Privacy Policy
Last updated: October 16, 2026. How we protect and process your data.
1. Who We Are
Tintly is operated by Sagar Gupta, an individual based in India (“we”, “us”). For any privacy or data inquiries, contact us at support@tintly.app.
Payments and subscription transactions are conducted via Dodo Payments, our Merchant of Record, which collects and processes customer billing details independently.
2. What Information We Collect
- Account Data: Your email address and authenticated login credentials.
- Brand & Positioning Data: Brand guidelines, target customer notes, product features, tone rules, and proof points you provide to establish your Brand DNA.
- Generated Content & Approvals: Creative drafts, reviewed posts, slide formats, and feedback selections you make during weekly sprints.
- Usage & Technical Data: Operational event logs and subscription status, kept to run the service and keep it stable. On the public pages, aggregate page views and a few events (such as viewing the pricing page), collected without cookies.
- Connected Accounts: If you connect X or LinkedIn, we store the access tokens needed to publish the posts you approve, until you disconnect the account.
- Link Click Data: When someone clicks a tracked link in one of your posts, we record the click with a salted hash of their IP address and browser details (the IP address itself is not stored), plus the browser's user-agent string, referrer, and country, so you can see which posts get read.
- Billing Data: Transaction IDs and plan keys. We do not store credit card numbers or financial payment credentials; all card data is stored directly by Dodo Payments.
3. How We Use Your Data
We use your personal data strictly to:
- Provide, operate, and maintain your AI creative director workspace;
- Synthesize relevant weekly angles and marketing deliverables in your voice;
- Send critical transactional notifications, billing updates, and security alerts;
- Enforce our plan boundaries and protect against abuse.
4. AI Providers & Model Training
We know your product strategy and customer discoveries are sensitive. Tintly does not train models on your data. Your material is sent to AI providers only through their paid API tiers. This is what each provider's published terms say, as we last read them on 10 October 2026:
- xAI: does not train on API data without explicit permission. API data is kept for 30 days for abuse checks and then deleted.
- Google (Gemini API, paid tier): does not use prompts or responses to improve its products. It keeps them for a limited period, for abuse detection only.
- TypeSafe (Jev): receives only the text of your chat messages so it can classify them. We have not yet independently confirmed its data terms or retention period, and will update this policy when we have.
- No Public Sharing: Your prompts and brand materials are never published or shared across other users' accounts.
5. Verified Sub-Processors
We work with trusted third-party infrastructure and service providers to operate Tintly:
| Provider | Purpose | Data Location |
|---|---|---|
| Supabase | User authentication, database, and encrypted storage | Singapore (ap-southeast-1) |
| Vercel | Application hosting, serverless compute, and cookieless page-view analytics | Global Edge / Singapore (sin1) |
| xAI | Strategy, drafting, and research intelligence (Grok API) | United States |
| Google (Gemini API) | Visual slide validation and taste review (Gemini API) | United States |
| TypeSafe | Structured classification decisions (Jev API) | United States / Global |
| Dodo Payments | Merchant of Record, subscription billing, and tax handling | United States / Global |
| Resend | Transactional email delivery and notification routing | United States |
| Cloudflare | DNS and inbound email routing for the support address | Global |
| X (Twitter) API | Scheduled post publishing (when connected by user) | United States |
| LinkedIn API | Scheduled post publishing (when connected by user) | United States |
6. Cookies & Tracking
We do not use third-party advertising pixels or behavioral trackers. We use essential session cookies required to keep you signed in to your workspace.
The public pages use Vercel Web Analytics, which sets no cookies. It identifies a visit only by a hash created from the incoming request, which Vercel discards after 24 hours, and it records page views and a few events (such as viewing the pricing page) in aggregate. The signed-in app does not load it.
7. Your Rights (GDPR, UK GDPR, CCPA/CPRA)
Depending on where you live, you may have the right to:
- Access the personal data we hold about you and receive a copy of it (portability);
- Correct inaccurate data;
- Have your account and associated workspace data deleted;
- Restrict or object to certain processing, and withdraw consent where we rely on it;
- Not be treated differently for using any of these rights.
Legal bases (GDPR): we process your account and workspace data to perform our contract with you, and billing, security, and abuse-prevention data for our legitimate interests and legal obligations. California: we do not sell your personal information or share it for cross-context behavioral advertising.
How to use your rights: write to support@tintly.app from your account email address. For now, exports and deletions are done by us on request, and we fulfill verified requests within 30 days. You can also complain to your local data-protection authority.
Where data is processed: in India, where we operate, and in the places listed in the table above, including Singapore and the United States. Where the law requires safeguards for these transfers, we rely on the contractual terms of our providers.
Age: Tintly is for people aged 18 or over, and we do not knowingly collect data from anyone younger.
8. Data Retention
- Account and workspace data (brand material, drafts, approvals, link click data) is kept while your account is active.
- After a verified deletion request, we delete your account and workspace data within 30 days.
- Backups: we keep encrypted backups of our database for a limited rolling period (about eight weeks), so deleted data can remain in a backup until it rotates out.
- Billing records are held by Dodo Payments as Merchant of Record for as long as tax and accounting law requires. We keep only your plan status and transaction identifiers.
- AI providers keep API data for the periods described in section 4 (xAI up to 30 days; Google for a limited period).
- Connected-account tokens are kept until you disconnect the account or delete your account.