Privacy Policy

This policy explains what personal data Tagsmith collects, why, and your rights.

1. Data we collect

• Account data: name, work email, and a hashed password (stored with bcrypt — we never store plaintext passwords).
• Workspace content: the data you create — UTM links, destination URLs, taxonomies/naming rules, team and workspace names, invited teammates' email addresses, and activity/audit history.
• Billing data: handled by Stripe. We do not store your full card number; Stripe processes payments and returns limited metadata (e.g., subscription status).
• Technical data: standard server logs and operational data needed to run and secure the Service.

2. How we use data

To provide and operate the Service, process payments, send transactional email (verification, teammate invites, password resets), secure and improve the Service, and comply with legal obligations. We do not sell your personal data and do not use it for third-party advertising.

3. Legal bases (where GDPR/UK GDPR applies)

Performance of our contract with you, our legitimate interests (securing and improving the Service), consent where required, and compliance with legal obligations.

4. Sub-processors

• Render — application hosting and Postgres database (data stored in the US).
• Stripe — payment processing.
• Twilio SendGrid — transactional email delivery.

5. International transfers

Data may be processed in the United States. Where required, transfers rely on appropriate safeguards (e.g., Standard Contractual Clauses via our sub-processors).

6. Data retention

We retain account and workspace data while your account is active. You can delete your workspace at any time; on deletion we remove your workspace data from active systems, with residual copies in backups purged on our normal backup cycle. Some records may be retained as required by law (e.g., billing records).

7. Your rights

Depending on your location, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Tagsmith provides in-app data export and workspace deletion. To exercise other rights, contact support@gettagsmith.com. You may also lodge a complaint with your local data-protection authority.

8. Security

We use measures including password hashing (bcrypt), token-based authentication, transport encryption (HTTPS), and access controls. No system is perfectly secure; we cannot guarantee absolute security.

9. Children

The Service is for business use and not directed to anyone under 18. We do not knowingly collect data from children.

10. Changes

We may update this policy; material changes will be communicated before they take effect.

11. Contact

Privacy questions or requests: support@gettagsmith.com.