Privacy Policy

Personal information you give us

In short: We collect the personal information you type into our forms.

We collect personal information that you voluntarily provide when you join our waitlist, contact us, or otherwise express an interest in tintlo. Depending on the form, this may include:

• your name (contact form)
• your email address (both forms)
• your role, for example student or developer (waitlist)
• your organisation name, if you choose to give it (contact form)
• the content of your message (contact form)

Sensitive information. We do not ask for or process sensitive information. Please don’t include any in your messages.

All personal information that you provide to us must be true, complete, and accurate, and you should let us know if it changes.

Information collected automatically

In short: When you submit a form, we record a few technical details about the visit.

When you submit one of our forms, we store the following alongside your entry:

• Log and usage data: the page you submitted it from, the page that referred you to our site, and the date and time.
• Device data: your browser’s user agent, which shows your browser and operating system (for example, “Chrome on macOS”).
• Location data: your country, as detected by Cloudflare from your connection. We do not collect precise or GPS location.

We do not store your IP address. Our hosting provider, Cloudflare, processes IP addresses briefly to deliver the website and protect it from bots and attacks. This information does not reveal your identity on its own, and we use it to run and secure the website and to understand where sign-ups come from.

Cookies

We do not use advertising, analytics or social media cookies, and we do not use tracking pixels. Cloudflare may use strictly necessary cookies or similar technologies to tell people apart from bots (for example, through its Turnstile check on our forms). These are needed for the website to work securely and do not track you across other sites.

In short: We use your information to run the waitlist, reply to you, send you updates you asked for, and keep the website secure. We may also use it for other purposes only with your prior explicit consent.

We process your personal information for these reasons:

• To manage our waitlist. We use your email address and role to keep your place on the waitlist and let you know when tintlo is available to download. (Retention: until launch, plus 12 months, or until you ask us to remove you.)
• To respond to your messages. We use your name, email, organisation (if given) and message to reply to you. (Retention: 24 months from our last contact with you.)
• To send administrative emails. We send a confirmation email when you join the waitlist or contact us, and may tell you about changes to our terms and policies. (Retention: the same as the related sign-up or message.)
• To send you launch news and updates. If you joined the waitlist, we may email you about tintlo’s launch, early access and related offers. You can unsubscribe at any time. (Retention: until you unsubscribe, or 12 months after tintlo launches, whichever comes first.)
• To request feedback. We may ask waitlist members what they think, or invite them to test tintlo. (Retention: until launch, plus 12 months, or until you unsubscribe.)
• To keep our website secure. We use limited technical data and Cloudflare’s bot protection to prevent spam, fraud and abuse. (Retention: only as long as needed for security, and no longer than 12 months.)
• To save or protect an individual’s vital interest, such as to prevent harm.

In short: We only process your personal information when we have a valid legal reason to do so, such as your consent, to provide what you asked for, to comply with laws, or for our legitimate interests.

If you are located in the EU or UK

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the legal bases we rely on. We rely on:

• Consent. When you join the waitlist, you ask us to email you about tintlo. You can withdraw your consent at any time. Learn more about withdrawing your consent.
• Performance of a contract. To do what you asked us to do, such as keep your place on the waitlist or reply to your message.
• Legitimate interests. Where it is reasonably necessary for our legitimate interests and those interests do not outweigh your rights and freedoms, in order to:
  • diagnose problems and prevent fraud, spam and abuse
  • understand feedback from our users so we can improve tintlo
• Legal obligations. Where necessary to comply with the law, such as to cooperate with a law enforcement body or regulator, or to exercise or defend our legal rights.
• Vital interests. Where necessary to protect your vital interests or those of a third party, such as when someone’s safety is at risk.

If you are located in Canada

We may process your information if you have given us specific permission (express consent), or in situations where your permission can be inferred (implied consent). You can withdraw your consent at any time.

In some exceptional cases, applicable law may allow us to process your information without your consent, for example:

• if collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
• for investigations and fraud detection and prevention
• for business transactions, provided certain conditions are met
• if it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
• for identifying injured, ill, or deceased persons and communicating with next of kin
• if we have reasonable grounds to believe an individual has been, is, or may be a victim of financial abuse
• if it is reasonable to expect that collection and use with consent would compromise the availability or accuracy of the information, and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
• if disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
• if it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced
• if the collection is solely for journalistic, artistic, or literary purposes
• if the information is publicly available and is specified by the regulations
• to disclose de-identified information for approved research or statistics projects, subject to ethics oversight and confidentiality commitments

In short: We only share information with the service providers that run our website and send our emails. We do not sell your personal information.

Service providers. We share your data with third-party service providers who perform services for us and need access to it to do that work. We have contracts (data processing agreements) in place with them, which are designed to safeguard your personal information. They may only use it as we instruct, may not share it with anyone else, and must protect it and keep it only for the period we instruct. They are:

We may also need to share your personal information in the following situation:

• Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or part of our business, including when we register tintlo as a company.

In short: We may transfer, store, and process your information in countries other than your own.

Our service providers’ servers are located in the United States and other countries, and we access your information from Bangladesh and the other countries where our founders are located. Regardless of your location, your information may be transferred to, stored by, and processed by us and by the service providers listed in section 4.

If you are a resident of the European Economic Area (EEA), United Kingdom (UK), or Switzerland, these countries may not have data protection laws as comprehensive as those in your country. However, we will take all necessary measures to protect your personal information in accordance with this Privacy Policy and applicable law.

European Commission’s Standard Contractual Clauses. Our service providers’ data processing agreements include the European Commission’s Standard Contractual Clauses for transfers of personal information from the EEA or UK. These clauses require the recipient to protect that personal information in line with European data protection law. Further details can be provided on request.

In short: We keep your information only as long as we need it for the purposes in this policy, unless the law requires otherwise.

• Waitlist sign-ups: until tintlo launches, plus 12 months, or until you ask us to remove you.
• Contact messages: 24 months from our last contact with you.
• Marketing emails: until you unsubscribe, or 12 months after launch, whichever comes first.
• Security data: only as long as needed for security, and no longer than 12 months.

When we no longer need your personal information, we will delete or anonymize it. If that is not possible (for example, because it is stored in backups), we will store it securely and isolate it from any further processing until it can be deleted.

In short: We protect your information with organizational and technical security measures.

All traffic to our website is encrypted (HTTPS), our forms are protected against bots, and the stored entries can only be seen by the founders through a password-protected admin area that signs out automatically.

However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise that hackers, cybercriminals, or other unauthorized third parties will never be able to defeat our security. Although we will do our best to protect your personal information, transmission of personal information to and from our website is at your own risk.

In short: We do not knowingly collect data from or market to children under 18 years of age, or the equivalent age as specified by law in your jurisdiction.

We do not knowingly collect, solicit data from, or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction, nor do we knowingly sell such personal information. By using our website, you represent that you are at least 18 or the equivalent age in your jurisdiction, or that you are the parent or guardian of a minor and consent to that minor’s use of the website. If we learn that we have collected personal information from someone under 18 without that consent, we will promptly delete it. If you become aware of any such data, please contact us at hello@tintlo.app.

In short: Depending on where you live, including in some US states, the EEA, the UK, Switzerland and Canada, you have rights that give you more access to and control over your personal information.

In some regions (like the EEA, UK, Switzerland, and Canada), you have the right (i) to request access to and a copy of your personal information, (ii) to request correction or erasure, (iii) to restrict the processing of your personal information, (iv) if applicable, to data portability, and (v) not to be subject to automated decision-making. If a decision that produces legal or similarly significant effects is ever made solely by automated means, we will inform you, explain the main factors, and offer a simple way to request human review. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make a request using the contact details in section 15. We will consider and act on any request in accordance with applicable data protection laws.

If you are located in the UK

If you are unhappy with how we have handled your personal information, you can complain directly to us. This is in addition to your rights under the UK General Data Protection Regulation and the Data Protection Act 2018.

• Online: tintlo.app/contact
• Email: hello@tintlo.app

After you complain:

• we will acknowledge your complaint within 30 days of receiving it
• we will investigate without unjustifiable or excessive delay
• we will keep you informed of progress and explain the outcome

If you are not happy with our final response, you can refer your complaint to the Information Commissioner’s Office (ICO), the UK supervisory authority:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

If you are located in the EEA or Switzerland

If you believe we are unlawfully processing your personal information, you have the right to complain to your national data protection authority. In Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawing your consent

If we rely on your consent to process your personal information (which may be express or implied, depending on the applicable law), you can withdraw it at any time by contacting us using the details in section 15. This will not affect the lawfulness of processing before you withdrew it, nor, where the law allows, processing based on legal grounds other than consent.

Opting out of marketing emails

You can unsubscribe from our marketing and promotional emails at any time by clicking the unsubscribe link in any of them, or by emailing us at hello@tintlo.app and asking to be removed. We will then take you off our marketing list. We may still send you non-marketing messages, for example to reply to a request you made.

If you have questions or comments about your privacy rights, email us at hello@tintlo.app.

Most web browsers and some operating systems include a Do-Not-Track (“DNT”) setting that signals you don’t want your online browsing activities monitored. No uniform standard for recognizing and implementing DNT signals has been finalized, so we do not currently respond to them. In any case, our website does not track you across other sites. If a standard is adopted that we must follow, we will explain our practice in a revised version of this Privacy Policy.

California law requires us to tell you how we respond to DNT signals. Because there is no industry or legal standard for recognizing or honoring them, we do not respond to them at this time.

In short: If you live in California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to access, correct, get a copy of, or delete the personal information we hold about you, and to withdraw your consent. These rights may be limited in some circumstances by law.

Categories of personal information we collect

The table below shows the categories of personal information we have collected in the past twelve (12) months. The examples are illustrative; for exactly what we collect, see section 1.

We may also collect other personal information when you contact us for support or take part in a survey, to deliver our services and respond to your inquiries.

We keep the categories we collect as follows:

• Category A: Waitlist sign-ups: until launch plus 12 months. Contact messages: 24 months.
• Category B: Waitlist sign-ups: until launch plus 12 months. Contact messages: 24 months.
• Category F: Waitlist sign-ups: until launch plus 12 months. Contact messages: 24 months.
• Category G: Waitlist sign-ups: until launch plus 12 months. Contact messages: 24 months.
• Category I: Waitlist sign-ups: until launch plus 12 months. Contact messages: 24 months.

Sources of personal information

We collect personal information directly from you, and automatically when you submit our forms. See section 1.

How we use and share personal information

See section 2 for how we use your personal information, and section 4 for the service providers we disclose it to under written contracts.

We may use your personal information for our own business purposes, such as internal research to develop and improve tintlo. This is not “selling” your personal information.

We have not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We have disclosed the following categories of personal information to our service providers for a business purpose in that time:

• Category A. Identifiers
• Category B. Personal information as defined in the California Customer Records law
• Category F. Internet or other similar network activity
• Category G. Geolocation data
• Category I. Professional or employment-related information

Your rights

You have rights under certain US state data protection laws. These rights are not absolute, and in certain cases we may decline your request as permitted by law. They include the right to:

• know whether or not we are processing your personal data
• access your personal data
• correct inaccuracies in your personal data
• request the deletion of your personal data
• obtain a copy of the personal data you previously shared with us
• not be discriminated against for exercising your rights
• opt out of the processing of your personal data for targeted advertising (or “sharing” as defined under California law), the sale of personal data, or profiling that produces legal or similarly significant effects. We do none of these.

Depending on the state where you live, you may also have the right to:

• access the categories of personal data being processed (for example, in Minnesota)
• obtain a list of the categories of third parties we have disclosed personal data to (for example, in California, Delaware, and Maryland)
• obtain a list of the specific third parties we have disclosed personal data to (for example, in Minnesota and Oregon)
• obtain a list of third parties we have sold personal data to (for example, in Connecticut)
• review, understand, question, and correct how personal data has been profiled (for example, in Connecticut and Minnesota)
• limit the use and disclosure of sensitive personal data (for example, in California)
• opt out of the collection of sensitive data and data collected through voice or facial recognition (for example, in Florida)

How to exercise your rights

To exercise these rights, email us at hello@tintlo.app, use our contact form, or use the contact details at the end of this policy.

Under certain US state laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an agent who does not submit proof that they have been validly authorized to act for you.

Request verification

When we receive your request, we will need to verify that you are the person the information is about, usually by confirming your email address. We will only use the personal information in your request to verify your identity or authority to make it. If we cannot verify you from the information we already have, we may ask for more information for verification and security purposes. If you submit a request through an authorized agent, we may need to verify your identity, and the agent will need written, signed permission from you.

Appeals

Under certain US state laws, if we decline to take action on your request, you may appeal our decision by emailing us at hello@tintlo.app. We will tell you in writing what action we took or did not take in response, with a written explanation of the reasons. If your appeal is denied, you may submit a complaint to your state attorney general.

California “Shine The Light” law

California Civil Code Section 1798.83 lets California residents request, once a year and free of charge, information about the categories of personal information (if any) we disclosed to third parties for direct marketing purposes, and the names and addresses of those third parties, in the preceding calendar year. We do not disclose personal information to third parties for their direct marketing. To make a request, write to us using the details in section 15.

This Privacy Policy covers the tintlo.app website only. The tintlo desktop app is not yet available. Before it launches, we will update this policy to explain how the app handles your information.

tintlo is run by its three founders, Md Mujtoba Siraj, Radeen Rahman and Nafis Hossain (“we”, “us” or “our”), and is not yet a registered company. When it is registered, we will update this policy with the company’s details. For any privacy question or request, email hello@tintlo.app.

In short: Yes, we will update this policy as needed to stay accurate and compliant with relevant laws.

We may update this Privacy Policy from time to time. The updated version will show a new “Last updated” date at the top. If we make material changes, we may notify you by posting a notice on the website or by emailing you. We encourage you to review this policy from time to time.

If you have questions or comments about this policy, email us at hello@tintlo.app or use our contact form. We do not currently have a postal address.

You have the right to request access to the personal information we collect from you, details about how we have processed it, to correct inaccuracies, or to delete it. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by law. To make a request, email us at hello@tintlo.app or use our contact form.