Privacy
What we hold, and who it belongs to.
Slatebook holds crew addresses, day rates, client margins and, on some plans, right-to-work documents. This says what happens to all of it.
Last updated 4 September 2026
We are two different things, depending on the data
For this website, and for the account and billing details of a company that subscribes, Flowspire Ltd (trading as Slatebook) is the data controller.
For everything a customer puts into the product — the crew they book, the clients they invoice, the call sheets they send — the customer is the controller and we are their processor. We act on their instructions and we do not decide what that data is used for. If you are a freelancer or a client and want to see, correct or remove what a production company holds about you, ask them: it is their record, and they can act on it immediately. If they need us to help, we will.
This website collects almost nothing
There are no cookies and no analytics on slatebook.co.uk. Nothing follows you between pages, and there is nothing to consent to — which is why you have not been asked.
If you write to us from the talk to us page, we get your name, your company, your email address and the time you picked, by email. That is used to reply to you and nothing else. Our host keeps ordinary server logs, including IP addresses, for a short period for security and diagnostics.
What the product holds
Whatever a production company records in it. In practice that means crew names and contact details, day rates, availability, bookings and call sheets — which carry addresses, phone numbers, dietary and accessibility notes and next of kin — along with client records, quotes, invoices and, where a company uses the feature, right-to-work documents.
We do not hold your rushes. Slatebook stores records and documents and links to wherever your media lives. That is a deliberate limit on what a breach here could reach.
Where it lives
Data is resident in the United Kingdom and the European Union — London and Dublin. We do not transfer customer data outside the UK or EU without a written agreement with the customer. In transit it is protected with TLS 1.3; at rest with AES-256. Backups are encrypted with separate keys and restore-tested monthly.
Inside the product, one company can never read another’s data: isolation is enforced by the database on every table, not by the application. Reading an uploaded document writes an audit entry before the file is handed over, so who opened a passport scan and when is a matter of record.
Who else touches it
Four sub-processors, and they are the ones the product actually calls:
| Who | What for | Where |
|---|---|---|
| Supabase | Database, authentication and file storage — the records themselves | United Kingdom / European Union |
| Vercel | Application hosting: runs the product and this website | European Union |
| Stripe | Subscription payments, and card payments your clients make to you | European Union / United States (standard contractual clauses) |
| Resend | Sending call sheets, offers, invoices and other email on your behalf | European Union |
We do not sell data, and we do not sell or share rate information. The subscription is the whole commercial relationship.
How long it is kept
Retention is deliberately not one rule, because the risk runs in different directions:
- Right-to-work documents are destroyed on schedule, automatically. Holding a passport scan past its date is the risk; losing it is not, because it was never the company’s document to keep.
- A freelancer’s contact details are minimised, never deleted. Their bookings are part of records HMRC expects to be kept for six years, so the record survives — the phone number and email do not have to, and a person decides when.
- Invoices, payments, quotes and jobs are never swept. Deleting those is the larger risk in the other direction.
Every destruction leaves a record that the thing existed and when it went. Proving you destroyed something on time needs evidence it was there.
Your rights
Under UK GDPR you can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, object to how we use it, or ask for it in a portable form. For anything held in a customer’s Slatebook, ask that company first — they are the controller, and every plan can export the lot at any time.
For anything we hold as controller, write to jack@flowspire.pro. We will answer within one month.
If you think we have got it wrong, you can complain to the Information Commissioner’s Office. We would rather you told us first.
Changes
If this notice changes in a way that matters, customers are told before it takes effect rather than after. The date at the top says when it last did.
Who we are
Slatebook is a trading name of Flowspire Ltd, registered in England and Wales, company number 15568183. Registered office: Childwickbury House, Childwickbury, St Albans, Hertfordshire, AL3 6JX. VAT number GB 456 4051 96.
See also the terms of service and the security page, which says what is in place and what is not yet.