Privacy Policy

Last updated: 21 August 2026

This policy explains what personal data TillyPay collects, why, and what your rights are. TillyPay is a service that lets tradespeople send customers a professional invoice with a tap-to-pay link.

1. Who we are

TillyPay is operated by TillyCall Ltd ("we", "us", "our"), a company registered in England & Wales (company number 17402622), registered office 66 Paul Street, London EC2A 4NA. We are the "data controller" for the personal data described in this policy, except where we act as a "processor" on behalf of our business customers (see section 6).

For any privacy question or request, contact us at info@tillycall.com.

2. The data we collect

a) Account & business data (for tradespeople who sign up)

• Your name and business name, email address, phone number, and business details you enter (trade, address, VAT status, terms).
• Your password, which we store only as a secure one-way hash — we never see or store it in plain text.
• Billing information: we use Stripe to take your subscription payment. We do not see or store your card details; we hold a Stripe customer reference and your plan status.

b) Invoice & customer data (entered by tradespeople)

• The job details and amounts you send us (for example "fixed kitchen leak, £120 labour, £30 materials").
• Your customer's details that you provide so we can send them the invoice: their name, phone number, email address and job address, as applicable.

c) Payment data (when a customer pays an invoice)

• Payments are processed by Stripe. Card and wallet details (Apple Pay / Google Pay) are entered directly into Stripe's secure checkout — they never pass through or get stored by us. We keep a record that an invoice was paid, the amount, and a Stripe payment reference.

d) Technical data

• Basic technical information such as your IP address, browser type, and server logs, and a strictly-necessary session cookie to keep you logged in (see section 9).

3. How we use your data and our lawful basis

What we do	Lawful basis (UK GDPR)
Create and run your account; build and deliver invoices and pay links	Performance of our contract with you
Take your subscription payment	Performance of our contract with you
Keep the service secure, prevent fraud and abuse, and improve it	Our legitimate interests
Send you service messages (e.g. a "paid" notification, important account notices)	Performance of our contract / legitimate interests
Meet our legal and accounting obligations	Legal obligation

We do not sell your personal data, and we do not use it for third-party advertising.

4. Payments

Subscription payments and your customers' invoice payments are handled by Stripe Payments Europe / Stripe, Inc. When you connect your own Stripe account, customer payments are made directly to your Stripe account and settle to your bank — TillyPay never holds your money or your customers' money. Stripe processes payment data as a controller in its own right under Stripe's Privacy Policy.

5. Who we share data with (our sub-processors)

We use a small number of trusted providers to run the service. They only process data on our instructions and to provide their part of the service:

Provider	Purpose
Stripe	Subscription billing and customer payments
Twilio	Sending invoice/pay-link messages by SMS or WhatsApp
Railway	Secure cloud hosting of the application and database
Resend	Sending invoice emails (where email delivery is used)
Anthropic / OpenAI	Turning a plain-language job note into a structured invoice (only when AI parsing is enabled; the job note text you send may be processed for this purpose and is not used to train their models under their business terms)

We may also share data where required by law, or in connection with a business sale or reorganisation.

6. Your customers' data — who is responsible

7. International transfers

Some of our providers (including Stripe, Twilio, Anthropic and OpenAI) may process data outside the UK, including in the United States. Where they do, the transfer is protected by appropriate safeguards such as the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

8. How long we keep it

We keep account and invoice data for as long as your account is active and for a reasonable period afterwards to meet legal, tax and accounting obligations (generally up to 6 years for financial records). We delete or anonymise data when it is no longer needed. You can ask us to close your account and delete your data at any time (subject to those legal retention requirements).

9. Cookies

TillyPay uses only strictly-necessary cookies — a secure session cookie to keep you logged in, and (across the Tilly family of products) a single sign-on cookie. We do not use advertising or third-party tracking cookies. Because these cookies are essential to the service, they do not require consent, but we tell you about them here for transparency.

10. Security

We protect your data with encryption in transit (HTTPS), securely hashed passwords, and access controls. Card payments are handled entirely within Stripe's PCI-compliant systems. No online service can be guaranteed 100% secure, but we take reasonable steps to protect your information.

11. Your rights

Under UK data protection law you have the right to access, correct, delete, restrict or object to our use of your personal data, and to data portability. To exercise any of these, email info@tillycall.com. You also have the right to complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk, though we'd appreciate the chance to put things right first.

12. Changes to this policy

We may update this policy from time to time. We'll change the "last updated" date above and, for significant changes, let you know by email or in the app.

13. Contact us

TillyCall Ltd, 66 Paul Street, London EC2A 4NA · info@tillycall.com