Privacy Policy

Last updated: [DATE]

This policy explains what personal data Promi Z Limited ("TivroLabs", "we", "us") collects, why we collect it, and what rights you have over it. We are the data controller for the information described here.

We are registered in England and Wales, For any question about this policy or your data, contact abhi@tivro.app.

What we collect

When you request a quote or contact us

• Your name, email address, and optionally your company name and phone number
• The details of the project you describe
• Your indicated budget range and timeline
• Your IP address, recorded to limit automated spam submissions

When you have a client account

• Your name, email address, company name, billing address and phone number
• Invoices, quotes, payments and their history
• Support tickets, replies and any files you attach to them
• Contracts, including electronic signatures and the date and IP address at signing
• Sign-in records: date, time and IP address, kept for account security

When you visit the website

We do not use advertising or tracking cookies. A single session cookie is set when you sign in to the client portal; it is required for the portal to work and is removed when you sign out.

What we do not collect

We never see or store your full card number. Card payments are processed by Stripe, and we retain only the card brand and its last four digits so you can identify a saved card.

Why we process it

• To perform our contract with you — delivering projects, issuing invoices, providing support, operating your client portal
• To comply with legal obligations — UK tax and accounting law requires us to keep financial records
• For our legitimate interests — responding to enquiries, securing our systems against abuse, and keeping records of what was agreed

We do not sell your data, and we do not use it for advertising.

Credentials we hold for you

Some projects require us to hold access credentials for your hosting, registrar, control panel or third-party services. Where we do:

• They are encrypted at rest using AES-256-GCM, with the encryption key stored outside the web directory
• Every time a credential is revealed, it is recorded with the user, date, time and IP address
• You can ask us to delete any credential at any time

We recommend you revoke any access we no longer need at the end of a project.

Who we share it with

We use a small number of third-party processors, each of which handles data on our instructions:

• Stripe — card payment processing
• Our hosting provider — storage of the website, portal and database
• Our email provider — sending invoices, notifications and correspondence

We may also disclose information where we are legally required to. We do not share your data with anyone else.

Where your data is held

Our servers are located in [SERVER LOCATION]. Some processors may transfer data outside the UK; where they do, transfers are covered by an adequacy decision or by standard contractual clauses.

How long we keep it

• Quote requests that do not become projects — up to 24 months, then deleted
• Invoices, payments and financial records — 6 years, as required by UK tax law
• Support tickets and project files — for the life of the client relationship, then 24 months
• Sign-in records — 6 months
• Activity logs — 12 months
• Stored credentials — until you ask us to delete them, or the project ends

Your rights

Under UK GDPR you have the right to:

• Ask what personal data we hold about you and receive a copy
• Have inaccurate data corrected
• Have your data deleted, where we are not legally required to keep it
• Object to or restrict how we process it
• Receive your data in a portable format

To exercise any of these, email abhi@tivro.app. We will respond within one month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Security

We use HTTPS throughout, hash passwords rather than storing them, encrypt stored credentials, require two-factor authentication on administrative accounts, and rate-limit sign-in attempts. No system is perfectly secure, but if a breach affects your data we will tell you and, where required, the ICO within 72 hours.

Changes

If we change this policy we will update the date at the top. Where the change is significant, we will tell active clients by email.