the payment succeeded. Stripe's handling of that data is governed by the Stripe privacy policy.

Information collected automatically

Our site uses Cloudflare Web Analytics, which reports aggregate traffic — page views, referrers, country, and device type. It does not use cookies, does not fingerprint visitors, and does not build a profile of you across sites. Our hosting provider also keeps standard server logs, including IP addresses, for security and troubleshooting.

We do not use advertising cookies or third-party tracking pixels on this site.

Client system data

Delivering development and support work sometimes means access to systems that hold personal data belonging to your customers or staff. We access that data only as needed to perform the work you have asked for, we do not use it for our own purposes, and we hold it under the confidentiality terms of our agreement with you. For that data you are the controller and we act as your processor.

3. Why we use it, and our legal basis

To provide the services you have purchased — performance of our contract with you.
To respond to enquiries and prepare quotes — steps taken at your request before entering a contract.
To take payment and keep accounting records — performance of our contract and compliance with legal obligations.
To secure and improve our site and services — our legitimate interest in operating a safe, working business.
To send service messages such as receipts, renewal notices, and outage notifications — performance of our contract.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not send marketing email to people who have not asked for it.

4. Who we share it with

We share personal information only with service providers who help us run the business, and only to the extent they need it:

Stripe — payment processing and subscription billing
Cloudflare — website hosting, DNS, security, and privacy-preserving analytics
Google (Workspace) — email and document storage
Hosting and infrastructure providers — running applications we build and maintain
Professional advisers — accountants and lawyers, where necessary

We may also disclose information where the law requires it, to protect our legal rights, or to a successor entity if the business is sold. In that last case you will be notified.

5. How long we keep it

Enquiries that do not become clients — 24 months, then deleted.
Client records and correspondence — for the engagement and 7 years afterwards, to meet tax and record-keeping obligations.
Financial and transaction records — 7 years, as required by law.
Server logs — typically 90 days.
Session recordings — 12 months, or deleted sooner on request.

6. How we protect it

The site is served over HTTPS. Access to client systems and data is restricted to those who need it, protected by multi-factor authentication, and credentials are stored in an encrypted password manager. Access to a client's systems is revoked at the end of an engagement unless a care plan keeps it active.

No system is perfectly secure. If a breach affecting your personal information occurs, we will notify you and any relevant regulator as the law requires.

7. Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, object to or restrict how we use it, receive it in a portable format, and withdraw consent where we relied on it.

California residents have rights under the CCPA to know what personal information is collected, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA.

To exercise any right, email spencerlabsco@gmail.com. We respond within 30 days and may need to verify your identity first. There is no charge. If you are unsatisfied with our response, you may complain to your local data protection authority.

8. International transfers

We operate from the United States and our service providers are primarily US-based, so information you give us is processed in the United States. If you are outside the US, appropriate safeguards such as standard contractual clauses are applied by those providers where required.

9. Children

Our services are for businesses. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, email us and we will delete it.

10. Changes to this policy

We update this policy when our practices change. The "last updated" date above always reflects the current version, and we will notify clients by email before any material change takes effect.

11. Contact

Privacy questions and requests: spencerlabsco@gmail.com

Spencer Labs Ltd. Co.
128 S 1st W St, Paris, ID 83261