Privacy Policy
Last updated 24 September 2026
The short version. We collect what we need to run your account and monitor your suppliers, and nothing for advertising. We don't sell your data, we don't use tracking or advertising cookies, and you can ask us to see, correct or delete what we hold about you at any time.
1. Who we are
SupplyGuard (supplyguard.online) is run by Lee McCaffrey and Shelley Newton, trading as SupplyGuard. We are the controller of the personal information described in this policy, which means we decide how and why it is used.
For anything about your personal information, email hello@supplyguard.online.
2. What we collect
When you create an account
Your email address and password. We never store your password itself, only a salted, one-way hash of it that can't be turned back into the password. We also keep your plan, whether you're a founding member, and when you last signed in.
When you pay
Payments are handled by Stripe. We never see or store your card details. We keep a Stripe customer reference and your plan so we can link payments to your account.
When you use the dashboard
The suppliers you add to your watchlist, the spend level and category you give them, any notes, and the risk results and alerts we produce for them. To keep you signed in, a sign-in token is stored in your browser for up to 30 days.
When you use the free Supplier Health Check
If you enter your email to see a full report, we store your email with the company you checked and its rating at the time. We use it to send you alerts about that company and nothing else.
When you join the waitlist or claim a founding member place
Your email address, so we can contact you about your place.
When you visit the site
Your IP address is used to apply fair-use limits to free searches and checks, and is held for about a day for that purpose. Our hosting providers also keep standard technical logs, such as IP address and browser type, to run and protect the service.
When you contact us
Your emails to us and our replies.
Information about company directors
SupplyGuard shows information from public company registers, which includes details of company directors and people with significant control, such as names, roles, appointment dates and partial dates of birth. This comes from Companies House, The Gazette and the German commercial register (supplied through OpenRegister). We use it to report on the companies our users watch and to research and improve our risk signals. If you are one of these people, you have the rights set out in section 7, including the right to object.
3. Why we use it, and our lawful basis
| What we use it for | Lawful basis under UK GDPR |
|---|---|
| Running your account, monitoring your suppliers, and sending your alerts and weekly digest | Contract: we need it to provide the service you signed up for |
| Taking payment and keeping financial records | Contract, and legal obligation for tax records |
| Health Check alerts about the company you checked | Legitimate interests: sending you the updates you asked for when you entered your email |
| Contacting waitlist and founding member sign-ups | Legitimate interests: following up on your request |
| Fair-use limits, security and preventing abuse | Legitimate interests: keeping the service working and protected |
| Reporting and research using public register information about directors | Legitimate interests: providing supplier risk information from official public records |
We don't sell personal information, use it for advertising, or make decisions about individuals based on it.
4. Who we share it with
We use a small number of trusted providers to run SupplyGuard. They only process personal information on our instructions:
- Cloudflare: runs our servers, database and storage. Our main database is held in Cloudflare's Asia-Pacific region.
- Netlify: hosts the website pages.
- Stripe: takes payments.
- Resend: sends our emails, from its data centre in Ireland.
- Our email provider: hosts the mailbox you write to when you contact us.
- OpenRegister: supplies German company data. We send it the German company names you search for and the companies you watch, never your personal details.
- French government registers (INSEE and BODACC): supply French company data. We send them the French company names you search for and the companies you watch, never your personal details.
- Irish Companies Registration Office: supplies Irish company data. We send it the Irish company names you search for and the companies you watch, never your personal details.
- Google Fonts: supplies the typefaces on our pages. Your browser requests them from Google, which receives your IP address.
We may also share information if the law requires it, or to protect our rights or other people's safety.
5. International transfers
Some of these providers store or process information outside the UK, including in the Asia-Pacific region and the United States. Where they do, the transfer is covered by UK adequacy regulations or by approved safeguards such as the UK International Data Transfer Addendum.
6. How long we keep it
- Account and watchlist: while your account is open. When you close it, we delete them within 30 days.
- Payment and billing records: 6 years, as required for tax purposes.
- Health Check emails: until you ask us to stop, and no more than 2 years after your last check.
- Waitlist emails: until your place is sorted out, or 12 months at most unless you become a customer.
- IP addresses for fair-use limits: about a day.
- Sign-in tokens: 30 days, or until you sign out.
7. Your rights
Under UK data protection law, you can ask us to:
- give you a copy of the personal information we hold about you;
- correct anything that's wrong;
- delete your information;
- restrict how we use it, or object to us using it, including where we rely on legitimate interests;
- give you your information in a portable format.
Email hello@supplyguard.online and we'll reply within one month. Some rights have limits, for example where we must keep billing records, and we'll explain if one applies.
If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to put things right first.
8. Cookies and similar technology
We don't use advertising, analytics or tracking cookies. The dashboard stores a sign-in token in your browser so you stay signed in, which is strictly necessary for the service to work.
9. Security
All connections to SupplyGuard are encrypted. Passwords are stored only as salted hashes, card payments are handled entirely by Stripe, and access to our systems is restricted. No system is perfectly secure, but we take reasonable steps to protect your information and will tell you promptly if a breach affects you.
10. Children
SupplyGuard is a business service and isn't intended for anyone under 18.
11. Changes to this policy
We'll post any changes here with a new date. If a change is significant, we'll email account holders before it takes effect.
12. Contact
Lee McCaffrey and Shelley Newton, trading as SupplyGuard
Email: hello@supplyguard.online
The terms that apply to using SupplyGuard are in our Terms of Service.