Privacy Policy

In short

This notice covers tidalux.io and summarises TapYes, Quash and the App Studio.

• We do not sell personal data. We do not store the card number.
• Card payments for Tidalux services go through Stripe. In the TapYes Android app, paid extras are billed by Google Play.
• To complain about your data, email legal@tidalux.io. We acknowledge that complaint within 30 days.

Who we are

Tidalux Ltd is a company registered in England and Wales, company number 17019367. Registered office: The Grange, Grange Road, Malvern, WR14 3HA, United Kingdom.

We are registered with the Information Commissioner’s Office, registration ZC091301, as a data controller for the personal data this notice describes. Write to legal@tidalux.io about a tidalux.io account, an invoice, or this notice. App support is support@tidalux.io. The studio inbox is apps@tidalux.io.

What this notice covers

tidalux.io

The company site, client portal, enquiries, invoices, hosting and Wave products you buy from us.

tidalux.ch

The App Studio site and the public crew list. That list is not an account.

TapYes

The app and tapyes.ch. The app’s own notice is tapyes.ch/privacy.html. If the two ever differ, the TapYes page is the one to follow for the app.

Quash

The published site at quash.li. The app is not in a store yet. The privacy link on that site goes to the TapYes notice, which describes TapYes, not a separate Quash account.

tidalux.io

On the company site we collect only what the task needs.

• Contact details: your name, email address and message when you write to us or use a form.
• Account details: email address, a hashed password and preferences if you register for a product or the client portal.
• Billing details: the name and address on an invoice. Card payments for Tidalux services go through Stripe. We do not store the card number.
• Usage logs: IP address, browser type and pages visited, collected by the site itself.
• Cookies: see the Cookie Policy.
• Newsletter: your email address, if you subscribe.
• WaveCheck: if you leave an email so we can send the PDF, we keep that as a lead. If you do not, we still keep the domain you checked, the score and the time of the completed scan so we can count demand. We do not store your IP address or browser against those anonymous rows.

We use that data to provide the service, reply to you, send invoices and receipts, send service messages, and meet legal duties. Marketing email is sent only with your consent, and you can unsubscribe. Optional analytics are described in the cookie policy. We do not sell personal data.

Legal bases

• Contract, where we need the data to do the work you asked for.
• Legitimate interests, for security, fraud prevention and understanding how the site is used, balanced against your rights.
• Consent, for marketing email and for non-essential cookies. You can withdraw consent at any time.
• Legal obligation, where tax or company law says we must keep a record.

Electronic mail and cookies on tidalux.io also sit under the Privacy and Electronic Communications Regulations 2003 (PECR). Non-essential cookies stay off until you choose them. Analytics that are sent to Google stay behind that choice. A narrower exception for statistics that never leave the site does not cover them.

We do not make a decision about you that has a legal effect, or a similarly significant effect, by solely automated means. A site assistant that answers from published pages is not that kind of decision. If that ever changes, we will say so in this notice before we rely on it.

Payments

Card payments for Tidalux services go through Stripe. We do not store the card number. Stripe hosts the payment page and tells us whether the payment succeeded.

You can pay a Tidalux invoice by bank transfer, using Faster Payments, where we agree that in writing. Those details are on the invoice, not in this notice.

TapYes is separate. The reminder itself is free. Keep, and any other digital extra the TapYes site describes, is optional. In the Android app, that charge is billed by Google Play, not by us and not by Stripe. The TapYes terms also say that on iPhone the charge goes through the App Store, and that on tapyes.ch it goes through Stripe. A TapYes receipt stores a product id, an expiry and a store source. It does not store the name on the button or a Yes log, and it does not store the card number. The price is shown before you pay. We do not set a Keep price on this page.

Refunds for a Google Play purchase follow Google Play’s rules. We do not control Google’s refund button. App Store refunds follow Apple’s rules. A Stripe payment on tapyes.ch follows Stripe’s rules for that payment. You can still write to support@tidalux.io.

TapYes

TapYes is a personal reminder published by Tidalux Ltd. It is not a clinic, not a medical device and not medical advice. The listing is for ages 18 and over. TapYes is not in Designed for Families, and it is not directed at children under 13.

The TapYes privacy notice says the following. We repeat it here so this page does not drift away from the app.

• The name on Yes, the reminder time, loudness, look, colour, optional cutoff, optional cues, optional supplements, further reminders if you have Keep, and Yes logs stay on the device, unless you turn on optional backup.
• On a phone, that store is encrypted on the device. Uninstalling TapYes, or clearing its storage, removes it.
• You can skip Google. TapYes still works. If you choose the spare key, TapYes asks Google to confirm it is you. It does not ask for your email address or your contacts. The app keeps a hashed Google user id on the device so it can recognise the same spare key later.
• If a backup host is switched on, we store that hashed id, a sealed box and a wrap of the key. The words that open the wrap stay on your devices. They are not uploaded, so we cannot read what is inside the box, including a medicine name if that is what you typed. If no backup host is on, nothing from TapYes is sent to us.
• No ads. No analytics SDK. No crash reporter. No sale of data. We do not use TapYes data to train models. We do not show third-party advertising.
• Reminders are scheduled on the device. We do not use those notifications to collect data.

The TapYes marketing pages also say “no tracking”. This notice does not repeat that as a blanket line, because the privacy page describes an optional Google sign-in and, on the website, a Stripe receipt. Those are not an ads SDK. They are also not “nothing ever leaves the phone” once you choose them.

On-device data stays until you delete the app, clear storage, or overwrite it. Server backup, if any, stays until you ask us to delete it or you overwrite it with a new spare-key save. A payment receipt stays until the store subscription ends, or until you ask us to delete the spare-key record. The TapYes pages say we aim to action those email requests within 14 days.

Quash

Quash has a published website. The app is not available in an app store yet. The Quash site says tasks stay on the phone, that uninstalling removes them, and that Quash does not run ads, analytics or crash reporters. It also says Quash does not sell data. We do not describe a Quash account, a spare key, or a server backup, because the Quash site does not describe one.

The privacy, terms and deletion links on quash.li go to the TapYes pages. Those pages describe TapYes. If you only used Quash on a phone and never sent us anything, uninstalling removes what the site says is on the device.

App Studio

tidalux.ch publishes the studio and a public crew list: names, short lines and pictures for the apps. The list is not an account and it does not take a payment. Some faces are marked as the Keep set, which is the paid tier inside TapYes. The list does not show a price. We do not treat a visit to that list as a product account.

Who we share data with

We do not sell, rent or trade personal data. We use these processors where the product needs them:

• Stripe, for card payments on Tidalux invoices and, where the TapYes notice says so, for Keep bought on tapyes.ch. You enter the card on Stripe’s page. We do not store the card number. Stripe tells us whether the payment succeeded.
• GoCardless, when a UK direct debit is set up on request. You enter the bank details on their page. They tell us the instruction is in place.
• Google Analytics 4, for aggregate website analytics on tidalux.io, and only where you have consented. Google Analytics 4 does not store your full IP address.
• Google Ads measurement, only where you have turned on campaign measurement. We may send a hashed email from a contact form so we can see which of our own adverts led to an enquiry. We never put adverts on this website.
• Google, for TapYes on Android: Play billing of paid extras, and the optional spare-key sign-in described above. Play billing is Google’s checkout, not ours.
• Apple, where you buy TapYes Keep on iPhone. The App Store bills that purchase under Apple’s terms. We do not store the card number.
• Proton Mail, for outbound email on enquiries, billing and service messages.
• Specialist companies that run the UK infrastructure our platform uses. See the next section.
• Authorities, where the law requires it.

For the processors we appoint for tidalux.io, we put written data processing terms in place. Google Play and Apple bill you under their own terms. They are not our card processor for those in-app purchases.

Where tidalux.io data is hosted

We design, run and support the platform your website, email and applications sit on. We do not own or operate data centres. The underlying infrastructure is in the United Kingdom and is operated for us by specialist companies under contract. Your contract stays with Tidalux Ltd. Those companies act as our processors, or as sub-processors where we handle personal data on your behalf, under written terms.

If you are a business customer and you need the names of the sub-processors used for your own service, email legal@tidalux.io and we will send them in writing.

How long we keep tidalux.io data

Account data is kept for the life of the account and then for 7 years where tax rules require it. Enquiry messages are kept for 2 years. You can ask us to delete sooner. We will say if a law requires us to keep a particular record, such as an invoice. TapYes retention is the shorter account in the TapYes section above, not this 7 year rule.

Your rights and deletion

Under UK GDPR you can ask to access, correct, delete, restrict or receive a copy of personal data we hold, object to processing based on legitimate interests, and withdraw consent. None of that removes a record we are legally required to keep.

For a tidalux.io account, portal, invoice or enquiry, email legal@tidalux.io. Include the email address we hold for you and what you want done. We respond within one month. There is not a self-serve delete button for those accounts on tidalux.io.

For TapYes, the in-app path is Options, then More, then Your data. Delete my account opens tapyes.ch/delete.html. Delete my data opens tapyes.ch/delete-data.html. Those pages write to support@tidalux.io. They explain what is removed from a server and what only exists on the phone.

How to complain about your data

You can complain to us about how we use personal data. That includes a concern about access, marketing, cookies, how long we keep something, security, or this notice. Email legal@tidalux.io with the subject “Data protection complaint”, the email address we hold for you, and what you want us to look at. You can also write by post to the registered office above, marked for the legal contact.

We will acknowledge a complaint within 30 days. We will look into it and tell you the outcome without undue delay, including what we have done. If you are not satisfied with that outcome, you can complain to the Information Commissioner’s Office at ico.org.uk. Please contact us first so we can try to put it right.

Children

tidalux.io is a business site. It is not directed at children. TapYes is listed for ages 18 and over. It is not directed at children under 13, it is not in Designed for Families, and it is not a children’s app. We do not knowingly collect children’s data. If we learn that we have, we will delete it. The Quash site does not state an age rating. We do not present Quash as a children’s app.

Security

We use encrypted connections (HTTPS), limit who on our side can open customer data, and review hosting and backups. No internet transmission is completely secure. If we become aware of a breach that is likely to affect your rights, we will tell you and the ICO when the law says we must.

International transfers

We primarily process personal data in the United Kingdom and the European Economic Area. Where a processor is outside the UK, we use an appropriate safeguard under UK GDPR, such as the UK International Data Transfer Agreement or Addendum, or adequacy regulations, and we look at the risk before the transfer.

For Google Analytics 4 and, where you consent, Google Ads measurement, Google may process data outside the UK. Google relies on Standard Contractual Clauses with the UK Addendum, and participates in the EU-US Data Privacy Framework and its UK extension, as a safeguard for those transfers.

Changes

The date at the top is the last review. When a change matters, we describe it on this page. We do not treat continued use as a substitute for telling you about a change that affects your data.

Contact

legal@tidalux.io for this notice and for tidalux.io personal data. support@tidalux.io for TapYes deletion and app help. Post is the registered office above.