Privacy notice
Last updated: 28 October 2026
This notice explains what personal data this website and the Slatestock product collect, why, how long we keep it and what you can do about it.
Who we are
Slatestock is run by Voll Studios Ltd, a company registered in England and Wales (company number 09302803). Our registered office is:
Voll Studios Ltd5 Brayford Square
London
England
E1 0SG
Voll Studios Ltd is the controller for the personal data described here. We are registered with the Information Commission, the UK data protection regulator (its office is known as the ICO), registration number ZC135838. To reach us about your data, use the contact page.
The law this notice follows
We are a UK company, so the UK GDPR applies to the personal data we handle. Article 13 lists what we must tell you when we collect data from you, starting with:
“the identity and the contact details of the controller and, where applicable, of the controller's representative;”
For customers in Canada, we also follow the fair information principles in Schedule 1 of the Personal Information Protection and Electronic Documents Act (PIPEDA). The sections below say how.
What we collect
Messages and requests you send us
If you use a form on this website, for example to contact us or ask for a call, we store what you enter. That is usually your name, email address, company and message.
Your account
If you buy a plan, we keep the name and email address of each person who signs in, and the email sign-in links we send them. Card payments are taken by our payment provider; we do not see or store card numbers.
Records you keep in the product
Your products, stock, suppliers, customers and orders are your records. We process them only to run the product for you. Where they include people's names or contact details, you are the controller of that data and we act on your instructions.
Technical data when you visit
When you open a page, our hosting provider receives your IP address, the address of the page and details of your browser, as with any website. It uses them to deliver the page and to protect the website from misuse, and keeps them in request logs for a short time.
What we do not collect
This website does not use analytics, advertising or tracking cookies, and does not build a profile of you. The cookie policy has the details.
Why we use it, and our lawful basis
Article 6(1) of the UK GDPR says:
“Processing shall be lawful only if and to the extent that at least one of the following applies:”
We rely on two of the grounds that follow:
- To run your account and the product you pay for, point (b): “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”.
- To reply to your messages and to keep the website secure, point (f): “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party”. Our interests are answering the people who write to us and keeping the website available.
We do not sell personal data or use it for advertising.
Where your data is held, and who we share it with
Account data and the records you keep in the product are stored in EU (Ireland).
These providers process data on our behalf, each under a data processing agreement:
- Vercel Inc. hosts the website and the product.
- Supabase Inc. runs the database, in EU (Ireland).
- Resend, Inc. sends our emails, such as sign-in links.
- Stripe processes card payments when you buy a plan.
Some of these providers may process data outside the UK, including in the United States. Where they do, the transfer is covered by the safeguards in our agreement with them. We share personal data with others only where the law requires it.
How long we keep it
- Messages and requests sent through the website: up to 2 years after our last contact with you, then deleted.
- Account data: while your subscription runs. After you cancel, we delete it once you have had the chance to export your records.
- Billing records: as long as UK tax law requires us to keep them.
- Request logs: kept by our hosting provider for a short period under its own retention settings, then deleted.
Your rights under the UK GDPR
Article 13(2)(b) of the UK GDPR names:
“the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;”
To use any of these rights, contact us through the contact page or write to us at the address above. We reply within one month.
Complaints
Article 13(2)(ca) of the UK GDPR names:
“the right to make a complaint to the controller under section 164A of the 2018 Act;”
To complain to us, use the contact page or write to us at the address above. We acknowledge your complaint within 30 days and tell you the outcome, as section 164A of the Data Protection Act 2018 requires.
Article 13(2)(d) also names:
“the right to make a complaint to the Commission under section 165 of the 2018 Act;”
The Commission is the Information Commission, the UK data protection regulator. You can complain to it online at ico.org.uk/make-a-complaint.
For customers in Canada (PIPEDA)
We follow the principles in Schedule 1 of PIPEDA. These are the ones you are most likely to need.
Accountability
“An organization is responsible for personal information under its control and shall designate an individual or individuals who are accountable for the organization’s compliance with the following principles.”
Voll Studios Ltd is responsible for the personal information described in this notice. Questions for the person accountable go through the contact page.
Identifying purposes and consent
“The purposes for which personal information is collected shall be identified by the organization at or before the time the information is collected.”
“The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.”
The purposes are the ones listed in this notice. We use your information only for them.
Access
“Upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information.”
Ask through the contact page and we will send you what we hold.
Challenging compliance
“An individual shall be able to address a challenge concerning compliance with the above principles to the designated individual or individuals accountable for the organization’s compliance.”
Raise it with us first through the contact page. You can also report a concern to the Office of the Privacy Commissioner of Canada at priv.gc.ca/en/report-a-concern.
Changes to this notice
We will update this notice when the website or the product changes what it collects. The date at the top of the page shows when it was last updated.