# Privacy policy > What TKVR collects, why, who processes it and for how long, and your rights under the GDPR and the Irish Data Protection Act 2018. Web page: https://tkvr.me/privacy ## Who we are TKVR is run by David Ewins, a sole trader in Ireland. "We", "us" and "our" on this page mean him. You can reach us at [david@tkvr.me](mailto:david@tkvr.me). We are the controller for the personal data described here. This policy is written for the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018. ## The short version We collect what we need to run your account, your page and your payments. We do not sell your data. We do not show ads, and we have no analytics or ad trackers of our own. ## What we collect - Account: your email address, and the name, photo, links, country and time zone you choose to add. Supabase also logs sign-in events, including your IP address. - Pages you run: page name, handle, bio, photos, cover, category, links, tiers and prices, posts and their media, courses, call types and availability, livestreams, bring a friend settings, team members and the email addresses you invite. - Memberships and purchases: your tier, status, renewal dates, course enrolments and lesson progress, call bookings with their times, your time zone and any cancel reason. - Payments: amounts, currencies, platform fees and the Stripe references for each payment, customer and subscription. Stripe holds your card details. We never see your full card number. - Payouts: the Stripe account linked to your page and your total earnings. Stripe collects your identity and bank details directly. We do not receive them. - ID badge: if you choose to verify, Stripe Identity collects your ID document and, if you choose it, a selfie. We receive only the result, the method and any error code. We do not receive the images. - Activity: pages you follow, your streak (the days you read posts or saved notes), and the notes, voice memos and drawings you save in Scratchpad. - Referrals: who shared a bring a friend link, who joined with it, and any reward. - Messages, calls and livestreams: the chat messages you send, and the audio and video of calls and livestreams while they happen. We do not record calls or livestreams. - Technical: your IP address and basic browser details, which our hosting provider and Cloudflare Turnstile receive when you use the site. ## What creators see When you join a creator's page, the creator sees your name and photo if you added them, your email address, your tier and your payments with them, and can export their member list. Payments are made on the creator's own Stripe account. For this data the creator is a separate controller, and their own privacy terms apply to what they do with it. Your name and photo are shown to other members in chats you take part in. Creator pages are public. ## Connected social accounts Creators can connect social accounts to schedule and publish posts from TKVR, using our post scheduler at [post.tkvr.me](https://post.tkvr.me). It works with Instagram, Facebook Pages, Threads, TikTok, YouTube, X, LinkedIn, Bluesky and Mastodon. You choose which accounts to connect, and you can take our access away at any time. The scheduler runs on our own server. - What we receive: the access token the platform gives us, and your account name, ID and profile photo on that platform. For a Facebook Page or Instagram business account, also the Pages and accounts you choose to connect. - What we do with it: publish the posts you create, at the time you pick, to the accounts you choose, and show you the comments and stats for those posts. Nothing is posted unless you create or schedule it. - What we do not do: we do not sell this data, use it for advertising, share it with other users, or use it to train AI models. - How long we keep it: until you disconnect the account in Social, or remove TKVR in the network's settings for connected apps. Either way we stop posting there at once. Email us and we also delete its stored login from our scheduler within one month. Posts already published stay on the platform until you delete them there. TKVR's use and transfer of information received from Google APIs follows the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. If you connect YouTube, you also agree to the [YouTube Terms of Service](https://www.youtube.com/t/terms), and the [Google Privacy Policy](https://policies.google.com/privacy) applies. You can remove our access at any time in your [Google account permissions](https://myaccount.google.com/permissions). Our [Data deletion](https://tkvr.me/data-deletion) page explains how to remove connected accounts and everything else we hold. ## Why we use it, and our lawful basis - To provide your account, pages, memberships, courses, calls, chat, payments and payouts. Lawful basis: contract. - To keep TKVR secure, stop bots and spam at sign in, prevent fraud and abuse, and act on reports. Lawful basis: legitimate interests in a safe service. - To keep payment and tax records. Lawful basis: legal obligation. - To check your identity for the ID verified badge. Lawful basis: contract, and Stripe asks for your explicit consent before it uses your selfie to match your face. - To publish posts to the social accounts you connect. Lawful basis: contract. - To answer your emails. Lawful basis: legitimate interests, or contract if it is about your account. We do not use your data for advertising, and we do not make decisions about you by automated means that have legal or similar effects. ## Who processes it for us - Supabase: database, sign in and file storage. All of the data above except card and identity details. Our database is hosted in Frankfurt, Germany. Supabase also sends the sign-in codes we email you. - Stripe: payments, subscriptions, payouts to creators (Stripe Connect) and the ID badge checks (Stripe Identity). Your email, payment details, purchases and, for creators, identity and bank details. - Vercel: hosts the website and runs our server. Requests to the site, including your IP address. Our server runs in Frankfurt, Germany. - Cloudflare Turnstile: checks you are a person when you ask for a sign-in code. Your IP address and browser signals. - Stream: chat, video calls and livestreams. Your user ID, name, photo, messages, and call and livestream audio and video while they happen. - Cloudflare R2 and Mux: store, encode and stream post and course media when switched on. Media files and, for Mux, playback data from your browser only if you tap Accept on the cookie banner (lawful basis: consent). Each provider processes data only to provide its service to us. Stripe also processes some data as a controller under its own privacy policy, for example to meet its legal duties and prevent fraud. ## International transfers Several of these providers are US companies, so your data may be processed outside the European Economic Area. When it is, the transfer relies on safeguards: where the provider is certified under the EU-US Data Privacy Framework, or otherwise under Standard Contractual Clauses. ## How long we keep it - Account and page data: while your account is open. - When you delete your account, we delete your sign in, profile, photo, memberships, follows, enrolments, call bookings, referrals, streaks, notes and ID check records. - Payment records: kept after you delete your account, with the link to you removed, for the creator's books and for as long as tax law requires. - Messages you sent in chats are not removed automatically when you delete your account. Email us and we will remove them. - Connected social accounts: until you disconnect them, as above. - Stripe keeps its own records under its own retention rules. - A bring a friend code stays in your browser for 30 days. ## Your rights Under the GDPR you have the right to: - access the personal data we hold about you - have it corrected if it is wrong - have it erased - restrict how we use it - get it in a portable format - object to how we use it, including where we rely on legitimate interests - withdraw consent at any time, where we rely on consent - complain to the Data Protection Commission in Ireland ([dataprotection.ie](https://www.dataprotection.ie)), or to the authority where you live ## How to use your rights Email [david@tkvr.me](mailto:david@tkvr.me). We answer within one month. You can also change your name, photo and links on your account page, and delete your account there. Creators can export their member list as a CSV file from the studio. ## Children TKVR is not for children. You must be at least 16 to have an account and at least 18 to run a page. If you think a child has given us their data, email us and we will delete it. ## Security Data is sent over encrypted connections. Access to it is limited by rules in our database, so people only see what they are allowed to see. Members-only media is served through short-lived signed links. ## Cookies Our [Cookie notice](https://tkvr.me/cookies) lists what we store in your browser and why. ## Changes If we change this page, we post the new version here with a new date. If a change matters to you, we tell you by email or in the app before it takes effect. ## Contact David Ewins, sole trader, Ireland. [david@tkvr.me](mailto:david@tkvr.me) Last updated 24 October 2026