Privacy Policy

Last updated: 2 July 2026  ·  Everyday Sorted Ltd, Company No. 17294707

1. Who we are

TillyTap is operated by Everyday Sorted Ltd (Company No. 17294707), registered in England and Wales. In this policy, "we", "us" and "our" refer to Everyday Sorted Ltd.

For data protection purposes, Everyday Sorted Ltd is the data controller for personal data collected through TillyTap. You can contact us at: privacy@tillytap.co.uk

2. What data we collect

We collect the following categories of personal data:

• Account data: name, email address, phone number, and password (stored as a secure hash)
• Business data: appointment records, client details you enter, takings and expense records, service notes and colour formulas
• Client data you enter: names, contact details, visit history, and treatment notes for your clients — you are the controller of this data; we process it on your behalf
• Payment data: subscription billing is handled by our payment processor; we do not store full card details
• Usage data: log files, IP addresses, device type, browser, and how you use the app (for performance and debugging)
• Receipt images: photos you upload for OCR expense scanning, processed and then deleted

3. How we use your data

We use your personal data to:

• Provide and maintain the TillyTap service
• Send appointment reminders and notifications you have configured
• Process your subscription payments
• Provide customer support
• Improve and develop the app (using anonymised analytics)
• Comply with our legal obligations, including HMRC requirements
• Detect and prevent fraud or abuse

We do not use your data for advertising, profiling, or sell it to third parties.

4. Legal basis for processing (UK GDPR)

• Contract: processing necessary to provide the TillyTap service you have signed up for
• Legitimate interests: security, fraud prevention, service improvement
• Legal obligation: where we are required by law
• Consent: for optional marketing communications (you can withdraw at any time)

5. Your client data

When you use TillyTap to store data about your own clients, you are the data controller for that information, and we act as your data processor. You are responsible for having a lawful basis to hold and process your clients' personal data, and for informing them about how you use it.

We process your clients' data only on your instructions, as described in our Data Processing Agreement (available on request).

6. Data sharing

We share your data only with:

• Infrastructure providers: Amazon Web Services (EU region) for hosting and storage
• Payment processor: for subscription billing (they are independently PCI-DSS compliant)
• Email service provider: to send transactional emails such as confirmations and reminders
• Analytics: anonymised, aggregated data only — no personal identifiers

All our sub-processors are subject to appropriate data processing agreements and operate under UK GDPR-equivalent safeguards.

7. Data retention

We retain your account and business data for as long as your account is active, plus 6 years after closure (to comply with HMRC record-keeping requirements). You can request deletion of your account at any time via the app or by contacting us.

8. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Restrict or object to processing
• Data portability — receive your data in a machine-readable format
• Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, contact us at privacy@tillytap.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Cookies

The TillyTap web app uses strictly necessary cookies for authentication and session management. We do not use advertising or tracking cookies. We may use a minimal analytics cookie (anonymised) to understand how the app is used — this does not identify you personally.

10. Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS/TLS), encrypted data at rest, and access controls. No system is completely secure, but we are committed to keeping your data safe and will notify you of any breach that affects your rights, as required by law.

11. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes via email or an in-app notice. The date at the top of this page shows when it was last updated.

12. Contact

For any privacy-related questions, please contact us at:
privacy@tillytap.co.uk
Everyday Sorted Ltd · Registered in England and Wales · Company No. 17294707