Privacy Policy
Scope
Slipway Sync publishes read-only Snowflake Native Apps that extract Clio Manage or Filevine data into the customer’s own Snowflake account.
- Practice data (matters, contacts, billing records, and similar) is written into your Snowflake account. We do not operate a multi-tenant store of that data for production Native App extracts.
- Production OAuth / API secrets and External Access Integrations are bound in your Snowflake account. We do not receive production tokens in our infrastructure for that extract path.
- Optional webhook delivery, if enabled later for a customer, may transit a publisher-operated ingress only as processor, solely to write events into that customer’s Snowflake account. We do not keep those events as our own warehouse.
This notice covers publisher personal data (website, support, and commercial contacts). It is not a substitute for your own privacy notice about law-firm client files in your Snowflake account.
1. Who we are (controller)
Controller: EPC Scout LTD (England and Wales private limited company).
Company number: 17229314
Registered office: 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE
Trading as: Slipway Sync
Contact (including data-subject requests): support@slipwaysync.com
Website: https://slipwaysync.com
ICO registration: ZC157582 (registered 26 May 2026; renews by 25 May 2027). We pay the UK data protection fee as required for controllers.
We have not appointed a Data Protection Officer (not required for our current scale).
2. Roles
| Context | Role |
|---|---|
| Website visits, support email, early-access and Marketplace / billing contacts | EPC Scout LTD is controller |
| Clio / Filevine (or other SaaS) data extracted into Snowflake via the Native App | You (the Snowflake account organisation) are controller. Installing the app does not make us the host of your practice-management database |
| Production secrets and External Access Integrations | Held in your Snowflake account |
| Webhook event delivery through publisher ingress (if enabled for you) | You remain controller; EPC Scout LTD acts as processor only to deliver events into your account |
We do not seek special-category data or legally privileged material as a publisher. Practice files in your warehouse may include such data under your control and lawful basis.
3. Personal data we process as publisher
When you use our website, email us, or deal with us via Snowflake Marketplace (when listed) or pre-listing early access, we may process:
| Category | Examples |
|---|---|
| Identity and contact | Name, business email, organisation name, role |
| Support content | Email body, attachments you send, troubleshooting notes |
| Commercial / Marketplace | Account contacts, listing or entitlement metadata Snowflake shares with providers, payout-related contacts |
| Technical (website) | Standard server and CDN logs (IP address, user agent, timestamps) from hosting providers |
We do not run a consumer signup product, marketing list, or advertising pixels on slipwaysync.com.
Sources: you (email and forms you send); your organisation; Snowflake (provider / Marketplace contacts when listed); and our hosting and DNS providers (technical logs).
4. Purposes and lawful bases (UK GDPR / Data Protection Act 2018)
| Purpose | Lawful basis |
|---|---|
| Respond to support and early-access requests | Legitimate interests (Art. 6(1)(f), answering B2B enquiries) and contract (Art. 6(1)(b)) where we have agreed to provide evaluation access |
| Operate listed Marketplace apps and related provider communications | Contract and/or legitimate interests (distributing and supporting the Software) |
| Website delivery, security, and abuse prevention | Legitimate interests (keeping the site available and secure) |
| Billing, tax, accounting, Companies House, and other legal duties | Legal obligation (Art. 6(1)(c)) and/or contract |
| Improve connector security without using customer practice data from your Snowflake | Legitimate interests (maintaining a safe product) |
Where we rely on legitimate interests, we consider that B2B contact and security processing is reasonably expected and not overridden by your rights. You may object (see Rights). We do not rely on consent for the processing described above.
5. Recipients
We do not sell personal data. We do not share it for advertising. We may share publisher personal data with:
| Category | Examples |
|---|---|
| Site hosting and DNS | Vercel (site), Cloudflare (DNS, CDN, Email Routing) |
| Cloudflare Email Routing to our support inbox | |
| Marketplace / cloud platform | Snowflake Inc. (provider distribution, security review, and entitlement contacts when listed) |
| Professional advisers | Accountants, solicitors, insurers, under a duty of confidence |
| Authorities | When required by UK law |
6. International transfers
Some processors (including Snowflake, Vercel, and Cloudflare) may process data in the United States or other countries outside the United Kingdom. Where the UK GDPR requires a transfer tool, we rely on UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or an equivalent lawful mechanism.
7. Retention
| Record | Typical retention |
|---|---|
| Support / early-access email | Up to 24 months after last correspondence, unless needed longer for a dispute or legal claim |
| Marketplace / billing contacts | For the commercial relationship, then up to six years (UK limitation and tax records) |
| CDN / security logs | Provider defaults (typically days to a few months) |
Practice data in Snowflake is retained or deleted under your control (including uninstall and DROP APPLICATION). Processor webhook events, if any, are not kept as a publisher warehouse.
8. Cookies and PECR
slipwaysync.com does not use non-essential analytics or advertising cookies. Fonts are self-hosted. We do not set a cookie banner because we do not use non-essential cookies. Hosting and CDN providers may process technical logs as described above. If that changes, we will update this notice.
9. Security
Connectors are designed so customer practice data stays in the customer Snowflake account. Secrets use Snowflake Secret objects. API egress uses External Access Integrations declared in the Native App manifest. Extract is read-only over HTTPS to public vendor APIs (not Private Link), plus webhook subscription management where that feature is enabled.
10. Your rights
UK data subjects may request: access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests. There is no right to data portability where we do not process on contract or consent in a way that creates that right.
Email support@slipwaysync.com or write to our registered office. We may need to verify your identity. We aim to respond within one month.
You may complain to the Information Commissioner’s Office: ico.org.uk, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113.
Automated decision-making: We do not use automated decision-making or profiling that produces legal or similarly significant effects about you.
11. Children
Our products and website are directed at businesses and professionals, not at children under 18. We do not knowingly collect personal data from children.
12. Changes
We will update this page and revise the “Last updated” date when the policy changes.