Legal

Privacy Policy

Last updated 10 October 2026 · Previous versions

This policy explains how Clearpath Labs Ltd ("we", "us") - trading as SnapAddress - collects, uses, shares and protects personal data when you use the SnapAddress API, dashboard, or WooCommerce plugin (the "Service"). We are the data controller for the information described here. Every version of this policy we have published is kept at Previous versions.

Who we are

Clearpath Labs Ltd (company no. 17145150) is registered in England and Wales at 35 Floyer Close, Richmond, England, TW10 6HS. Clearpath Labs Ltd is registered with the Information Commissioner's Office as a data controller, registration reference ZC126842. We are not required to appoint a Data Protection Officer; for privacy queries, contact snapaddress@clearpathlabs.co.uk.

We act as the data controller for the account, business and usage data described here. You remain responsible, as controller, for any personal data you or your end users submit to your own application. Where we process your lookup queries on your behalf, we act as your processor under our Data Processing Agreement.

What we collect

  • Account and business details - your name, email address and authentication identifiers; whether you act as a company, charity, public body, partnership or sole trader; your business name; your business address, postcode and country (required for our Royal Mail PAF licence, see below); the billing address supplied through Stripe when you pay; your use case, which provider you used before and how you heard about us, if you chose to tell us; your marketing preference; and a record of the terms you accepted (document version, time, IP address and browser). Account data is held by Supabase on our behalf.
  • Billing data - Stripe customer and payment identifiers, what you bought and when. Payment card details are handled by Stripe and never touch our servers.
  • API credentials - your API keys, stored so you can view and copy them from your authenticated dashboard. You can revoke a key at any time.
  • Usage events - for each API request: the time, the route called, the result code, whether a credit was spent and, where the client software identifies itself (for example our WooCommerce plugin), its name and version, linked to your account and key. We do not keep the postcode or address text you looked up, except that a postcode or address identifier that could not be found is kept for 14 days, without any link to your account, so we can spot gaps in the data.
  • Operational logs - standard server logs (including IP address) retained briefly for abuse prevention and debugging.
  • Website and dashboard analytics - on our website and dashboard only, in the tier you choose from the cookie banner (see Cookies and similar technologies below). Until you choose, we count page views, performance and errors anonymously: no cookie, nothing stored in your browser, an identifier held only in memory that resets each time a page is loaded, and your IP address is discarded by our analytics provider as it arrives. If you accept analytics cookies, we also recognise your browser between visits, link activity to your account id and email address once you are signed in so we can see which account hit a problem, and record sessions with form inputs and API keys masked. If you reject, we collect nothing from your browser. This is not collected from API requests.
  • Email delivery data - whether emails we send you were delivered, bounced and, where enabled, opened or clicked.

We do not store the addresses returned to end users of your application. Lookups are served from our own licensed copy of the Royal Mail PAF data; we do not send your queries to Royal Mail.

Why we process it

  • Contract - where you contract with us personally, as a sole trader: to provide the Service you signed up for - issuing API keys, authenticating requests, metering usage, billing, and emails about your account.
  • Legitimate interests - where you act for a company or other organisation, to manage that business relationship, provide support and administer access and payment; for everyone, to prevent abuse, protect the Service, improve reliability, understand how our website and dashboard are used, and meet the reporting and record-keeping conditions of the Royal Mail PAF licence under which the Service is supplied. You can object to processing based on legitimate interests (see Your rights).
  • Consent - with your consent, to email you product news and feature announcements. You can withdraw consent at any time from the billing page, by the unsubscribe link, or by emailing us; this does not affect service messages about your account.
  • Legal obligation - to keep the records UK tax law requires.

Who we share it with

Royal Mail. Our PAF licence requires us to report each customer licensed under it to Royal Mail's Address Management Unit each month: your name or business name, business address and postcode, licence dates and the credit blocks granted to you. Royal Mail receives this as licensor and uses it to administer PAF licensing; it is a controller in its own right. We never send Royal Mail your lookup queries. We collect your business address for this reason, and cannot grant trial or purchased lookups without it.

Service providers we use. These providers process data for us, under contracts that bind them to our instructions:

  • Supabase - authentication and database hosting (UK, London region).
  • Stripe - payment processing and invoicing (US).
  • Vercel - website and dashboard hosting (UK, London region).
  • AWS (Amazon Web Services) - address-lookup API infrastructure (UK, London region, eu-west-2).
  • Cloudflare - network edge for the address-lookup API: encryption in transit, security and rate limiting. It sees request IP addresses and the lookups passing through it (US company; requests are handled at the Cloudflare data centre nearest the caller).
  • Resend - delivery of transactional and lifecycle emails, such as sign-up, purchase confirmation and credit-expiry reminders, and the contact record that selects them - your email, name, use case, purchase status and marketing preference (US).
  • Sentry - error monitoring and diagnostics for the API (EU region).
  • PostHog - product analytics and error monitoring for our website and dashboard and, if you accept analytics cookies, session replay, linked to your account id and email only with that acceptance (EU region).

How long we keep it

  • Account and business details - for the life of your account. When you delete your account they are removed, except as set out under Deleting your account.
  • Billing records and the credit ledger - 6 years after the transaction (UK tax law and our Royal Mail PAF licence).
  • Licence record - the name or business name, address and postcode each credit block was granted to - 6 years after the block was granted (Royal Mail PAF licence, Schedule 2 paragraph 6).
  • Usage events - 6 years (Royal Mail PAF licence records of PAF use), with your contact details removed when you delete your account.
  • Record of the terms you accepted - for the life of your account and 6 years after it is deleted.
  • Website and dashboard analytics - up to 12 months; session recordings 30 days.
  • Email delivery data - 13 months.
  • Failed-lookup diagnostics - 14 days.
  • Server logs - up to 30 days.
  • Demo rate-limit counters - 7 days, held as a salted hash of your IP address.

Your rights under UK GDPR

You can request:

  • Access to the personal data we hold about you
  • Correction of inaccurate data
  • Erasure of your account and associated data - you can delete your account any time from the billing page
  • Restriction of our processing of your data in certain circumstances
  • A portable copy of your data
  • To object to processing based on legitimate interests
  • To withdraw consent to marketing emails at any time

To exercise any of these rights, email snapaddress@clearpathlabs.co.uk. You can also complain to the UK Information Commissioner's Office at ico.org.uk. We do not make decisions about you by automated means that have legal or similarly significant effects.

Deleting your account

When you delete your account we remove your login, revoke and erase your API keys, delete your Stripe customer record, remove you from our email lists and delete your email delivery data, and erase your profile from our analytics tools. We keep:

  • credit-transaction and usage records with your name, email and addresses removed, because our Royal Mail PAF licence and UK tax law require them;
  • the licence record for each credit block you were granted - your name or business name, business address and postcode - because our Royal Mail PAF licence requires us to be able to show who each block was licensed to, for 6 years;
  • the record of the terms you accepted, for 6 years, so we can show what you agreed to.

If a step cannot be completed immediately - for example an external provider is unavailable - we finish it as soon as we can and the account is disabled in the meantime.

International transfers

Most processing takes place in the UK or the EEA: Supabase, Vercel and the AWS address-lookup infrastructure run in the UK (London), and Sentry and PostHog operate in the EU (EEA). Some providers process personal data outside the UK/EEA - currently Stripe and Resend, both in the US, and Cloudflare, a US company whose network may handle a request outside the UK. For each such transfer we rely on the UK Extension to the EU-US Data Privacy Framework (the UK-US Data Bridge) where the provider's certification covers the transfer, and otherwise on the UK International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses) in that provider's data processing agreement. You can ask us for details of the safeguards relied on for any transfer.

Cookies and similar technologies

We use a small number of first-party cookies strictly necessary to keep you logged in and to remember your preferences, including one cookie, sa_consent, that remembers your answer to the cookie banner for 12 months. We do not use advertising cookies.

Analytics cookies are your choice. The banner offers Accept and Reject with equal weight, and nothing beyond the anonymous counting described above happens until you answer.

  • Accept - our analytics provider sets a first-party cookie and browser storage, kept for 12 months, so your browser is recognised between visits; sessions are recorded with form inputs and API keys masked; and, once you are signed in, analytics are linked to your account as described above.
  • Reject - we collect nothing from your browser. Only sa_consent remains, so we do not ask again.
  • No answer yet - anonymous counting only, with no cookie and nothing stored in your browser.

You can change your answer at any time from the "Cookie settings" link in the footer of the website and the dashboard. The change takes effect immediately. Switching to Reject removes the analytics cookie and browser storage; data already collected is kept for the periods set out above, and deleting your account erases your analytics profile.

Changes to this policy

If we make material changes we will update the "last updated" date above and, where appropriate, notify you by email. Every version is kept at Previous versions.