Privacy policy

01Data we collect

Account data. When you create an account we collect the identifiers necessary to run it: name, email address, a hashed password (or the token returned by the third-party identity provider you chose), organization or workspace name where applicable, and your chosen display preferences.

Usage data. We log request metadata needed to operate the Services: IP address, user agent, timestamp, the URL or API endpoint you asked for, the referring URL, and the response status. Inside authenticated product surfaces we log the features you used, in-app events you triggered, and errors you encountered.

Content. Anything you submit to the Services (forms, uploads, project data, messages, support tickets) is stored so we can provide what you asked for.

Cookies and local storage. We set a minimum set of first-party cookies to keep sessions alive, remember preferences, and, with your consent, measure aggregate site performance. See our Cookie Policy for the full list.

Billing data. If you enter a paid plan, our payment processor Stripe collects the card or bank details; we receive only the last four digits, card brand, expiry, and billing country for our records.

We do not buy personal data, enrich visitors from third-party data brokers, or run browser fingerprinting to defeat private browsing.

02Lead capture on public cards

This section is about people who are not our users. A TNAADO Connect card has a public web page, and that page carries a contact form. The form is switched on by default for every card, on free and paid accounts alike, and it is not a paid feature. A visitor who chooses to fill it in may give us their name, email address, phone number, company, and a short message, recorded alongside the page it was submitted from and the referring URL. That visitor has no TNAADO Labs account and is under no obligation to submit anything in order to read the card. This is the category the app's privacy manifest and its App Store privacy label describe as contact information about people who are not users of the app.

Where it goes. A submitted lead is delivered to the owner of the card, who reads it in the TNAADO Connect app and in the web portal and may export it to a contact file. We hold it on that card owner's behalf; the card owner decides whether and how to follow up, and is the controller of that follow-up. We do not use leads for our own marketing, we do not add them to our mailing lists, and we do not sell, rent, or disclose them to anyone other than the card owner and the sub-processors listed in section 05.

Lawful basis. Where the GDPR applies, we rely on the visitor's consent, given by choosing to complete and submit the form, together with the card owner's legitimate interest in receiving an enquiry that was addressed to them. Consent may be withdrawn at any time through the erasure route below.

Retention. A lead is kept for 730 days (two years) from the day it is submitted and is then deleted. A card owner may delete an individual lead sooner, and closing an account removes the leads held under it.

How a lead asks to be erased. You do not need a TNAADO Labs account to exercise your rights over a form you submitted. Email [email protected] with the subject line “Lead erasure”, the email address or phone number you entered on the form, and the card or the person you submitted it to. We will locate the record, confirm the request with the address you gave, and delete it. The same route covers access and correction requests, on the timescales set out in section 06.

03Card analytics

What is recorded. When someone opens a public TNAADO Connect card, or taps a link on it, we record the event so the card owner can see how their own card is performing. Each event carries the time, the kind of event, the city, region, and country resolved from the visitor's network address, the browser and operating system family, the device type, the referring URL, and a visitor id.

First party only. The visitor id is a value held in that browser's local storage for the card domain that set it. It exists for one purpose, counting how many distinct people viewed a card, and it is never shown to the card owner. We do not set it on any other site, we do not join it to an advertising identifier, we do not embed a third-party advertising or analytics network on card pages, and we do not track visitors across apps or websites owned by other companies. The app declares no tracking in its privacy manifest for exactly this reason.

Addresses are not kept. A visitor's network address is used once, at the moment of the request, to resolve an approximate location, and is then discarded. What we store in its place is a truncated one-way hash. Location is recorded no more precisely than a city. We do not store latitude and longitude, and we do not store the internet provider.

Retention. Card views and link clicks are deleted 180 days after they are recorded, and saved-contact records are deleted after 365 days, both by a scheduled job that runs nightly. A free account can read only the most recent 50 events on a card; Connect Pro lifts that reading limit but does not extend how long any event is kept.

04How we use it

We use the data above to operate and secure the Services, authenticate users, process payments, respond to support requests, investigate abuse, comply with legal obligations, measure aggregate performance of the site and product, communicate material changes, and improve our product. We do not sell your data, rent it, trade it, or expose it to advertising networks, and we do not use customer content to train machine-learning models for ourselves or anyone else.

Our lawful bases, where GDPR applies, are (a) performance of the contract we have with you, (b) our legitimate interest in running a secure, well-maintained service, (c) compliance with legal obligations, and (d) your consent for optional analytics cookies.

05How we share it

We share personal data only with the sub-processors needed to run the Services, each under a written data-processing agreement:

• Vercel Inc.: hosting and edge delivery of tnaado.com and the application endpoints (United States).
• Supabase Inc.: managed Postgres, authentication, and object storage acting as our data processor (United States).
• Stripe, Inc.: payment processing for subscriptions and one-off charges (United States).
• Resend, Inc.: transactional and account email delivery (United States).
• Google LLC: aggregate page-view analytics (Google Analytics 4), and only where you have accepted analytics cookies on the in-page banner (United States).

We may disclose personal data to law enforcement or other government authorities where required by a valid legal request, and we will notify the affected account unless the request prohibits it. In a merger, acquisition, or sale of assets, your data may transfer to the successor; in that case we will give you notice and an opportunity to delete your account before the transfer.

06Your rights

Depending on where you live, you have some or all of the following rights with respect to the personal data we hold about you:

• Access: ask for a copy of your personal data.
• Correction: ask us to fix data that is inaccurate or incomplete.
• Deletion: ask us to erase your account and the personal data associated with it.
• Portability / export: receive a machine-readable export of your content.
• Objection and restriction: object to, or ask us to restrict, certain processing.
• Opt out of sale or sharing: although we do not sell or “share” personal data as those terms are defined under the CCPA and CPRA, California residents may still submit a verifiable opt-out request.
• Withdraw consent: for any processing we perform on the basis of your consent.
• Lodge a complaint: with your local data-protection authority.

To exercise any of these rights, email [email protected] from the address on the account, with the subject line “Privacy request” and enough detail for us to locate your records. We will acknowledge within seven days and respond substantively within thirty, or explain why we need longer. We will not discriminate against you for exercising these rights.

07Retention

We keep personal data only for as long as we need it for the purposes set out above, or as required by law. Request logs roll off after thirty days. Support-email threads stay while the relationship warrants them and are deleted on request. Account data is kept while the account is open and deleted within thirty days of account closure, except for records we must retain for tax, accounting, or dispute-resolution purposes (typically up to seven years).

08International transfers

TNAADO Labs is based in the United States and our primary sub-processors operate in the United States. If you access the Services from the European Economic Area, the United Kingdom, Switzerland, Canada, or another jurisdiction with data-export rules, your data is transferred to the United States on the basis of the Standard Contractual Clauses published by the European Commission (and the UK Addendum where applicable), supplemented by the technical and organizational measures described in our Security page.

09Children

The Services are not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has submitted personal data to us, write to [email protected] and we will delete it. For applications targeted at minors, we enforce additional age gates described in the app's own policy.

10Changes to this policy

When we make a material change to this policy we will update the effective date at the top of the page and, for account holders, email a short summary at least fourteen days before the change takes effect.

11Contact the Data Protection Officer

Privacy questions, requests, or complaints go to our Data Protection Officer at [email protected]. You can also reach the studio via the contact page. Postal mail, marked “Attn: DPO”: TNAADO Labs, Inc., 777 Brickell Avenue, Suite 500, Miami, FL 33131, United States.