Privacy Policy

Last updated: 15 November 2026

1. Who we are

PassTally is a service that helps small businesses track prepaid session packages. It is run by its founder, a sole trader based in China (“PassTally”, “we”, “us”). You can reach us at [email protected].

For privacy questions, email [email protected]. Because we are not established in the UK, we are appointing a representative under Article 27 of the UK GDPR and will name them here. Until then, please contact us directly at the address above.

2. Our role: controller and processor

• Business accounts, the waitlist and our website. We decide how this data is used, so we are the controller.
• Information a business keeps about its own customers (for example names, phone numbers, pets, packages and visits). The business decides what to record and why, so the business is the controller and we are its processor. We only use this data to provide PassTally to that business, under the data processing terms in our Terms of Service. If you are a customer of a business that uses PassTally, please contact that business first about your data; we will help them respond.

3. What we collect

From businesses using PassTally

• Account details: email address, name, role (owner or staff), business name, business type, shop phone number, currency and language.
• Sign-in and security data: one-time sign-in codes (stored only as a hash), the IP address a sign-in was requested from, and the device or browser name of each signed-in session.
• Customer records you add: customer names, phone numbers, email addresses and notes, the packages you sell them, and each check-in and undo, including which staff member made it.
• Billing: your plan, subscription status, billing cycle and renewal date. Payments are taken by our payment provider Creem (see section 5). We never see or store your card details.
• Support: anything you tell us when you email us.

Nothing you import is saved until you confirm it. A spreadsheet is read on your phone or computer and is never uploaded. A photo of paper cards stays on your device if you type the cards in yourself. If automatic reading is used (Pro), the photo is sent to Cloudflare Workers AI, our hosting provider (see section 5), which reads the names and numbers and sends them back to your screen. The photo is processed only for that request: PassTally does not store it, and it is not used to train AI models. We keep only a usage record (when, how long it took and how many customers were found) for 90 days. Only the rows you confirm are saved to PassTally.

From people who join the waitlist

Email address, and optionally business name, business type, country, approximate number of customers and how you track packages today. We also record which link brought you to our site (for example a campaign tag) and your IP address to stop spam.

From customers of a business

When a customer opens their member card link, we show the information their business has recorded. We do not track customers across websites and we do not set cookies on the member card page. Our hosting provider processes standard connection data (such as IP address) to deliver and protect the page.

4. How and why we use it

We do not sell personal data, use it for advertising, or use your customers’ data for our own purposes. We do not make automated decisions that have legal or similar effects on you.

5. Who we share it with

We use these service providers (sub-processors):

If you download our app, Apple (App Store) or Google (Google Play) process data under their own terms. We may also disclose data if required by law, or if PassTally is transferred to a company we set up to run it, or sold, in which case this policy will continue to apply.

6. International transfers

We are based in China. PassTally is run from China, so personal data is accessed from China to operate and support the service, although it is stored in Western Europe. China does not have a UK or EU adequacy decision. We protect this access with the UK International Data Transfer Agreement and the EU standard contractual clauses (see the data processing terms), access data only when needed to run or support the service, and keep it encrypted in transit and at rest.

Some providers are based in, or may access data from, countries outside the UK and EEA, including the United States. Where this happens we rely on adequacy regulations (for example the UK Extension to the EU–US Data Privacy Framework) or on standard contractual clauses with the UK International Data Transfer Addendum. You can ask us for details.

7. How long we keep it

• Account and customer records: while your account is open. When you delete your account in the app, we delete it from our live database immediately. Backups are overwritten within 30 days.
• Sign-in codes and their IP addresses: 30 days.
• Signed-in sessions: until they expire (60 days of inactivity) or you sign out.
• Waitlist: until 12 months after we launch publicly, or until you ask us to remove you.
• Billing records: as long as the law requires (usually 6 years in the UK). Most of these are held by Creem.
• Support email: up to 2 years after the conversation ends.

8. Security

Data is encrypted in transit (HTTPS) and at rest. We use passwordless sign-in with short-lived codes, store codes and session tokens only as hashes, keep a permanent check-in history so balances cannot be changed silently, and limit staff access to what their role needs. If a personal data breach affects you, we will tell you and the regulator where the law requires.

9. Your rights

Depending on where you live, you can ask to access, correct, delete or receive a copy of your personal data, object to or restrict how we use it, and withdraw consent. Business owners can export their data as CSV and delete their account at any time in Settings. For anything else, email [email protected]. We reply within one month.

These rights apply under the UK GDPR, the EU GDPR, the Australian Privacy Act 1988 (and the Australian Privacy Principles) and Canada’s PIPEDA, among others.

Deleting your PassTally account

1. Open the PassTally app or web app and sign in.
2. Go to Settings → Delete account, type DELETE and confirm.
3. Owners: cancel any Pro subscription first (Settings → Plan → Manage billing, or your Creem receipt email). Deleting the owner account deletes the business and all its customers, packages and history. Staff: only your own login is deleted.

If you can’t sign in, email [email protected] from the address on the account and we will delete it within 30 days. Data is removed from our live database immediately and from backups within 30 days.

10. Cookies and local storage

We only use storage that is strictly necessary for the service to work, so we do not ask for cookie consent. We do not use advertising or analytics cookies.

The member card page and our website set no cookies of their own. If we ever add analytics or marketing tools that need consent, we will ask first and update this table.

11. Children

PassTally is a tool for businesses and is not meant for children. Businesses may record customers of any age (for example a child’s swimming lessons), and are responsible for doing so lawfully.

12. Changes

If we make important changes, we will tell business owners by email or in the app before they take effect. The date at the top shows the latest version.

13. Contact and complaints

Email [email protected] and we will reply within one month. If you are not happy with our answer, you can complain to your data protection regulator: the Information Commissioner’s Office in the UK (ico.org.uk), the Office of the Australian Information Commissioner (oaic.gov.au), the Office of the Privacy Commissioner of Canada (priv.gc.ca), or your local authority in the EU.