Privacy Policy

Last updated: 20 October 2026

This policy explains what personal information Tiempo collects about the people who use our website and dashboard, what we do with it, and your rights. Tiempo is run by Double-Tap Development Ltd, a company registered in Scotland with number SC635454, at 17 Gatehead Drive, Bishopton, PA7 5QQ, Scotland. We’re the controller of the information this policy describes. Contact us about it at info@doubletapdevelopment.com.

1. Two kinds of information

About our customers’ teams. When you sign up, join a team or use the dashboard, we decide how your information is used. This policy covers that.

Sent to us by platforms. Booking platforms send Tiempo information about their businesses and those businesses’ staff and customers: names of staff and rooms, bookings, attendees and whatever else they choose to include. For that information we’re a processor acting on the platform’s instructions, under our Data Processing Addendum. If you booked with a business that uses a platform built on Tiempo, the business or the platform decides how your information is used: ask them first. We’ll help them answer you.

2. What we collect

Your account: your name and email address, the platforms you belong to and your role in each. Sign-in is handled by Firebase Authentication, a Google service, which holds your password; we never see it. If you sign in with Google or GitHub, they tell us your name and email address.
Team invitations: the email address someone invited, the role, who invited them and when.
Using the dashboard: your sign-in sessions and when they were last used, and the API keys your team creates, with their names and when each was last used.
Billing: when you go live you enter your card on a page run by Stripe. Stripe keeps the card details, your billing address and any tax ID; we keep the card’s brand, last four digits and expiry date, and the billing name and country. We keep the invoices we send.
Security: the IP address and email address of failed sign-ins, and the IP address of each sign-up, so we can limit attempts.
Logs: our hosting provider records each request to our servers, including the IP address, the browser or client, the address requested and the time.
Messages: what you send us when you email us.

We don’t use analytics, advertising or tracking tools on our website or dashboard, and we don’t sell personal information.

3. Why we use it, and our lawful basis

To provide the Service (signing you in, running your platform, your team, support): necessary for our contract with you or your employer, and our legitimate interest in running the Service for the businesses that use it.
To bill (charging cards, invoices, tax): necessary for that contract, and our legal obligation to keep accounting records.
To keep the Service secure (rate limits, logs, investigating abuse): our legitimate interest in protecting the Service and our customers.
To tell you about the Service (changes to the API, these policies or your account): our legitimate interest, or our contract with you. We don’t send marketing emails.
To comply with the law and to establish or defend legal claims.

4. Cookies and storage in your browser

We only store what the website and dashboard need to work:

__session, a cookie that keeps you signed in to the dashboard. It’s sent only to the dashboard, can’t be read by scripts, and lasts 14 days unless you sign out.
In your browser’s local storage: which platform you last opened, whether the dashboard shows test or live data, and the language you chose for code examples in the docs.
In session storage, cleared when you close the tab: what you entered in the dashboard’s test harness, and a note that stops a page reloading itself twice after we release a new version.

These are strictly necessary for the things you ask for, so we don’t ask for consent to them. The website’s fonts come from Google Fonts, so your browser connects to Google, which receives your IP address.

6. Where it’s stored

Tiempo’s servers and database run in Google Cloud’s Belgium region (europe-west1). Firebase Authentication and Stripe may process information in the United States and other countries. Where information leaves the UK, we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework where the provider is certified) or on the provider’s standard contractual clauses with the UK’s International Data Transfer Addendum.

7. How long we keep it

Your account and team information: while your account is open, then as section 11 of our terms describes.
Billing records and invoices: six years after the end of the financial year they relate to.
Records of sign-in and sign-up attempts: about a day.
Server logs: about 30 days.
Database backups: seven days, after which older copies are overwritten.
Emails with us: as long as they’re useful to deal with what they’re about, and no more than six years.

8. Your rights

You have the right to ask for a copy of your personal information, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable form. Some of these depend on the circumstances. Email info@doubletapdevelopment.com and we’ll answer within a month. If you joined a platform’s team, that platform can also remove you from it.

If you’re unhappy with how we’ve handled your information, please tell us. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

9. Security

Everything travels over HTTPS. Our database is encrypted at rest by Google and only accepts encrypted connections. API keys, sign-in sessions and invitation links are stored only as one-way hashes. Our Data Processing Addendum describes the rest.

10. Children

Tiempo is a service for businesses and isn’t meant for anyone under 18.

11. Changes to this policy

We’ll update this page when what we do changes, and change the date at the top. If a change matters, we’ll also email your platform’s owners.