Privacy
Policy.

Last updated: November 2026

01

Introduction

Tooltip Tour is a product of Lovely Something Ltd ("we", "us", "our"). This Privacy Policy explains how we collect, use, and protect information about you when you use Tooltip Tour at app.lovelysomething.com. By creating an account or using the service, you agree to the practices described here. If you have any questions, contact us at hello@lovelysomething.com.

02

Information We Collect

Account information: When you sign up we collect your name and email address. If you sign in via Google, Apple, or Microsoft, we receive your name and email from that provider. Usage data: We record activity within the dashboard — tours created, steps written, sites added, and anonymous view counts from your end users. This data is used to provide your analytics and improve the product. Payment information: Billing is handled entirely by Stripe. We never see or store your card details. We do store your Stripe customer ID and subscription status to manage your plan. Technical data: We log IP addresses and basic request metadata for security monitoring and abuse prevention. This data is not used for advertising. Website analytics: If you allow analytics cookies, Google Analytics 4 collects information about how you use our website — pages viewed, links clicked, approximate location, device and browser type. See Cookies & Tracking below.

03

How We Use Your Information

We use the information we collect to: • Provide, operate, and maintain the Tooltip Tour service • Send transactional emails — sign-in links, billing receipts, and security alerts • Respond to support requests you send us • Monitor the service for abuse, fraud, and security threats • Understand how the product is used so we can improve it • Comply with legal obligations We do not sell your data or build advertising profiles of you. If you allow marketing cookies, we may use advertising tools (such as Meta Pixel) to measure and target our own ads — see Cookies & Tracking.

04

Data Storage & Security

Your data is stored in Supabase, hosted in the EU (Ireland). Data is encrypted at rest and in transit using TLS. Access to production data is restricted to authorised personnel only. We take reasonable technical and organisational measures to protect your information. No method of storage or transmission is 100% secure — if you believe your account has been compromised, contact us immediately at hello@lovelysomething.com.

05

Cookies & Tracking

When you first visit our website we ask which cookies you're happy with. Nothing non-essential loads until you say yes, and you can change your mind any time from "Cookie settings" in the footer (or Account → Preferences in the dashboard). Strictly necessary — always on. Session cookies that keep you signed in to the dashboard, and a small entry in your browser's local storage that remembers your cookie choice. Analytics — off unless you allow it. Google Analytics 4 (Google LLC) sets cookies named _ga and _ga_<id> to measure how our website is used. Google may process this data outside your country, including in the United States. If you withdraw consent, we stop loading Google Analytics and delete its cookies. Marketing — off unless you allow it. We may in future use advertising pixels, such as Meta Pixel (Meta Platforms Ireland Ltd), to measure and target our own ads. None are in use today; if we add one, it will only load for visitors who have allowed marketing cookies, and we will list it here. The Tooltip Tour embed script that runs on our customers' websites is separate: it sets no cookies, does not fingerprint visitors, does not load Google Analytics or any advertising technology, and only records anonymous tour events for our customers' analytics.

06

Third-Party Services

We use the following sub-processors to deliver the service: • Supabase — authentication and database (supabase.com/privacy) • Stripe — payment processing (stripe.com/privacy) • Resend — transactional email delivery (resend.com/legal/privacy-policy) • Vercel — hosting and edge delivery (vercel.com/legal/privacy-policy) • Google — website analytics, only with your consent (policies.google.com/privacy) Each of these providers has their own privacy policy and data processing practices. We have Data Processing Agreements in place where required.

07

Data Sharing

We do not sell, rent, or trade your personal data. We share data only with the sub-processors listed above, and only to the extent necessary to provide the service. We may disclose information if required to do so by law, court order, or to protect the rights, property, or safety of Lovely Something, our users, or others.

08

Data Retention

We retain your account data for as long as your account is active. If you close your account, we will delete your personal data within 30 days of receiving your request, except where we are required to retain it for legal, tax, or accounting purposes. Anonymous aggregate data (such as view counts across the platform) may be retained indefinitely as it cannot be used to identify you.

09

Your Rights

Under UK GDPR and EU GDPR you have the right to: • Access the personal data we hold about you • Correct inaccurate or incomplete data • Request deletion of your account and associated data • Receive a copy of your data in a portable format • Object to or restrict certain processing activities To exercise any of these rights, email hello@lovelysomething.com. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority (in the UK, the ICO at ico.org.uk).

10

Changes & Contact

We may update this policy from time to time. For material changes we will notify you by email before they take effect. The "last updated" date at the top of this page always reflects the current version. If you have any questions or concerns about this policy or how we handle your data, please contact us: Lovely Something Ltd hello@lovelysomething.com app.lovelysomething.com