01 Controller and contact #
Tap To Start Ltd (1 Example Street, London EC1A 1AA, United Kingdom) is the controller of the personal data described in this policy, except where we act as a processor for an organiser (see “Room data” below). Contact us at [email protected].
02 What we collect #
Account data — when an organiser signs up: name, email address, organisation name, password hash, plan and billing details. Card details are handled by our payment processor; we never see or store full card numbers.
Room data — the questions an organiser creates and the answers participants submit. Participants are anonymous by default: we do not ask for a name, an email address or an account. If an organiser turns on name capture, that name is part of room data.
Technical data — when anyone loads a page: IP address, user agent, referring page, and timestamps. We use a short-lived hash of the IP address to prevent one device stuffing a poll; we do not retain raw IP addresses for analytics.
Support data — anything you send us by email or in a support conversation.
03 Why we use it, and our lawful bases #
- To provide the Service and run rooms — performance of our contract with the organiser.
- To bill for paid plans and keep accounting records — contract, and legal obligation.
- To keep the Service secure and prevent abuse or vote-stuffing — legitimate interests.
- To measure aggregate product usage and improve the Service — legitimate interests, using data that does not identify individuals.
- To send service notices you cannot opt out of, such as security or billing notices — contract.
- To send product marketing to organisers — consent, withdrawable at any time from any email we send.
- To place non-essential cookies — consent, managed through the cookie banner.
04 Room data: we act as processor #
For the content of rooms, the organiser is the controller and we are the processor. We process room data only on the organiser’s documented instructions, we do not use it to train models or build profiles, and we do not sell it. If you took part in a room and want your response removed, contact the organiser who ran it; if you cannot identify them, contact us and we will help.
05 Cookies #
We use a small number of cookies. Strictly necessary cookies are set without consent; everything else waits for your choice in the cookie banner. Full detail, including names and lifetimes, is in our Cookie Policy.
07 International transfers #
Our primary infrastructure is in the UK and the EEA. Where a processor is outside the UK or EEA, we rely on UK adequacy regulations, the UK International Data Transfer Addendum, or EU Standard Contractual Clauses, together with a transfer risk assessment.
08 How long we keep it #
| Data | Retention |
|---|---|
| Account data | For the life of the account, then 12 months |
| Room data — free plan | 7 days after the room closes |
| Room data — Host plan | 12 months, or until the organiser deletes it |
| Room data — Venue plan | As set in the order form |
| Billing records | 7 years (statutory accounting requirement) |
| Security and abuse logs | 90 days |
| Support conversations | 24 months |
09 Your rights #
Under the UK GDPR and equivalent laws you have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting processing already carried out.
To exercise any of these, email [email protected]. We respond within one month. You will not be charged, and we will not treat you differently for asking.
If you are unhappy with our response you can complain to the Information Commissioner’s Office (ico.org.uk) or to your local supervisory authority.
10 Children #
The Service is not directed at children under 16 and we do not knowingly collect their personal data for our own purposes. Rooms may be run for younger audiences by a responsible adult, who is responsible for any consents required. If you believe a child’s data has reached us, contact [email protected] and we will delete it.
11 Security #
We encrypt data in transit with TLS and at rest, restrict internal access on a need-to-know basis, log administrative access, and test the Service regularly. No system is perfectly secure; if a breach affects your rights and freedoms we will notify you and the relevant regulator as the law requires.
12 Changes #
We will post any changes here and update the date at the top. If a change is material we will tell account holders by email before it takes effect.
Something unclear? Email [email protected] and a human will answer.