Privacy Policy

Account data: your name, email address, and password (stored as an irreversible hash, never in plain text) when you create an account.

Business listing data: if you list a business, the business name, description, category, city, website, contact email/phone, address, and opening hours you provide.

Payment data: if you pay for a placement, Stripe processes your card details directly — we never see or store your card number. We receive confirmation that a payment succeeded, its amount, and a Stripe transaction reference. Stripe emails you an invoice and a receipt.

Usage data: general site analytics (pages visited, approximate location, device type) via Google Analytics — only if you accept statistics cookies, and only on the live production site.

Cookies and browser storage: a session cookie (keeps you logged in) and a language-preference cookie are needed for the site to work and are always set. Google Analytics cookies are set only if you accept them in the cookie banner, and you can change your choice at any time under "Cookie settings" at the bottom of every page. Your chosen city, your saved businesses and your cookie choice are kept only in your own browser; we do not store them.

To provide the service you asked for: creating and managing your account, publishing your business listing, and processing payments for placements.

To communicate with you: account verification emails, password reset emails, and service-related notices.

To keep the service secure and working correctly, and to understand how the site is used so we can improve it.

The legal basis is performance of a contract (providing the account/listing service), our legitimate interest (security, fraud prevention, improving the service), or your consent where applicable.

Site analytics through Google Analytics is based solely on your consent, which you can withdraw at any time under "Cookie settings". Withdrawing it removes the Google Analytics cookies from your browser.

We don't sell your data. We share it only with the service providers that help us run Tipsly, each acting under their own privacy terms:

Stripe — payment processing.

Resend — delivery of verification and password-reset emails.

Google Analytics (Google LLC) — site usage analytics, if you have accepted statistics cookies.

Vercel and Neon — application hosting and database infrastructure.

Business listing information (name, description, contact details, address) is public by design — that is the point of a directory — and is shown to anyone browsing the site.

The app and its database run in the EU (Frankfurt, Germany).

Several of our providers are US companies — Google, Vercel, Stripe, Resend and Neon — and may process your data in, or access it from, the United States. These transfers are covered by the EU–US Data Privacy Framework where the provider is certified under it, and otherwise by the European Commission's standard contractual clauses.

Account and business listing data is kept while your account is active, and deleted on request or when an account is closed, except where we are legally required to keep it longer.

Payment records are kept for the period required by Swedish bookkeeping law (Bokföringslagen), currently seven years, regardless of account status.

Under GDPR you have the right to access the personal data we hold about you, request correction of inaccurate data, request deletion, restrict or object to processing, and request a copy of your data in a portable format.

To exercise any of these rights, contact support@nawton.net. You also have the right to lodge a complaint with Sweden's data protection authority, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

Tipsly is not directed at children. If you are below the age at which your country's law allows you to consent to data processing on your own, please do not use Tipsly without a parent or guardian's involvement.

We may update this policy as the service changes. Material changes will be reflected here with an updated date above.

Questions about this policy or your data: support@nawton.net.