Privacy notice
Last updated 19 October 2026
Who we are
[Company name], [Registered address], CRO no. [CRO number] (“we”) provides Townspoke. This notice covers our website, people who ask to join the pilot, and the owners and managers who use the dashboard. Questions: [privacy email].
Messaged a business that uses Townspoke?
That business is responsible for your information, and we process it on its behalf. Their privacy notice explains how it’s used. Please contact them directly; if you contact us, we’ll pass your request on to them.
What we collect and why
| Information | When | Why | Legal basis |
|---|---|---|---|
| Name, business name, email, phone, business type and message | You ask to join the pilot | To contact you about the pilot | Steps before a contract, at your request (GDPR Art. 6(1)(b)) |
| Name, email, password (stored only as a secure hash), alert settings and an optional WhatsApp number for alerts | You use the owner dashboard | To give you an account and send you alerts | Contract (Art. 6(1)(b)) |
| Sign-in records: time, whether it worked, network address | You sign in | To keep accounts secure and stop password guessing | Legitimate interest in security (Art. 6(1)(f)) |
| Plan, subscription status, invoices, billing address and VAT number. Card details are held by Stripe, never by us | You choose a paid plan | To bill you | Contract (Art. 6(1)(b)); legal obligation to keep tax records (Art. 6(1)(c)) |
| Support emails and messages | You contact us | To help you | Contract or legitimate interest (Art. 6(1)(b), (f)) |
We don’t use advertising or analytics cookies. The dashboard sets one essential cookie to keep you signed in.
Who we share it with
These providers act for us under data processing terms:
- Vercel: website hosting (Frankfurt region, EU)
- Neon: database (EU region)
- Resend: email
- Stripe: subscription billing
- Meta (WhatsApp): only if you turn on WhatsApp alerts
Some are US companies. Where information leaves the European Economic Area, it’s protected by an adequacy decision, such as the EU-US Data Privacy Framework, or by the European Commission’s Standard Contractual Clauses. We don’t sell personal information.
How long we keep it
- Pilot requests: 12 months, then deleted automatically.
- Accounts: while you use the service, and deleted within 90 days of closing your account.
- Sign-in records: 30 days.
- Invoices and billing records: 6 years, as Irish tax law requires.
Your rights
You can ask for a copy of your information, or ask us to correct it, delete it, limit how we use it, or give it to you in a portable format. You can also object to how we use it where we rely on legitimate interests. Email [privacy email], and we’ll reply within a month.
If you’re not happy, you can complain to the Data Protection Commission: www.dataprotection.ie, 21 Fitzwilliam Square South, Dublin 2, D02 RD28.
Changes
We’ll post changes here and email account holders about important ones.