Privacy notice

What we collect, which is almost nothing.

Last updated 29 July 2026

GoodSpot is built so that your family's health data never leaves your home. This website is held to the same standard: it sets no cookies, runs no analytics, and — beyond the routine server logs described below — collects nothing unless you type something into the waitlist form or the contact form.

Who is responsible for your data

GoodSpot AI Labs is the data controller for the personal data described in this notice.

Our data officer is Kartika Chendorain-Tulusan, founder and CEO. She is responsible for how personal data is handled across GoodSpot and is the named contact for anything in this notice: hi@wearegoodspot.com.

What we collect, and why

Your email address, if you join the waitlist. We use it for two things: to invite you when the beta opens, and to send you an occasional note on how GoodSpot is coming along — a handful of emails a year, written by us, each with a working unsubscribe link. We do not profile you with your email address, we do not sell it, and we do not pass it to anyone to use for their own purposes.

• Lawful basis: consent. You gave it by submitting the form, and you can withdraw it at any time — by clicking unsubscribe in any email we send, or by emailing us.
• Retention: until you unsubscribe or ask us to delete it. We also review the list at least once a year and delete addresses we no longer have a good reason to hold.

What you send us through the contact form. Your name, your email address, the reason you selected, and whatever you write in the message box. We use it to read your message and reply to it. It does not get added to the waitlist or any mailing list, it is not used to profile you, and it is not passed to anyone else.

• Lawful basis: legitimate interests. Answering someone who has written to us.
• Retention: we keep the correspondence while the conversation is live and for up to twelve months afterwards, then delete it. Ask us sooner and we will delete it sooner.

Standard server logs. Our host records the usual technical information when a page is served: IP address, browser type, the page requested, the time. This is a normal part of running a website securely and we do not use it to identify or track individuals.

• Lawful basis: legitimate interests. Keeping the site available, and protecting it from abuse.
• Retention: as long as our host keeps them, which is a short rolling period.

Cookies

This website sets none. There is no analytics, no advertising pixel, no tag manager, and nothing stored in your browser. That is why you were not asked to accept anything when you arrived. If that ever changes, a consent banner will ask you before anything is set, and this page will describe exactly what and why.

Who else sees anything

Two third parties are involved in serving this site.

• Netlify hosts the site and processes both the waitlist form and the contact form. What you submit is stored in our Netlify account until we export or delete it. Netlify is a US company and acts as our processor under a data processing agreement.
• Unsplash serves one photograph on the homepage from its image CDN. When your browser loads that image, Unsplash receives the standard technical details of the request, such as your IP address and browser type. We do not send Unsplash anything about you, and no cookie is set. Their practices are described in the Unsplash privacy policy.

Our fonts are served from our own domain, and apart from that one image nothing on the page causes your browser to contact anyone else. We do not sell personal data, and we do not share it with advertisers or data brokers. There is no third-party form service in the path. Both forms post to our own host.

Data leaving the UK

Netlify is a US company, so serving this site involves a transfer abroad. That transfer is covered by the standard contractual protections in their data processing agreement. We are actively reviewing European hosting so that this section can eventually say nothing leaves at all.

Automated decisions

None. Nothing on this website makes an automated decision about you, and there is no profiling.

Your rights

Under UK GDPR you have the right to:

• ask what we hold about you, and get a copy
• have inaccurate data corrected
• have your data erased
• restrict or object to how we use it
• receive it in a portable format
• withdraw consent at any time, without it affecting anything done beforehand

Complaints

If you think we have handled your data badly, please tell us first, because we would rather fix it. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or on 0303 123 1113.

Children

This website is aimed at adults. We do not knowingly collect data from children through it. GoodSpot is a product for families, and when the product itself launches it will have its own, fuller notice covering how a household's data is handled.

Changes to this notice

If we change what we collect or how we use it, we will update this page and change the date at the top. If a change would mean using your data in a new way — a different purpose than the ones you signed up for — updating this page is not enough on its own: we will email the people affected and ask, and the new use will not apply to you unless you agree. Changes that do not touch your data in a new way, like switching hosting provider, will simply be reflected here.