Skip to content
TackNote

Legal

Privacy policy

What we collect, why we need it, and who else ever sees it. This is the working outline.

Last updated August 2026

01The short version

  • A supporter never sees a creator's address, legal name or contact details.
  • A creator never sees a supporter's address or payment details, and sees a real name only if the supporter chooses to share one.
  • No identity documents are collected to receive gifts.

02What we collect

  • Account data: email address, handle, password hash.
  • Delivery data: the shipping address a creator gives us so we can forward parcels.
  • Gift data: items, amounts, messages and timestamps.
  • Technical data: IP address, device and browser information, and pages visited.

To be drafted

  • Confirm the full list of analytics events and the retention period for each.
  • Document exactly which fields the payment processor returns to us.

03Why we collect it

  • To forward gifts to the right person, which cannot be done without a delivery address.
  • To prevent fraud and abuse of the forwarding service.
  • To provide support when a parcel goes missing.

To be drafted

  • Map each purpose to its lawful basis under UK and EU GDPR.
  • Decide whether product analytics runs on consent or legitimate interests.

04Who we share it with

  • Payment processors, to take payment and pay out.
  • Shipping carriers, limited to what is needed to deliver a parcel.
  • Hosting and infrastructure providers.

To be drafted

  • Publish the full subprocessor list with locations, and commit to a notice period for changes.
  • Confirm the transfer mechanism for data leaving the UK and EEA.

05How long we keep it

To be drafted

  • Set a retention period for each category, and the deletion schedule after account closure.
  • Confirm the minimum retention required by tax and anti-money-laundering law.

06Your rights

  • You can request a copy of your data, correct it, or ask for it to be deleted.
  • You can object to processing and complain to your local data protection authority.

To be drafted

  • Name the data protection contact and the response time commitment.
  • Build and document the self-serve export and deletion flow.

07Children

To be drafted

  • Set the minimum age for an account and describe how under-age accounts are handled once identified.

Questions about this document?

Write to legal@tacknote.xyz and a human will come back to you.