Privacy policy
What we collect, why we collect it, how long we keep it, and what you can ask us to do about it.
The short version
- Right now this website does one thing with your data: it runs a waitlist.
- We collect your name, email, country and what you are interested in.
- We use it to email you about Shuttlevest, and for nothing else.
- We do not sell your personal data. We never will.
- You can leave the waitlist and have your data deleted at any time, by replying to any email or writing to privacy@shuttlevest.com.
1. Who is responsible for your data
Shuttlevest Limited, a company registered in England and Wales under company number 17498721, registered office 128 City Road, London, EC1V 2NX, United Kingdom, is the data controller for the personal data described in this policy.
For any privacy question or request, contact privacy@shuttlevest.com.
When you later use a regulated service provided by one of our partners, that partner will normally be a data controller in its own right for the data it needs to deliver that regulated service, and will have its own privacy notice. We will make that clear, and link to their notice, before you sign up to anything. See how our services are regulated.
2. What we collect
Information you give us
| Data | Why | Lawful basis |
|---|---|---|
| Name | To address you properly in our emails | Consent |
| Email address | To send you the product updates you asked for | Consent |
| Country | To understand which markets to prioritise and whether a service can be offered where you live | Consent; legitimate interests |
| Main interest | To shape what we build and make our updates relevant | Consent; legitimate interests |
| Anything you send us by email | To answer you | Legitimate interests |
Information we collect automatically
| Data | Why | Lawful basis |
|---|---|---|
| A one-way cryptographic hash of your IP address | To rate-limit the signup form and prevent abuse. We store the hash, not the address itself, and the hash cannot be reversed back into your IP. | Legitimate interests (security) |
| Browser user-agent string | To detect automated abuse and diagnose display problems | Legitimate interests (security) |
| The page you signed up from | To understand which of our pages work | Legitimate interests |
| Server log data held by our hosting provider | To keep the site running and secure | Legitimate interests |
Our "legitimate interests" above are keeping this website secure and available, preventing abuse of our forms, and understanding demand for the product so we build the right thing. We have considered your interests and rights, and we use the minimum data that achieves those aims.
What we do not collect
This website does not ask for and does not collect financial information, identity documents, bank details, card numbers or national identifiers. Never send those to us by email. When regulated services launch, identity verification will be carried out through our regulated partners and their specialist providers under a separate, clearly explained process.
3. Cookies
We use a small number of cookies and similar technologies. The full list, what each one does, and how to change your choice is in our cookie policy.
4. How we use your data
- To send you product updates, launch news and early-access invitations for Shuttlevest.
- To understand which markets and features matter most to the people waiting for us.
- To keep the website and the signup form secure and free from abuse.
- To answer questions you send us.
- To meet our legal and regulatory obligations.
We do not use your data for automated decision-making that produces legal effects for you, and we do not carry out profiling of that kind.
5. Who we share it with
We do not sell your personal data, and we do not share it for anyone else's marketing.
We share it only with service providers that help us run Shuttlevest, acting on our instructions under a written contract:
- Our hosting provider, which stores the website and the waitlist database.
- Our email provider, to deliver the updates you signed up for.
- Professional advisers such as lawyers and accountants, where genuinely necessary.
We may also disclose data where we are legally required to, to establish or defend legal claims, or to prevent fraud and financial crime.
If Shuttlevest is involved in a merger, acquisition or sale of assets, your data may transfer to the acquiring entity. We would notify you before it became subject to a different privacy policy.
6. International transfers
Some of our service providers operate outside the United Kingdom. Where personal data is transferred outside the UK, we rely on an adequacy decision or on appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with additional measures where needed. You can ask us for details of the safeguards used.
7. How long we keep it
- Waitlist records: until you ask us to remove them, until you unsubscribe, or until 24 months after launch if you never became a customer — whichever comes first.
- Security data (hashed IP, user agent): 12 months.
- Email correspondence: up to 24 months after the matter is closed.
- Records we must keep by law: for the period the law requires.
When a retention period ends we delete the data or irreversibly anonymise it.
8. Your rights
Under UK data protection law you have the right to:
- Be informed about how your data is used — this policy.
- Access a copy of the personal data we hold about you.
- Rectification of data that is inaccurate or incomplete.
- Erasure of your data in certain circumstances.
- Restrict how we process your data in certain circumstances.
- Data portability — receive your data in a structured, machine-readable format.
- Object to processing based on our legitimate interests.
- Withdraw consent at any time, without affecting processing already carried out.
- Opt out of marketing at any time, via the unsubscribe link in any email.
To exercise any of these, email privacy@shuttlevest.com. We will respond within one month. There is no charge, and we may ask you to confirm your identity first.
9. Complaining to the regulator
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the UK's data protection regulator:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint
10. How we protect your data
We use encryption in transit (HTTPS across the whole site), access controls on the administration area, hashing rather than storage of IP addresses, rate limiting on our forms, and the principle of least privilege for anyone who can see signup data. No system is perfectly secure, and we will notify you and the ICO as required if a breach occurs that poses a risk to you.
If you believe you have found a security vulnerability in this website, please report it to security@shuttlevest.com. We will acknowledge your report and will not pursue anyone who reports a genuine issue in good faith.
11. Children
This website and the Shuttlevest waitlist are not directed at children, and we do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, contact privacy@shuttlevest.com and we will delete it.
12. Changes to this policy
We will update this policy as Shuttlevest develops — in particular when regulated services launch, which will involve new processing and new partners. The "last updated" date at the top shows the current version, and we will tell waitlist members by email about changes that materially affect them.