Privacy Policy

1. Who we are

Steady Circuit Ltd (“Steady Circuit”, “we”, “us”) is a company registered in England and Wales (company number 16471673), with its registered office at 66 Paul Street, London, EC2A 4NA. We are the data controller for the personal information described in this policy. We are registered with the Information Commissioner’s Office (ICO), the UK’s data protection regulator, under registration number ZC011452. You can check our entry on the ICO’s public register.

For questions about your personal information, or to use any of your rights, email privacy@steadycircuit.com.

This policy covers:

• this website (steadycircuit.com), including its contact form and data deletion form;
• the Steady Support chat on this website (chat.steadycircuit.com);
• the feedback form on our product pages;
• your Steady Circuit account (auth.steadycircuit.com), the shared sign-in and payment service our products use; and
• custom domains set up through our customer domain proxy (customerdomains.steadycircuit.com), which lets you use your own domain name with one of our products.

Our products (SteadyStack, RegFlags, SteadyMonitor, Godopilot, SteadySync, TraderTaxNinja and Spread the Word) handle further information when you use them, which their own privacy notices explain. If a product you use does not show a privacy notice yet, ask us at privacy@steadycircuit.com and we will tell you what it holds.

2. What we collect, why, and our lawful basis

Visiting this website

Our servers record each request to this website: your IP address, browser details, the page requested and the time. We use these records to keep the site secure and working. Lawful basis: our legitimate interests in running a safe, reliable website.

This website uses no analytics or advertising trackers, and you don’t need an account to use it. Its fonts and images are served from our own servers.

Contact form

We collect your name, email address and message, and use them to reply to you. The form does not store your message on our web server: it is sent by email, through our email provider Resend, to our team’s inbox. Lawful basis: our legitimate interests in answering the people who contact us or, if you are asking about using one of our products, taking steps you have asked for before entering into a contract.

Data deletion and other privacy requests

Through our data deletion form we collect the account email address, the product, what you want deleted and any details you add, and we give your request a reference number. Like the contact form, it is sent through Resend to our team’s inbox. We use this information, and anything you send us when you use your other rights, to check the request is yours, carry it out and keep a record that we did. Lawful basis: legal obligation (data protection law requires us to act on these requests and to be able to show how we handled them).

Support chat

The chat button on every page of this website comes from our own support service, Steady Support (chat.steadycircuit.com). Loading the button means that service receives your IP address and browser details, as with any web request.

If you open the chat, you can talk to us without signing in. We keep what you write, any files you attach, and a random identifier for your browser so you can come back to the conversation. Our team can see your message as you type it, before you send it. Replies are written by people on our team. If you sign in to a Steady Circuit account, your conversations are linked to that account.

Lawful basis: our legitimate interests in helping the people who contact us and, if you are a customer, performance of our contract with you.

Feedback form

Some product pages have a Send feedback button. It opens a form from our sign-in service (auth.steadycircuit.com) that asks for your name, email address, the type of request, a subject and a message, and lets you add a screenshot. It also sends the address of the page, your browser and operating system, and your time zone; the form shows you these before you send it. Your request becomes a conversation in Steady Support. We email you to confirm we have it, and again when we reply, with a link to the conversation. Lawful basis: our legitimate interests in hearing about and fixing problems with our products, and in replying to you.

Your Steady Circuit account and payments

Our products use one shared sign-in service at auth.steadycircuit.com. If you have an account, we hold:

• your name and email address, and which of our products you use;
• your password, stored only in a scrambled (hashed) form, or, if you sign in with Google, Microsoft or GitHub, the name, email address and account identifier that provider gives us;
• any passkeys or two-step verification you set up;
• for each signed-in session, your IP address and browser;
• records of sign-ins and of changes to your security settings;
• if you pay for anything, your Stripe customer reference, what you bought, amounts and dates, and the terms you agreed to. Card payments are handled by Stripe: your card details go directly to Stripe, and we never see or store them.

To show a profile picture, we may check Gravatar using a hashed form of your email address. We send sign-in codes, password reset links and security notices by email through Resend. If you turn on browser notifications, they are delivered through your browser’s push service (for example Google, Mozilla, Apple or Microsoft).

Lawful bases: performance of our contract with you (providing your account and the products you sign up for, and taking payment); legal obligation (keeping payment and accounting records); our legitimate interests (keeping accounts secure, preventing fraud and abuse, and showing a profile picture); and your consent for browser notifications, which you can turn off at any time.

Custom domains

Some of our products let you use your own domain name, such as status.example.com. This runs through our customer domain proxy (customerdomains.steadycircuit.com). When you set one up, we hold the domain name, your Steady Circuit account identifier and the product’s reference for your account, the address the domain points to in the product, a verification code, and the results of our DNS and certificate checks. The setup link the product gives you is valid for one hour.

To check your DNS settings, we look up your domain name through public DNS services run by Cloudflare and Quad9. To secure the domain, Let’s Encrypt (United States) issues a certificate for it. Let’s Encrypt publishes every domain name it issues a certificate for in public Certificate Transparency logs, where anyone can see it, and these entries cannot be removed. Don’t use a domain name that contains anything you don’t want to be public.

When people visit your domain, the proxy passes their requests to the product for you. The proxy does not keep its own record of those visits. Lawful basis: performance of our contract with you (providing the custom domain you asked for).

We do not sell your personal information or use it for advertising.

3. Cookies and browser storage

• This website sets no cookies. It stores only your light or dark theme choice, in your browser’s local storage. That choice stays on your device and is not sent to us.
• If you open the support chat, the chat window (from chat.steadycircuit.com) stores in your browser a random visitor identifier, so you can return to your conversation; a session token that is removed when you close the tab; and your theme choice. If you are signed in to your Steady Circuit account, the chat can use that account’s sign-in cookie.
• Our sign-in service (auth.steadycircuit.com) uses the cookies needed to keep you signed in.

None of these are used for analytics or advertising. They are needed for things you choose to use, so we do not ask for consent to them. You can clear them at any time in your browser settings.

4. Who we share it with

• Hetzner (Germany and Finland): the servers that run this website, the support chat, our sign-in service and the customer domain proxy.
• Backblaze (Amsterdam, Netherlands): storage for our encrypted backups.
• Resend (United States): sends our emails, including contact and data deletion requests to our inbox, and emails from the support chat and sign-in service.
• Google (Google Workspace): our email inbox, where contact and data deletion requests arrive and from which we reply.
• Stripe: payments made through your Steady Circuit account.
• Google, Microsoft or GitHub: only if you choose to sign in with them.
• Gravatar (Automattic, United States): a hashed form of your account email address, to show a profile picture.
• Your browser’s push service: only if you turn on browser notifications.
• Let’s Encrypt (United States): issues certificates for custom domains, and publishes the domain names in public Certificate Transparency logs.
• Cloudflare (United States) and Quad9 (Switzerland): public DNS services we use to check custom domain settings. They see the domain name being checked.
• Professional advisers, such as lawyers and accountants, where necessary.
• Law enforcement or regulators, where the law requires it.
• A buyer or successor, if our business or its assets are ever sold or merged.

5. Transfers outside the UK

Most of this information stays in the UK and the European Economic Area. Some of our providers are in, or may process data in, the United States: Resend, Google, Stripe, Microsoft, GitHub, Gravatar (Automattic), browser push services, Let’s Encrypt and Cloudflare. Quad9 is in Switzerland. Where personal information goes outside the UK to these providers, it is protected by a safeguard UK data protection law allows, such as UK adequacy regulations (including the UK–US data bridge) or the ICO’s international data transfer agreement. Email privacy@steadycircuit.com for details of the safeguard for a particular provider. Domain names published in Certificate Transparency logs are public worldwide.

6. How long we keep it

Where a period below says “we are introducing”, that rule has been decided but is not yet carried out automatically; until it is, the information is kept for as long as stated.

• Website server logs: up to 30 days.
• Contact form messages: kept in our inbox with no fixed end date. We are introducing deletion 2 years after we receive them.
• Data deletion and other privacy requests: kept in our inbox with no fixed end date. We are introducing deletion 3 years after we close the request; we keep them that long as a record of how we handled it.
• Support chat and feedback conversations, including attachments: kept with no end date. We are introducing deletion 2 years after a conversation closes. You can ask us to delete a conversation sooner.
• Your Steady Circuit account: for as long as you have it. To close it, use our data deletion form or email privacy@steadycircuit.com.
• Sign-in records: 400 days.
• Records of changes to your security settings: kept with no end date. We are introducing deletion after 2 years.
• Payment records: at least 6 years after the end of the financial year they belong to, as UK tax and company law requires. Today they are kept with no end date, including after an account is deleted. We are introducing deletion once that period ends, and unlinking them from your profile when you delete your account.
• Custom domains: kept with no end date unless the product deletes them, including domains whose setup was never finished and expired setup links. We are introducing deletion 30 days after a domain stops being used or if its setup is never completed, and deletion of setup links 7 days after they expire. Certificate Transparency log entries are permanent and outside our control.
• Backups: information deleted from our systems can remain in our encrypted backups until those backups expire. We are introducing a limit of 35 days.
• Information stored in your browser: until you clear it.

7. Your rights

Under UK data protection law you can ask us to:

• give you a copy of the personal information we hold about you;
• correct information that is wrong or incomplete;
• delete your information;
• restrict how we use it;
• stop using it where we rely on our legitimate interests (you can object);
• give you the information you provided to us, or send it to another organisation, in a portable format; and
• where we rely on your consent, withdraw that consent at any time.

To ask us to delete your account or data, use our data deletion form. For any other request, email privacy@steadycircuit.com. We may need to confirm it is you. We reply within one month; if a request is complex we may need up to two more months, and we will tell you within the first month if so.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or by phone on 0303 123 1113.

8. How we protect it

Everything between your browser and our services is encrypted in transit (HTTPS). The forms on this website keep nothing on our web server: they pass what you send straight to our inbox. Access to our systems and inbox is limited to the people who run Steady Circuit. No way of sending or storing information is completely secure; if a breach affects your personal information, we will tell the ICO and you where the law requires it.

9. Children

This website is not intended for anyone under 18, and we do not knowingly collect personal information from children. If you believe we have, please contact us and we will delete it.

10. Changes to this policy

When we change this policy, we update the date at the top of this page. If a change significantly affects how we use information we already hold about you, we will tell you before it takes effect where we have a way to contact you.

11. Contact us