tiltless.club is the controller of personal information processed through tiltless.club. Contact privacy@tiltless.club or write to Tiltless Club, Nottingham, United Kingdom.
1. Information collected
We process account data (email, password hash, verification, country if supplied and security state); Stripe checkout/customer data returned to us, including email and phone number; funnel and attribution data (visit UUID, squeeze variant, referrer, referral code/alias, UTM fields and events); training activity and progress; appointment details (name, email, time zone, selected time, question, status and secure management link); orders, refunds, entitlements and Stripe identifiers; affiliate relationships, clicks, commissions, ledger entries, payout instructions and withdrawals; communications and consent choices; and security data such as privacy-protected IP/user-agent hashes, login events and audit records.
2. Sources
Information comes from you, your browser, an affiliate link you intentionally follow, Stripe payment events, Google Calendar when an authenticated staff member expressly connects an account, and service providers that operate infrastructure or communications for us. We do not receive or store full payment-card numbers from Stripe Checkout.
3. Why we use information
We use data to create and secure accounts; provide free and paid training; administer the six-week coaching programme and requested appointments; confirm purchases, refunds and access; attribute referrals; calculate and pay eligible affiliate commissions; prevent fraud and abuse; respond to support; maintain audit/accounting records; comply with law; and, where permitted, send optional marketing communications.
4. Legal bases and choices
Depending on jurisdiction, processing may rely on contract, legitimate interests, legal obligations or consent. Optional marketing and optional media/cookie choices are separate from processing necessary to supply the Service. You may withdraw consent where consent is the basis, without affecting earlier lawful processing.
5. Stripe and payment data
Stripe hosts Checkout and processes payment details under its own privacy terms. We require Stripe Checkout to collect an email address and phone number for these purchases. Our application stores relevant Stripe identifiers, the checkout email/phone returned to us, amount, product, price type, payment/refund/dispute state and other records needed to administer the transaction and coaching relationship.
6. Google Calendar data
Only an authenticated Tiltless administrator initiates Google authorization for a staff account. Tiltless reads that account’s calendar list so the staff member can select calendars; requests free/busy intervals from selected calendars to calculate live availability; and creates, updates or deletes private Tiltless appointment events and Google Meet links only in a destination calendar owned by the connected account. Conflict-event titles, descriptions and attendee details are not requested or shown to customers.
We store the connected account email, approved scope list, selected calendar identifiers and names, event/calendar identifiers, Meet URL, synchronization status and an encrypted OAuth refresh token. Free/busy results are used to answer the availability request and are not retained as an event-content archive. Disconnecting Google in Tiltless deletes the stored refresh token, connected-account identity and calendar selections; the staff member can also revoke access in their Google Account. Appointment records may remain where required to administer the booking, resolve disputes or meet legal obligations.
Tiltless Club’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Google user data is not used for advertising, sold, or used to train general-purpose AI models.
7. reCAPTCHA
When the operator enables Google reCAPTCHA v3, Google receives technical and interaction information needed to return an automated-abuse risk score for protected lead, booking, login and password-reset submissions. Tiltless validates the token, action, hostname and configured score threshold and does not use the score for advertising.
8. Affiliate attribution
If you follow an affiliate link, we may store the referring affiliate identifier for the configured attribution window. When you create an account, the sponsor relationship is normally locked so later browsing does not silently replace it. Affiliates see privacy-reduced downstream information; administrators may access additional records where necessary for legitimate programme administration and fraud review.
9. Sharing
We may share data with processors and professional advisers where needed to operate the Service, including payment, calendar/meeting, hosting, email, analytics/security and professional-service providers. We may disclose data where required by law or to protect rights and security. We do not sell personal information or full payment-card data.
10. Retention
Account, appointment, order, refund, affiliate, tax, fraud and audit records are retained for periods appropriate to service, legal, accounting, dispute and security needs. Shorter-lived OAuth state, free/busy responses, attribution and session data expire sooner. We review retention periods against applicable legal and operational requirements.
11. International transfers
Providers may process information in other countries. Where required by applicable law, we use appropriate transfer mechanisms and provide information about relevant safeguards.
12. Security
We use password hashing, CSRF protection, constrained sessions, server-side Stripe verification, encrypted OAuth tokens and payout details, private-path web-server rules and administrative audit records. No system is perfectly secure; report suspected compromise promptly.
13. Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict, object, port or complain about processing. Rights can be limited by legal retention, fraud-prevention and accounting duties. A staff member can disconnect Google in Tiltless or revoke Tiltless in Google Account security settings. Contact privacy@tiltless.club.
14. Children
The Service is intended for adults and is not knowingly directed to children.
15. Changes
We may update this policy as the Service or legal requirements change. Material changes will be notified where required.