Tillping Privacy Policy
Version: 2026-11-11-v3.4
Effective date: 11 November 2026
Last updated: 11 November 2026
This Privacy Policy explains how personal data is collected and processed in connection with the Tillping website at https://tillping.online and the services provided through it (the "Service"). It provides the information required by the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, and the Israeli Protection of Privacy Law, 5741-1981 and the regulations made under it (the "Israeli Privacy Law"). Capitalized terms not defined in this Privacy Policy have the meanings given to them in our Terms of Service (the "Terms").
In short
- What we collect: your email address and account data; scan data, including the URLs or domains you submit and how they responded; domain-verification data; your consent records; purchase records we receive from our Merchant of Record; mailing-list, early-bird and Founding Offer records if you sign up for them; your support messages; and limited security, rate-limit and cookieless analytics data, keyed to hashed (not raw) IP addresses.
- Who handles it: we use third-party service providers (cloud hosting and database providers and an email delivery provider) that store and process personal data on our behalf, under contract and only on our instructions. Paddle, our Merchant of Record, handles your payment as an independent seller.
- What we use it for: to identify you, run your Account and Scans, process purchases and refunds, support you, keep the Service secure and meet our legal duties; and, only if you opted in, to send our newsletter, the early-bird launch email and the Founding Offer.
- What we never do: we do not sell personal data, and we do not use it for advertising.
The numbered sections below give the full details.
1. Controller and Contact
1.1 Controller. Tillping is operated by Hanna Rynkov, a sole proprietor (Osek Murshe) registered in Israel (the "Operator", "Tillping", "we", "us" or "our"). The Operator is the controller of the personal data described in this Privacy Policy and, for the purposes of the Israeli Privacy Law, the owner of the database.
1.2 Contact. For any question about this Privacy Policy or to exercise your rights, please email support@tillping.online with "Privacy" in the subject line.
1.3 Data protection officer. We have not appointed a data protection officer, as we do not consider that the nature and scale of our processing require one. If this changes, we will publish the officer's contact details in this Privacy Policy.
2. Personal Data We Collect
2.1 Data you provide to us.
| Category | Description |
|---|---|
| Account data | Your email address, used for sign-in and Service communications, and the user ID we assign to you. |
| Scan input | The Target URL you submit, the payment provider you select or we detect, and the Scan type. |
| Domain data | The hostname and webhook URL of each domain you add, the verification token we issue, and the result and time of verification. |
| Consent records | Records of the confirmations, requests and notices you give in the Service, each with its date and time and the version of the text concerned: (a) your Sign-up Confirmation, with the Terms, AUP and Privacy Policy versions; (b) each Authorization Declaration: for Account users, the Sign-up Confirmation together with the Scan or domain to which it relates; for Free Scans without an Account, the version of the notice shown and the Scan record; (c) the Purchase Request you give by ticking the box before checkout, with the exact wording and version of that text, the Terms version, the order and domain concerned, and the time at which we sent the Order Confirmation and its message reference; and (d) each withdrawal you submit through the withdrawal function in your Account dashboard (/dashboard/withdraw), with the name, email address and statement you enter, the order concerned, the time of submission, and the status of the acknowledgement email and of the related refund. |
| Mailing-list data | If you subscribe to our mailing list: your email address, the page on which you subscribed, and the dates of confirmation or unsubscription. |
| Waitlist data | If you join our pre-launch waitlist: your email address, the page on which you signed up, and the dates of sign-up, confirmation and withdrawal (Section 13.2). |
| Founding Offer records | If you are a Founding Member (Section 13.2.1): your confirmation time and position, the personal code issued to you, and whether the Founding Credit was granted and used. |
| Correspondence | The content of messages you send us and your contact details. |
2.2 Data generated when you use the Service.
| Category | Description |
|---|---|
| Scan results | For each request made to a Target: the status code, timing, redirect location and selected response headers (cookie values are removed before storage), the first 240 characters of the response body and certificate information; together with the findings, fix steps, any AI Content, the Scan duration, your user ID (if you are signed in) and a hashed IP address. |
| Hashed IP address | We do not store your IP address in our database in raw form. We store a keyed hash of it (HMAC-SHA-256 with a secret key), which we use for rate limiting, abuse prevention, Scan records and aggregate visitor counts. A keyed hash is pseudonymous personal data, and we treat it as such. |
| Analytics data | Our first-party analytics operate without cookies and without cross-site tracking. Visitors outside the European Economic Area (EEA), the United Kingdom and Switzerland, where your country can be determined: your browser holds a random identifier in session storage for the duration of a single browser tab, and it is deleted when the tab is closed. We store only a keyed hash of that identifier, never the identifier itself, together with the steps you take (such as a page view, a Scan, a sign-up or a purchase), the page path, the referring website's domain or campaign (utm) tags, the first page you visited, and a daily visitor value derived from your hashed IP address and the date. Visitors in the EEA, the United Kingdom or Switzerland, and visitors whose country cannot be determined: no analytics identifier is created or stored on your device, and we record page views only: for each page view, the page path, the referring website's domain or campaign (utm) tags, the time, and the daily visitor value described above. These page views are not linked to one another by any identifier stored on your device, and no other steps are recorded for analytics. We determine your location from the country associated with your IP address, so a visitor using a VPN or proxy may be treated according to the apparent location. Hosting-provider analytics: for visitors outside the EEA, the United Kingdom and Switzerland, where the visitor's country can be determined, we also use privacy-friendly analytics provided by our hosting provider, a cookieless analytics service provided to us as our processor (Section 6.1). It records page views with the page path (we remove query strings before sending, except a campaign reference tag), the referring page, the time, and the approximate location, browser, operating system and device type derived from the request. It does not set cookies or store any identifier on your device; the provider distinguishes visitors by a hash of the incoming request that is discarded after 24 hours, and we see aggregated statistics only. These hosting-provider analytics are switched off for visitors in the EEA, the United Kingdom or Switzerland and for visitors whose country cannot be determined. All visitors: where your browser sends a Do Not Track signal, no session identifier is created and our website sends no page-view events to our first-party analytics or to the hosting-provider analytics. We do not use Google Analytics or any advertising analytics. |
| Security and rate-limit records | Counters used to prevent abuse and to cap the use of AI Content and of Free Scans, keyed by hashed IP address, by a keyed hash of the network range from which you connect (the first 24 bits of an IPv4 address or the first 64 bits of an IPv6 address), by user ID or, for sign-in attempts, by a keyed hash of your email address. |
| AI usage records | Your user ID, hashed IP address or hashed network range, the type of finding, the number of tokens used, the model and the time. |
| Sign-in records | Our authentication provider records your email address, sign-up and last sign-in times, and sign-in event logs that include IP address and time. |
| Copies of emails | A copy of each email we send you (recipient, subject, content and delivery status), such as sign-in links and confirmations. |
| Server logs | Our hosting provider processes your IP address, user agent, the address requested and the time, as part of delivering the website. |
2.3 Data we receive from third parties.
| Source | Description |
|---|---|
| Paddle (Merchant of Record) | Payment records. When you make a purchase, we receive order and customer identifiers, the item purchased, its status and dates, and refund status. We pass your email address and user ID to the checkout so that the purchase can be linked to your Account. We never receive your full payment card number. |
| Google (identity provider) | If you choose Google sign-in, Google provides us with the email address associated with your Google account and a provider user identifier, which we use to create or recognise your Account. Google is the identity provider you choose for that sign-in; it is not our processor under Section 6.1. |
| Scanned endpoints | The responses described in Section 2.2. |
2.4 No credentials or sensitive data. The Service never requires API keys, signing secrets, passwords or payment card data. Please do not submit such information, special categories of personal data or other sensitive information in a Target URL, a Scan option or any correspondence with us.
2.5 Whether you must provide data. You are under no statutory or contractual obligation to provide personal data. However, without an email address we cannot create an Account, sign you in or add you to our mailing list, and without a Target URL we cannot perform a Scan.
3. Purposes and Legal Bases
We process personal data for the purposes set out below. Where the GDPR or UK GDPR applies, we rely on the legal bases indicated. Under the Israeli Privacy Law, we process personal data for the purposes described in this Privacy Policy, of which we inform you when the data is collected, and with your consent where required.
| Purpose | Data | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Performing Scans and displaying Reports | Scan input and results, hashed IP address, user ID | Performance of a contract (Art. 6(1)(b)); for Free Scans run without an Account, our legitimate interest in providing the tool you requested (Art. 6(1)(f)) |
| Creating and administering your Account; sign-in | Account data, sign-in records, authentication cookies | Performance of a contract (Art. 6(1)(b)) |
| Domain verification | Domain data | Performance of a contract (Art. 6(1)(b)) |
| Processing purchases and refunds with the Merchant of Record | Order data, email address, user ID, consent records | Performance of a contract (Art. 6(1)(b)); compliance with legal obligations, including tax and accounting obligations (Art. 6(1)(c)) |
| Keeping proof of consents, confirmations and withdrawals; complying with consumer-protection law; establishing, exercising or defending legal claims | Consent records | Compliance with legal obligations, including the obligations to obtain and confirm a consumer's express request for immediate performance and to acknowledge a withdrawal (Art. 6(1)(c)); our legitimate interests in being able to demonstrate which texts were accepted and which confirmations and withdrawals were given, and in establishing, exercising or defending legal claims (Art. 6(1)(f)) |
| Generating AI Content | The non-identifying finding description described in Section 4; AI usage records | Our legitimate interest in providing clearer remediation guidance at proportionate cost (Art. 6(1)(f)) |
| Preventing abuse and securing the Service and third-party Targets | Hashed IP address, user ID, rate-limit records, Scan records, server logs | Our legitimate interest in the security of the Service and the protection of third parties (Art. 6(1)(f)) |
| Understanding use of the website in aggregate | Analytics data | Our legitimate interest in improving the website, pursued through a privacy-protective design (Art. 6(1)(f)) |
| Sending our newsletter and product updates | Mailing-list data | Your consent, given by double opt-in (Art. 6(1)(a)), which you may withdraw at any time |
| Sending the launch email to the pre-launch waitlist (Section 13.2) | Waitlist data | Your consent, given by double opt-in (Art. 6(1)(a)), which you may withdraw at any time |
| Providing the Founding Offer and preventing duplicate claims (Section 13.2.1) | Founding Offer records | Performance of the offer (Art. 6(1)(b)) |
| Responding to correspondence | Correspondence | Performance of a contract or our legitimate interest, depending on the request (Art. 6(1)(b) or (f)) |
| Complying with law, responding to lawful requests, and establishing, exercising or defending legal claims | Any relevant data | Compliance with legal obligations (Art. 6(1)(c)); our legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may object to such processing at any time (Section 9).
We do not process personal data for purposes incompatible with those set out above unless we first obtain your consent or are otherwise permitted to do so by applicable law.
4. AI Content
4.1 Where a Scan finds a high- or medium-severity issue, we may ask a third-party AI service for a short fix tip. We send it only a short technical description of the finding, and we remove URLs, email addresses, IP addresses and hostnames before sending. This provider may process data outside Israel and the EU. These tips are labeled as AI Content.
4.2 The description is sent from our servers, not from your browser, and is limited to 700 characters: the name of the payment provider, our internal finding code and severity, the finding's standard title (which may include a value such as an HTTP status code or a response time), and a technical signature composed of those elements. Before it is sent, our systems remove any URL, email address, IP address or hostname from it. We do not send the Target's domain or hostname, response headers or bodies, your user ID or any other identifier.
4.3 Because the description relates only to a type of technical problem common to many websites and does not identify you or any Target, we do not regard it as personal data. The AI service receives it under its own terms, and it is not a processor of your personal data.
4.4 The tip returned is stored and may be shown to any user whose Scan produces the same type of finding. It contains no data about you.
5. Cookies and Similar Technologies
5.1 Strictly necessary cookies. We set cookies only where they are strictly necessary to provide the sign-in functionality you request. They are set only if you sign in.
| Cookie | Purpose | Duration |
|---|---|---|
sb-<project-id>-auth-token (set by our authentication service; which may be split into numbered parts) |
Keeps you signed in after you complete a sign-in link or Google sign-in | Up to 400 days, or until you sign out |
sb-<project-id>-auth-token-code-verifier |
Secures the sign-in step (email link or Google) with a one-time verifier | For the duration of sign-in |
5.2 Session storage.
- (a) Analytics. For visitors outside the European Economic Area (EEA), the United Kingdom and Switzerland whose country can be determined, our first-party analytics use a random identifier held in your browser's session storage, as described in Section 2.2. It is not a cookie, is not shared with any third party, is not used to track you across websites, and is deleted when you close the browser tab. It is not set where your browser sends a Do Not Track signal. For visitors in the EEA, the United Kingdom or Switzerland, and for visitors whose country cannot be determined, no analytics identifier is stored in your browser (Section 2.2). Our hosting-provider analytics store nothing in your browser (Section 2.2).
- (b) Running a Deep Scan. When you start a Deep Scan or a re-scan, your browser holds a temporary request key in session storage so that, if the connection is lost or the page is reloaded, the same request is completed and your Deep Scan Credit is not used twice. This storage is strictly necessary to provide the Deep Scan you request. It is removed when the request completes or when you close the browser tab.
5.3 No tracking technologies. We do not use advertising, social-media or third-party analytics cookies, pixels or tracking scripts. The hosting-provider analytics (Section 2.2) are provided by our hosting provider as our processor, does not use cookies or cross-site identifiers, and is not used for advertising.
6. Recipients of Personal Data
6.1 Service providers. We use a small number of third-party service providers to run the Service. They store and process personal data on our behalf, under written contracts (data processing agreements), only on our instructions and only to provide their services to us:
| Category of recipient | What they do for us | Data they handle |
|---|---|---|
| Cloud hosting and database providers | Hosting the website and server code, running scheduled jobs, storing our database, signing you in, and the privacy-friendly analytics provided by our hosting provider (off for visitors in the EEA, the United Kingdom or Switzerland and for visitors whose country cannot be determined) | All data stored by or passing through the Service, including IP addresses in transit, server logs and sign-in records |
| An email delivery provider | Sending sign-in links, confirmations, the launch email and, if you subscribed, our newsletter | Email address, email content and delivery data |
We also send the non-identifying finding description described in Section 4 to a third-party AI service. No personal data is sent to it.
6.2 Paddle. We name Paddle because it is the seller you contract with when you pay: it appears on your receipt and handles payment, VAT and refunds. It is not our processor (Section 6.3). Payment and webhook providers that you test with the Service (for example, Stripe, Lemon Squeezy or Paddle) are mentioned only to describe what the Service checks; in that role they are not our service providers and receive no data from us.
6.3 Merchant of Record. Paddle sells Paid Items to you as reseller and seller of record and processes your payment, contact, tax and transaction data as an independent controller under its own privacy policy (https://www.paddle.com/legal/privacy). We receive from Paddle only the information described in Section 2.3.
6.4 Other disclosures. We may also disclose personal data:
- (a) to the operator of a scanned endpoint, limited to the facts of a Scan of that operator's own systems (such as its time and request details), where the operator reports an unauthorized Scan and we reasonably consider the disclosure necessary to address the complaint and permitted by applicable law;
- (b) to courts, law-enforcement authorities or regulators, where required by applicable law or in response to a valid legal request;
- (c) where necessary to establish, exercise or defend legal claims, or to protect the rights, safety or property of Tillping, our users or the public;
- (d) to professional advisers bound by duties of confidentiality; and
- (e) to a successor or acquirer in connection with a transfer, merger or reorganization of the Tillping business (including its transfer to a company), provided the recipient is bound to process the data in accordance with this Privacy Policy.
6.5 No sale. We do not sell personal data and do not use or disclose it for advertising purposes.
7. International Transfers
7.1 Israel. We are established in Israel. The European Commission has decided that Israel ensures an adequate level of protection for personal data transferred from the European Union, and the United Kingdom recognizes Israel as adequate for transfers from the United Kingdom.
7.2 Transfers outside Israel and the EEA. Some of our service providers, and Paddle, may process personal data outside Israel and the European Economic Area. Where personal data originating in the EU, the EEA or the UK is transferred to a country that is not the subject of an adequacy decision, we rely on an adequacy decision where one exists or, otherwise, on the Standard Contractual Clauses approved by the European Commission (and the UK International Data Transfer Addendum where relevant), incorporated in our providers' data processing agreements (Articles 45 and 46(2)(c) GDPR and the corresponding provisions of the UK GDPR).
7.3 Transfers from Israel. Transfers of personal data from our database to providers abroad are made in accordance with the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001, on the basis of each provider's written undertaking to protect the data adequately and not to transfer it onward except as its agreement permits.
7.4 Details and copies. You may email us for details of these transfers and safeguards, or a copy of them, using the contact details in Section 1.2. Commercial terms may be redacted.
8. Retention
We retain personal data only for as long as necessary for the purposes described in Section 3, after which we delete or anonymize it.
| Data | Retention period |
|---|---|
| Account data | For as long as your Account remains open. Deleted within 30 days of your request to close the Account, save where a longer period below applies. |
| Scans run by signed-in users | 12 months from the Scan, or until your Account is closed, whichever is earlier. |
| Scans run without an Account | 30 days from the Scan. |
| Hashed IP address stored with a Scan | 30 days, after which it is removed from the Scan record. |
| Domain and verification data | Until you remove the domain or your Account is closed. |
| Analytics data | 12 months. The hashed visitor value is removed after 90 days, leaving aggregate counts only. |
| Rate-limit records | 7 days. |
| AI usage records | 90 days. |
| Copies of emails we send | 30 days from sending. |
| Mailing list (confirmed subscribers) | Until you unsubscribe. |
| Mailing list (unconfirmed sign-ups) | 30 days. |
| Waitlist (confirmed sign-ups) | Until thirty (30) days after the launch email is sent, or until you withdraw your consent, whichever is earlier (Section 13.2). |
| Waitlist (unconfirmed sign-ups) | 30 days. |
| Unsubscribe records | We retain your email address and the date of unsubscription for as long as necessary to ensure that we do not email you again. |
| Billing records | 7 years, to comply with tax and accounting obligations. |
| Consent records relating to a purchase (the Sign-up Confirmation in force at the purchase; the Purchase Request; the Order Confirmation record) and withdrawal records | 7 years from the date of the purchase concerned, including after your Account is closed, because these records are needed to show that we complied with consumer-protection law and to establish or defend legal claims. This corresponds to the general limitation period of seven years for claims under Israeli law (Limitation Law, 5718-1958, section 5(1)) and to the retention period for billing records. |
| Authorization Declarations | Kept with the Scan or domain record to which they relate, for the periods stated above for Scans and for domains. Where a Scan or Target is the subject of an abuse report or a legal claim, we keep the related Authorization Declaration as stated in the last row of this table. |
| Founding Offer records (confirmation time and position, personal code, whether the credit was granted and used) | 60 days after the launch email (30 days after the free Deep Scan expires), then deleted. Purpose: providing the Founding Offer and preventing duplicate claims. Basis: performance of the offer (GDPR Art. 6(1)(b)). |
| Records of payment notifications (identifiers only) | 90 days. |
| Correspondence | 24 months from the end of the correspondence. |
| Sign-in logs held by our authentication provider; server logs held by our hosting provider | In accordance with the provider's standard retention settings. |
| Records relating to abuse reports or legal claims | For as long as necessary to resolve the matter and for the applicable limitation period. |
9. Your Rights
9.1 EU, EEA and UK. Subject to the conditions and exceptions provided by law, you have the right to:
- (a) access your personal data and obtain a copy of it;
- (b) rectification of inaccurate or incomplete personal data;
- (c) erasure of your personal data;
- (d) restriction of processing;
- (e) data portability, namely to receive personal data you have provided to us, which we process on the basis of contract or consent, in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible;
- (f) object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests, and to object at any time, without giving reasons, to processing for direct-marketing purposes;
- (g) withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal; and
- (h) lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence or place of work or of the place of the alleged infringement. In the United Kingdom, the supervisory authority is the Information Commissioner's Office.
9.2 Israel. Under the Israeli Privacy Law, you have the right to inspect personal data about you held in our database and to request that we correct or delete data that is inaccurate, incomplete, unclear or out of date. You may also request removal from any list used for direct marketing. If we decline a request, we will inform you of the reasons and of how you may challenge our decision. You may lodge a complaint with the Privacy Protection Authority at the Israeli Ministry of Justice.
9.3 All users. Wherever you are located, you may ask us what personal data we hold about you, request its correction or deletion, and request an export of your data as a file. You may unsubscribe from our mailing list at any time using the link included in every newsletter. We will not discriminate against you for exercising your rights.
9.4 How to exercise your rights. Please email support@tillping.online with "Privacy" in the subject line, where possible from the email address associated with your Account or with your mailing-list subscription. We may need to verify your identity before acting on a request, and we will use any information provided for verification solely for that purpose. We will respond within one month of receipt where the GDPR or UK GDPR applies, and within 30 days where the Israeli Privacy Law applies, subject to any extension permitted by applicable law, of which we will inform you. Requests are free of charge unless they are manifestly unfounded or excessive.
9.5 Limitations. Certain rights are subject to statutory exceptions. For example, we may retain billing records that we are required to keep for tax purposes, or data needed to establish, exercise or defend legal claims. If we are unable to comply with a request in full, we will explain why.
10. If Your Website Was Scanned
If your URL or server was scanned by another person and you wish to know what data we hold about it, or wish us to delete it, please email support@tillping.online with "Privacy" or "Abuse" in the subject line, stating the URL or host and the approximate time of the Scan. Our requests identify themselves with the user agent TillpingProbe/1.0 (+https://tillping.online/security). Where a Scan was not authorized, we may act against the Account responsible under our Acceptable Use Policy.
11. Security
11.1 We implement technical and organizational measures appropriate to the nature of the data and the risks involved, including encryption in transit, database access controls with row-level security, server-side-only access keys, keyed hashing in place of raw IP addresses, removal of cookie values from Scan results, network controls that prevent Scans from reaching private or internal addresses, verification of the signatures of payment notifications, and restriction of access to personal data to the person who operates the Service.
11.2 No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you discover a security vulnerability, please report it to support@tillping.online with "Security" in the subject line, without including any secrets.
11.3 In the event of a personal data breach, we will take appropriate steps to contain and assess it and will notify the competent supervisory authority and affected individuals where, and within the time, required by applicable law.
12. Automated Decision-Making
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Scan findings are automated assessments of an endpoint, not of a person. Automated rate limits may temporarily prevent you from running further Scans; if you believe a limit was applied in error, please contact us and the matter will be reviewed by a person.
13. Marketing Communications and Pre-Launch Waitlist
13.1 Newsletter. We send newsletters and product updates only to persons who have confirmed their subscription through the link in our confirmation email. Each such email contains an unsubscribe link, and unsubscription requests are given effect promptly. Service communications, such as sign-in links, purchase confirmations and notices concerning your Account, the Terms or this Privacy Policy, form part of the Service and are sent irrespective of your marketing preferences.
13.2 Pre-launch waitlist. Before paid Deep Scans become available, you may join our early-bird waitlist. We add your email address to the waitlist only after you confirm it through the link in our confirmation email (double opt-in). We use the waitlist for one purpose only: to send you a single email announcing that Deep Scans are available for purchase (the "launch email"). We do not send you newsletters or other marketing on the basis of the waitlist; you receive those only if you separately subscribe to our newsletter under Section 13.1. The legal basis is your consent (Art. 6(1)(a) GDPR). You may withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal, by using the unsubscribe link in any email we send you or by emailing support@tillping.online. Because the launch email is an advertisement within the meaning of section 30A of the Israeli Communications (Telecommunications and Broadcasting) Law, 5742-1982, we send it only with your consent, identify it as an advertisement, and include in it a means of refusing further advertisements. Waitlist data is stored by our cloud hosting and database providers and the emails are sent through our email delivery provider; the recipients and transfer safeguards described in Sections 6 and 7 apply. We delete your waitlist entry thirty (30) days after the launch email is sent, or promptly when you withdraw your consent, whichever is earlier. We retain only the unsubscribe record described in Section 8 where you have asked us not to email you again.
13.2.1 Founding Offer. If you are one of the first fifty (50) people to confirm your early-bird sign-up (a "Founding Member", as defined in section 21 of our Terms), we also keep the following:
- your confirmation timestamp and position;
- the personal code issued to you;
- whether a free Deep Scan credit was granted to and used on your account.
We use these only to provide the free Deep Scan and to prevent duplicate claims, on the basis of performing the offer (GDPR Art. 6(1)(b)). We delete them sixty (60) days after the launch email, which is thirty (30) days after the free Deep Scan expires. Records of a Deep Scan you actually ran form part of your account data and follow section 8.
14. Children
The Service is intended solely for persons aged 18 or over (Section 4.1 of the Terms). It is not directed at children, and we do not knowingly collect personal data from anyone under the age of 16. If you believe that a child has provided us with personal data, please contact us and we will delete it.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. The current version, with its "Last updated" date, is published on this page. If we make a material change, we will notify Account holders and mailing-list subscribers by email before the change takes effect. Where a change requires your consent under applicable law, we will request it.
16. Contact
We are always happy to hear from you.
Tillping is operated by Hanna Rynkov, a sole proprietor (Osek Murshe) registered in Israel.
Email: support@tillping.online (subject line: "Privacy").