Privacy.

Tagits is run by Steve Jarvis, a sole trader trading as tagits.co.uk, who is the controller of the personal information described here. That means we decide how it is used and are responsible for looking after it. Our postal address is in our terms. For anything in this notice, email hello@tagits.co.uk.

Opening a tag needs no app and no sign-in. Each time a tag is opened we record which tag and when, so the host can see which pages guests use. Nothing about you or your phone is saved with it.

If you use “Something’s not working”, what you write is emailed to the host and kept with the property’s record, as are the boxes you tick on a checkout list. We do not ask for your name or contact details, so only include them if you want the host to have them.

To stop abuse, we use your IP address to limit how many messages and PIN attempts come from one place. That count is deleted within a day.

When you sign up we hold your email address and, if you give it, your name, to run your account and sign you in. We also hold what you set up: your site, properties, tags, the pages you write, and the checks and guest messages recorded at your properties. We use it to provide Tagits to you, under our contract with you.

When you pay, Stripe tells us the payment went through and gives us the delivery name and address, which we use to post your tags. We keep a record of each order and payment because tax law requires it.

We email you sign-in links, reminders when a check is due, a monthly count of how often your tags were opened, fault reports from guests, and messages about your orders and plan. These are part of the service, not marketing.

A host can invite you to a property by giving us your email address. We send you an invitation, and you can add your name when you sign in. Each check you record is saved with your name, the date, the time and the answer, because that is what a safety log is for. We use it to provide the log the host has asked for, which is in our legitimate interests and theirs.

If you asked to hear when Tagits opens, we hold your email address to tell you, because you consented. To come off the list, email hello@tagits.co.uk and we will remove you.

If you email us, we keep the message to answer you, in our legitimate interests in replying to people who contact us.

Like every website, ours receives your IP address, browser and the pages you request, and our host keeps them in short-lived logs to run the site and keep it secure. On the information pages, not on tag pages or in accounts, we count visits with Vercel Web Analytics. It sets no cookies, stores nothing on your device and does not identify you; it tells us which pages are read, from which country and on what kind of device. We rely on our legitimate interests in running and improving the site.

We do not sell personal information, and we make no decisions about anyone by automated means.

These companies run parts of Tagits for us, act only on our instructions, and must keep it secure:

Vercel, which hosts the site, on servers in London (Vercel Inc. is in the USA). Neon, which holds the database, in London. Resend, which sends our emails, in the USA. Zoho, which runs our hello@tagits.co.uk mailbox, in the EU. Royal Mail or the courier carrying your parcel sees the name and address on it.

Card payments are taken by Stripe, which acts under its own privacy notice at stripe.com/gb/privacy. We never see your full card number.

A host sees the checks, messages and names recorded at their own properties. We also share information when we have to: with HMRC and an accountant for tax, with professional advisers, with the police or courts where the law requires it, or with a buyer if Tagits is ever sold, who would have to follow this notice.

Where a provider handles information outside the UK, it is protected in one of the ways UK law allows: the country is approved by UK regulations (the EEA, and US companies certified under the UK Extension to the EU-US Data Privacy Framework), or the transfer is covered by the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Ask us for the details for any provider.

A host’s account, properties, pages, safety log and guest messages: while the account is open, and after a plan ends so the log can still be read and printed, until the host asks us to close the account. Hot tub records in particular may need keeping for years, which is why nothing is deleted on its own.

A cleaner’s access ends when the host removes them, but their name stays on the checks they recorded, because those are the host’s record.

Orders and payments: six years from the end of the tax year they fall in. Sign-in links: deleted within a day of expiring, 15 minutes after they are sent. Sessions: deleted when they expire, after 30 days. IP counts used to stop abuse: a day. Emails to us: up to two years after we last hear from you. The mailing list: until you come off it.

When the time is up we delete the information or make it fully anonymous.

We set two cookies, both needed for the site to work, so they need no consent. __Host-tg_session keeps you signed in: 30 days, or until you sign out. __Secure-tg_pin_… remembers, for 12 hours, that you entered a tag’s PIN, so the protected part of that page stays open. Neither is set unless you sign in or enter a PIN. There are no advertising or tracking cookies. Stripe sets its own cookies on its payment page.

You can ask for a copy of the personal information we hold about you, ask us to correct it, delete it or restrict how we use it, object to how we use it where we rely on legitimate interests, ask for information you gave us in a format you can take elsewhere, and withdraw consent where we rely on it.

Email hello@tagits.co.uk. There is no charge. We reply within one month, and may ask for proof of identity first; a complex request can take up to two months more, and we will tell you if it does. Some rights have limits, for example where we must keep payment records, and we will tell you if one applies.

If you are unhappy with how we have used your information, please tell us first by emailing hello@tagits.co.uk. We acknowledge a complaint within 30 days, look into it properly and tell you the outcome.

You can also complain to the Information Commissioner’s Office, the UK regulator: ico.org.uk/make-a-complaint, 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Tagits accounts are for adults running a business. Anyone can open a tag page, children included, and it collects nothing about them.

We update this notice when what we do changes, and the date at the top shows the latest version. If a change matters to you, we will tell you before it applies.