Privacy Policy

⚠ Placeholder wording. This is scaffolding for you to finalise with legal advice before charging customers.

Last updated 19 August 2026

This Privacy Notice for Liam Kelman ("we", "us", or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://tuesdayclub.app, or any website of ours that links to this Privacy Notice
• Use Tuesday Club — a marketing tool for restaurants that generates flyers and social posts, and scores how well their website, Instagram, and Google presence drives direct online ordering
• Engage with us in other related ways, including support enquiries

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at hello@tuesdayclub.app.

1. What information do we collect?

Personal information you disclose to us

In short: we collect personal information that you provide to us.

We collect personal information that you voluntarily provide when you register on the Services, express an interest in our products, or otherwise contact us. This may include:

• Email addresses
• Passwords
• Contact or authentication data
• Mailing addresses — your restaurant's business address

Sensitive information. We do not process sensitive information (for example racial or ethnic origin, health data, or religious beliefs).

Payment data. If you subscribe, payment is handled entirely by our payment processor, Stripe — your card number and security code never reach our own servers. You can review Stripe's privacy notice at https://stripe.com/privacy.

Social login data. You may register or sign in using your Google account. If you do, we receive basic profile information (your name and email address) from Google, as described under How do we handle social logins? below. We do not support signing in with any other social platform.

All personal information you provide to us must be true, complete and accurate, and you must notify us of any changes.

Information automatically collected

In short: some information — such as your IP address — is collected automatically for security and to understand how the Services are used.

We automatically collect certain technical information when you use the Services, primarily to maintain security and for our own internal usage reporting. This includes:

• Log and usage data — your IP address, used for rate limiting and abuse prevention, and basic usage events (signups, checkout starts, plan changes) used internally to understand product conversion. We do not use any third-party analytics service (e.g. Google Analytics) — this data stays with us.

Google API Services

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This covers Google Maps/Places (restaurant search), Google Sign-In, and — if you choose to connect it — your Google Business Profile.

Information collected from other sources

In short: we collect limited public business data — never for advertising — from Google, Apify and Companies House.

To power the presence scan and review features, we look up public information about your restaurant (not you personally) from these sources:

• Google Places/Maps — public business listing data (address, phone, ratings) when you search for and select your own listing
• Apify — scrapes public review and listing data (Google reviews, Instagram) to power the audit/scoring features
• Companies House — public UK company registry lookups
• Google Business Profile API — if you explicitly connect your own account, we read your profile and review data directly from Google

None of this is used for advertising, marketing partnerships, or shared with data brokers — it exists solely to power the audit and scoring features of the Services.

2. How do we process your information?

In short: we process your information to provide, improve and administer the Services, communicate with you, for security, and to comply with law.

• Facilitate account creation and authentication, and manage your account.
• Deliver the Services — generate your flyers, carousels, and review scores.
• Respond to enquiries and provide support.
• Send administrative information — account and billing notices.
• Manage your subscription, payments, and cancellations.
• Request feedback via our built-in feedback tool.
• Protect the Services, including fraud and abuse prevention.
• Identify usage trends to improve the product.
• Follow up on free scan and multi-restaurant enquiries — contact details submitted through the free presence scan, or an enquiry about running more than one restaurant, even for people who never create an account.

3. What legal bases do we rely on?

In short: we only process your information when we have a valid legal reason to do so.

Under the GDPR and UK GDPR, the legal bases we rely on are:

• Consent — where you've given us permission for a specific purpose. You can withdraw this at any time by contacting us.
• Performance of a contract — processing necessary to deliver the Services you signed up and pay for.
• Legitimate interests — to identify usage trends and improve the product, to protect the Services (fraud/abuse prevention), to request feedback, and to follow up on free scan and multi-restaurant enquiries.
• Legal obligations — where necessary to comply with the law.
• Vital interests — in rare cases involving a threat to someone's safety.

4. When and with whom do we share your information?

In short: only with the service providers that make the product work — never sold, never shared for advertising.

• Supabase — account storage and authentication
• Fly.io — hosting, where the app and your data live
• Stripe — payment processing
• Anthropic — AI generation of copy and scoring
• Google — Maps/Places, Sign-In, and Business Profile if you connect it
• Apify — public review and listing data collection
• Companies House — public company registry lookups
• Resend — delivers our transactional emails (signup confirmation, password reset, notifications)

We may also share information if the business is sold or transferred (a merger, acquisition, or sale of assets) — the same protections in this notice would apply to the new owner. Google Maps Platform APIs are used to search for and display business location information (the restaurant you search for and select) — we do not track or store your own device's location.

5. Do we use cookies and other tracking technologies?

In short: one essential cookie, nothing else.

We set a single essential session cookie to keep you signed in — nothing more. We do not use advertising cookies, third-party tracking pixels, or any third-party analytics service. Most browsers accept cookies by default; you can set yours to reject them, though this will stop you being able to stay signed in.

6. Do we offer AI-based products?

In short: yes — content generation, presence scoring, and a help chatbot, all powered by Anthropic.

Our AI features are provided through a third-party AI service provider, Anthropic. Your brand details and other relevant information are shared with and processed by Anthropic to enable these features:

• Content generation — flyer and social carousel copy
• Analysis and scoring — reviewing and scoring your website, Instagram, and Google presence
• AI automation — a background process that periodically re-runs scoring so your scores stay current
• Conversational assistant — the built-in help chatbot

7. How do we handle your social logins?

In short: if you sign in with Google, we receive your basic Google profile information.

Our Services let you register and sign in using your Google account. If you do, we receive basic profile information from Google — typically your name and email address. We only use this for the purposes described in this notice. We do not support signing in with Facebook, X, or any other social platform.

8. Is your information transferred internationally?

In short: yes, to some of our US-based service providers.

Our servers are located in the United Kingdom. Several of the service providers listed above are based in the United States (Anthropic, Stripe, Fly.io, Resend, Google, Supabase); Apify is based in the Czech Republic. Where personal information is transferred outside the UK/EEA, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (with the UK's International Data Transfer Addendum applied where relevant). Details of these safeguards can be provided on request.

9. How long do we keep your information?

In short: up to 12 months after your account is closed.

We keep your personal information for as long as your account is active, and for up to twelve (12) months after it's closed, unless a longer period is required by law (for example, tax or accounting records). After that, we delete or anonymise it.

10. How do we keep your information safe?

In short: reasonable technical and organisational measures — but no method of transmission is ever 100% guaranteed.

We use technical measures including encrypted credential storage, signed session cookies, and webhook signature verification for payment events, among others, to protect your information. No method of transmission over the internet is completely secure, so we can't guarantee absolute security.

11. Do we collect information from minors?

In short: no — Tuesday Club is a business tool, not aimed at anyone under 18.

We do not knowingly collect data from, or market to, anyone under 18. By using the Services you confirm you're at least 18. If we learn we've collected data from a minor, we'll delete it — contact us at hello@tuesdayclub.app if you believe this has happened.

12. What are your privacy rights?

In short: you can access, correct, export or delete your data.

Depending on your location, you may have the right to access, correct, delete, or export your personal information, or to object to or restrict its processing. You can:

• Use the Reset control in Settings to clear your review data yourself
• Contact us at hello@tuesdayclub.app to update, export, or delete your account and assets entirely

If you're in the UK and unhappy with how we've handled your data, contact us first — we aim to acknowledge complaints within 30 days. You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. If you're in the EEA or Switzerland, you can also contact your own national data protection authority.

13. Do we make updates to this notice?

We may update this notice from time to time — the "last updated" date at the top will change, and we'll flag material changes prominently rather than silently.

14. How can you contact us?