Privacy Policy

YOUR PRIVACY RIGHTS AND OUR DATA PROTECTION COMMITMENTS

Change Notice (9 November 2026): We have changed our name from NHCarrigan to SpellWare. Only the name has changed. This Policy applies to your personal information in the same way as before, including information you gave us under our previous name.

Change Notice (14 October 2026): We have added Section 3.4 to explain how we use your details to send our newsletter and marketing emails, the right to withdraw your consent (Section 5.1(f)), and how long we keep newsletter subscription details (Section 6.2(e)).

Change Notice (9 October 2026): We have updated Section 8 to disclose our use of Cloudflare and zcal. On 6 October 2026 we updated Sections 2, 4, and 8 to disclose our use of Google Analytics, HubSpot, Secure Privacy, Google AdSense, Tree-Nation, and Google Fonts, and to explain how cookie consent is managed. See our Data Subprocessors disclosure for details.

1. INTRODUCTION AND SCOPE

1.1. About This Policy

This Privacy Policy (“Policy”) sets out how SpellWare (“we,” “us,” “our,” or “the Company”) collects, uses, stores, and protects your personal information when you use our services, applications, and platforms (collectively, the “Services”).

1.2. Policy Applicability

This Policy applies to:

(a) All services, websites, and applications operated by SpellWare;

(b) All users of our Services, regardless of location;

(c) All personal data collected through our Services;

(d) Both current and former users of our Services.

1.3. Additional Policies

Specific Services may be subject to additional privacy notices or terms (“Service-Specific Policies”). Where such policies exist:

(a) They supplement this main Policy;

(b) In case of conflict, the most privacy-protective terms shall apply;

(c) We shall clearly identify when additional policies apply.

1.4. Policy Updates

We reserve the right to update this Policy at any time. Changes may:

(a) Take effect immediately upon publication;

(b) Apply retroactively to previously collected data;

(c) Require your continued consent through ongoing use of our Services.

1.5. Acceptance and Consent

By using our Services, you:

(a) Acknowledge that you have read and understood this Policy;

(b) Consent to our collection and processing of your personal data as described;

(c) Agree to be bound by the current version of this Policy.

1.6. Contact for Privacy Matters

For all privacy-related inquiries, please contact us at: [email protected]

2. INFORMATION WE COLLECT

2.1. Types of Personal Information

We may collect the following categories of personal information:

(a) Identity Information: Name, username, email address, and demographic information;

(b) Technical Information: IP address, browser type, device information, and operating system;

(c) Usage Information: How you interact with our Services, including pages visited and features used;

(d) Communication Information: Messages sent through our platforms and support communications;

(e) Account Information: Registration details, preferences, and account settings;

(f) Consent Information: Your cookie consent choices and the date and time you made them.

2.2. Methods of Collection

We collect personal information through:

(a) Direct Provision: Information you provide when registering, using our Services, or contacting us;

(b) Automated Collection: Technical data collected through cookies, logs, and analytics tools such as Google Analytics and HubSpot;

(c) Third-Party Sources: Information from integrated services and platforms (with your consent).

2.3. Undocumented Collection

Despite our best efforts to maintain comprehensive documentation:

(a) Some data collection may occur that is not explicitly documented;

(b) This may result from system updates, third-party integrations, or technical changes;

(c) You maintain all privacy rights regardless of documentation status;

(d) We commit to honouring all data subject rights for any collected information.

3. HOW WE USE YOUR INFORMATION

3.1. Primary Purposes

We process your personal information for the following purposes:

(a) Service Provision: To provide, operate, and maintain our Services;

(b) Communication: To respond to inquiries and provide customer support;

(c) Improvement: To analyse usage patterns and enhance our Services;

(d) Security: To protect against fraud, abuse, and security threats;

(e) Legal Compliance: To fulfil our legal obligations and protect our rights.

3.2. Legal Basis for Processing

Our legal basis for processing personal information includes:

(a) Consent: Where you have explicitly agreed to processing;

(b) Contract: Where processing is necessary to perform our Services;

(c) Legitimate Interests: Where we have legitimate business interests that do not override your rights;

(d) Legal Obligation: Where required by applicable law.

3.3. Automated Decision-Making

We may use automated systems for:

(a) Spam detection and content moderation;

(b) Security threat identification;

(c) Service personalisation and recommendations.

You have the right to request human review of automated decisions that significantly affect you.

3.4. Newsletter and Marketing Emails

We send our newsletter only to people who have asked for it:

(a) Subscribing: When you subscribe on our website, we ask for details such as your name and email address. We use them to send you our newsletter, which goes out once a week and shares updates on our work;

(b) Consent: We send marketing emails only where you have agreed to receive them by ticking the relevant box on the sign-up form. You can withdraw that consent at any time;

(c) Transactional Emails: When you subscribe, you also agree to receive transactional emails from us, such as an email confirming your subscription;

(d) Unsubscribing: Every marketing email includes an unsubscribe link, and you can also ask us to remove you by writing to [email protected];

(e) Processing: Your subscription details are stored, and our emails are sent, through HubSpot, which is one of our subprocessors (see our Data Subprocessors disclosure). We do not sell your details (see Section 4.3).

4. DATA SHARING AND DISCLOSURE

4.1. Internal Access

Access to your personal information within our organisation is restricted to:

(a) Authorised team members on a need-to-know basis;

(b) Personnel responsible for system maintenance and support;

(c) Individuals involved in legal compliance and security matters.

4.2. Third-Party Sharing

We may share your information with:

(a) Service Providers: Third-party companies that help us operate our Services, including the analytics, customer relationship management, consent management, advertising, and hosting providers listed in our Data Subprocessors disclosure;

(b) Legal Authorities: When required by law, court order, or to protect legal rights;

(c) Business Partners: With your explicit consent and for specific purposes;

(d) Successors: In the event of a merger, acquisition, or business transfer.

4.3. Data Sale Prohibition

We do not and will not sell your personal information to third parties for commercial purposes.

4.4. International Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for such transfers, including:

(a) Adequacy decisions by relevant authorities;

(b) Standard contractual clauses;

(c) Other legally recognised transfer mechanisms.

5. YOUR PRIVACY RIGHTS

5.1. General Rights

Regardless of your location, you have the following rights regarding your personal information:

(a) Right of Access: Request a copy of the personal information we hold about you;

(b) Right of Rectification: Request correction of inaccurate or incomplete information;

(c) Right of Erasure: Request deletion of your personal information in certain circumstances;

(d) Right to Restrict Processing: Request limitation of how we process your information;

(e) Right to Data Portability: Receive your information in a structured, commonly used format;

(f) Right to Withdraw Consent: Withdraw any consent you have given at any time, including by using the unsubscribe link in our emails.

5.2. Exercising Your Rights

To exercise any of these rights:

(a) Submit requests through our Privacy Request Form (Preferred): https://mktg.spellware.dev/privacy

(b) Alternatively, submit requests to [email protected] from the email address associated with your account;

(c) Provide sufficient information to verify your identity;

(d) Specify clearly which right you wish to exercise;

(e) Include any relevant details or documentation to support your request.

5.3. Response Timeframes

We endeavour to respond to all privacy requests within 7-10 business days. For complex requests that require additional time, we will notify you and respond within thirty (30) days as required by applicable data protection laws (including GDPR).

5.4. Limitations on Rights

Your privacy rights may be limited where:

(a) Deletion would compromise essential functionality for all users;

(b) We have overriding legitimate interests or legal obligations;

(c) Information is necessary for the establishment, exercise, or defence of legal claims;

(d) Processing is required for compliance with legal obligations.

6. DATA RETENTION AND DELETION

6.1. Retention Principles

We retain personal information based on the following principles:

(a) Data Minimisation: We keep only what is necessary for the stated purposes;

(b) Purpose Limitation: Information is retained only as long as needed for its original purpose;

(c) Legal Requirements: Some information may be retained to comply with legal obligations.

6.2. Retention Periods

General retention periods include:

(a) Active Account Data: Retained whilst your account remains active;

(b) Inactive Account Data: Retained for up to twelve (12) months after last activity;

(c) Communication Records: Retained for up to three (3) years for support purposes;

(d) Legal and Compliance Data: Retained as required by applicable laws;

(e) Newsletter Subscriptions: Retained until you unsubscribe or ask us to delete them.

6.3. Automated Deletion

Heads Up!

The policy or policies in this section are still a work in progress. We have not yet implemented the necessary infrastructure to comply with this section.

We are working very hard to get them in place as soon as possible. If you would like to help, consider applying to join our team!

Where technically feasible, we implement automated systems to:

(a) Delete information that has exceeded its retention period;

(b) Anonymise data where deletion is not possible;

(c) Regularly review and purge unnecessary information.

6.4. Backup Retention

For system recovery purposes:

(a) Backups may contain personal information beyond active retention periods;

(b) Backup systems are secured and accessed only when necessary for restoration;

(c) Personal information in backups is subject to the same protection standards.

7. DATA SECURITY

7.1. Security Measures

We implement comprehensive security measures including:

(a) Encryption: Data is encrypted both in transit and at rest;

(b) Access Controls: Multi-factor authentication and role-based access restrictions;

(c) Monitoring: Continuous monitoring for security threats and unauthorised access;

(d) Regular Audits: Periodic security assessments and vulnerability testing.

7.2. Personnel Security

All team members with access to personal information:

(a) Undergo privacy and security training;

(b) Sign confidentiality agreements;

(c) Are subject to background checks where legally permissible;

(d) Face disciplinary action for unauthorised access or misuse.

7.3. Incident Response

In the event of a data breach:

(a) We will investigate and contain the incident promptly;

(b) Affected users will be notified within seventy-two (72) hours where feasible;

(c) Relevant authorities will be notified as required by law;

(d) We will provide regular updates on our investigation and remediation efforts.

7.4. Third-Party Security

Third-party service providers must:

(a) Maintain equivalent security standards;

(b) Sign data processing agreements;

(c) Undergo regular security assessments;

(d) Notify us immediately of any security incidents.

8. COOKIES AND TRACKING TECHNOLOGIES

8.1. Use of Cookies

We use cookies and similar technologies to:

(a) Remember your preferences and settings;

(b) Analyse usage patterns and improve our Services;

(c) Provide personalised content and features;

(d) Maintain security and prevent fraud.

8.2. Types of Cookies

We may use the following types of cookies:

(a) Essential Cookies: Necessary for basic functionality;

(b) Performance Cookies: Help us understand how our Services are used;

(c) Functional Cookies: Remember your choices and preferences;

(d) Targeting Cookies: Used to deliver relevant content and advertising (with consent).

8.3. Cookie Management

You can manage cookies through:

(a) Your browser settings;

(b) Our cookie consent banner and preference centre, provided by Secure Privacy, which you can reopen at any time to change your choices;

(c) HubSpot’s own cookie banner, which manages consent for HubSpot cookies separately;

(d) Opt-out tools provided by third-party services.

Please note that disabling certain cookies may affect the functionality of our Services.

8.4. Third-Party Services That Use Cookies

Our websites and documentation load the following third-party services, each of which may set cookies or process similar identifiers:

(a) Google Analytics: Measures how our websites and documentation are used, including pages visited, devices, and approximate location, and is blocked until you consent through our cookie consent banner;

(b) HubSpot: Tracks website visits, captures information you submit through forms, and powers our live chat widget, with consent for its cookies managed through HubSpot’s own cookie banner;

(c) Secure Privacy: Displays our cookie consent banner and records your consent choices;

(d) Google AdSense: Displays advertisements and measures their performance, and may personalise advertisements where permitted;

(e) Tree-Nation: Displays our carbon offset and tree counter badges;

(f) Google Fonts: Delivers the typefaces used on our websites;

(g) Cloudflare: Delivers and protects our websites and assets, and may set security cookies.

Details of the information each service processes, and links to their privacy policies, are provided in our Data Subprocessors disclosure.

8.5. Live Chat and Forms

If you use the live chat widget or submit a form on one of our websites, the information you provide, such as your name, email address, and message, is processed by HubSpot so that we can respond to you. Please avoid sharing sensitive information through the live chat widget. If you book a meeting with us through zcal, the details you enter on the booking form are processed by zcal so that we can schedule and confirm the meeting.

9. CHILDREN’S PRIVACY

9.1. Age Restrictions

Our Services are not intended for children under the age of thirteen (13), or the minimum digital age of consent in your jurisdiction, whichever is higher.

9.2. Collection from Children

We do not knowingly collect personal information from children under the applicable minimum age. If we become aware that we have collected such information:

(a) We will delete the information promptly;

(b) We will notify the child’s parent or guardian if possible;

(c) We will take steps to prevent future collection.

9.3. Parental Rights

Parents and guardians have the right to:

(a) Review any personal information we hold about their child;

(b) Request deletion of their child’s information;

(c) Refuse to permit further collection from their child.

10. CONTACT INFORMATION AND COMPLAINTS

10.1. Privacy Contact

For all privacy-related matters, contact us at:

Email: [email protected]

Discord Community: https://chat.spellware.dev (for general inquiries)

10.2. Information to Include

When contacting us about privacy matters, please provide:

(a) Your full name and contact information;

(b) Details of your request or concern;

(c) Any relevant account information or identifiers;

(d) Supporting documentation if applicable.

10.3. Response Commitment

We commit to:

(a) Acknowledging all privacy inquiries within two (2) business days;

(b) Providing substantive responses within the timeframes specified in this Policy;

(c) Treating all inquiries with respect and confidentiality;

(d) Following up to ensure your concerns have been adequately addressed.

10.4. Complaints and Escalation

If you are not satisfied with our response:

(a) You may request escalation to senior management;

(b) You have the right to lodge a complaint with relevant data protection authorities;

(c) You may seek independent legal advice regarding your rights.

10.5. Supervisory Authority Contact

For complaints in jurisdictions with data protection authorities, you may contact your local supervisory authority. In the European Union, you can find your local authority at: https://www.edpb.europa.eu/about-edpb/our-members_en

11. UPDATES

11.1. Policy Updates

We may update this Policy periodically to reflect:

(a) Changes in our data processing practices;

(b) New legal requirements or regulatory guidance;

(c) Feedback from users and data protection authorities;

(d) Technological developments and security enhancements.

11.2. Notification of Changes

We will notify you of material changes through:

(a) Prominent notices on our Services;

(b) Email notifications to registered users;

(c) Updates to our website and documentation.

11.3. Version History

Previous versions of this Policy are available upon request for transparency and reference purposes.

---

This Privacy Policy is designed to comply with applicable data protection laws whilst providing clear information about our privacy practices. If you have any questions or concerns, please do not hesitate to contact us.