Privacy Notice

          Last updated 10 February 2023; effective from 10 February 2023

🤝 About us

We are Spill App Ltd and are located at 9th Floor 107 Cheapside, London, United Kingdom, EC2V 6DN. We are registered on Companies House under number 10602161 with the ICO number ZA459842 — you can look us up in the ICO register here.

In the US, we are Spill Inc and are located at Corporation Trust Center, 1209 Orange Street, City of Wilmington, County of New Castle, Zip Code 19801.

If you have any questions about how we process your personal data then you can contact our DPO on

❓ What we do

Spill App Ltd provides all-in-one mental health support for employees. This includes one-to-one sessions, manager mental health training, and regular feelings check-ins — embedded into the company's Slack or MS Teams or accessed via email login depending on your plan.

As a company dealing with sensitive issues to do with people’s mental health, we take privacy and confidentiality extremely seriously.

Spill processes your data for the purpose of offering our service, meaning remote sessions, wellbeing tools, and mental health content.

⚙️ Spill’s role

Principally, we’re a data controller with regards to the user data we collect for the purposes of providing the Spill services. If you’re based in the US, Spill Inc and Spill App Ltd are joint controllers for this data.

Being a controller means that we are trusted to look after and deal with your personal information in accordance with data protection law. We determine the ways and means of processing your data and must therefore be accountable for it.

However, in some cases we may also act as a data processor where your employer is the controller. For example, when we first start to work with a company, the employer provides us with a way to contact employees — be that via Slack, MS Teams or email. This means we can contact the employees (you!) to offer our Spill services. We are doing this on the instruction of your employer.

If you are on one of our team plans (accessed via Slack or MS Teams), we are also a processor in two further instances: (1) if you contribute to a Wall of Praise (any praise or comments you leave for your colleagues on the Wall of Praise is therefore viewable by your company’s Slack administrator) and (2) if you, as a manager, refer a report as part of Manager Check-in.

If you have questions about the invitation process, Wall of Praise or Manager Check-in, please contact your employer.

Note: If you are the organiser of a Team Check-in, then we are a processor for the data used to set up the invite by you. We will give you the option to connect Spill to your Google calendar in order to make it easier for you to select the meeting which you wish to link to Spill. Spill will read a list of meetings from your Google Calendar in order to show these to you as options to choose from, but Spill does not store information about these events.

If you select a meeting, Spill will use the video link URL for that event in order to generate a Team Check-in URL. When setting up the meeting, Spill will only process the data you ask us to process and do this as a processor on behalf of your employer. For details about the information collected during Team Check-in, please see below.

If you have any questions about how we handle your personal data, please email us at

🔒 Your rights

As a data subject you have rights in respect of our processing of your personal data when we are the controller of your data:
Your right of access - you have the right to ask us for copies of your personal information.
Your right to rectification - you have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure - you have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing - you have the right to ask us to restrict the processing of your information in certain circumstances.
Your right to object to processing - you have the right to object to our processing your information if the legal basis is legitimate interests.
Your right to data portability - this only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or under a contract, or in talks about entering into one, and the processing is automated.

If you want to exercise any of these rights, please just contact us on In the UK and the EU you also have the right to lodge a complaint about our processing with a supervisory authority.

In the UK that is the ICO whose details are here.

If you are an EU user then you also have the option to communicate with our EU Data Rep for any issues or to exercise your rights. Please see the section about our EU Data Rep.

🔎 How we process your data

As a general principle, we try to only collect the data we can’t function without — and delete it as soon as we no longer need it (unless we are legally obliged to keep it). We collect and use data at different stages during your interactions with Spill. Click on the stage that you are most interested in for more detail.

In brief:
     We never share your data outside Spill unless it’s absolutely necessary.
     All your data is kept confidentially.
     We will never share data with your employer without your consent.

📦 What happens if our business changes hands?

We may, from time to time, expand or reduce our business and this may involve the sale and/or the transfer of control of all or part of our business. Any personal data that you have provided will, where it is relevant to any part of our business that is being transferred, be transferred along with that part and the new owner or newly controlling party will, depending on the lawful basis, be permitted to use that data only for the same purposes for which it was originally collected by us.In the event that any of your data is to be transferred in such a manner, you will be contacted in advance and informed of the changes.

🖊️ Changes to Our Privacy Notice

We may change this Privacy Notice from time to time (for example, if the law changes). We recommend that you check this page regularly to keep up to date.

If we make any material changes to the manner in which we process and use your personal data, we will contact you to let you know about the change.

🇪🇺 EU Data Rep

If you’re based in the EU/EEA and are an EU data subject or if you’re based in Switzerland and are an FADP data subject, you can raise questions about your personal data by either contacting our DPO on or you can contact us via our EU GDPR Representative, DataRep:

Finally, we do not sell your data to anyone.