Privacy Policy

Effective date: 2026-08-04

Who we are

Infracto is the data controller for the personal data described in this policy — the organisation that decides why and how it is used. Our ICO data protection registration number is [ICO REGISTRATION NUMBER — TBD, registration not yet filed]. You can contact us about anything in this policy at accounts@infracto.co.uk.

What we collect

We collect three kinds of personal data:

• Account details — your email address and password (stored as a salted hash, never in plain text), used to create and secure your account.
• Payment metadata — if you subscribe to a paid plan, Stripe processes your card details directly; we store only the resulting customer and subscription identifiers, never your card number.
• Usage data — the rooms, cues, and messages you create while using the product, so the service can display and synchronise them for you and anyone you share a link with.

Why we use it, and our lawful basis

• Account details — to provide the service you asked for (performance of a contract).
• Payment metadata — to bill you for a paid subscription (performance of a contract) and to meet our accounting obligations (legal obligation).
• Usage data — to run the core functionality of the product: displaying your cues and messages on the screens you or your team open (performance of a contract).

How long we keep it

We keep account and usage data for as long as your account is active, and for a limited period afterwards in case you wish to reactivate it or as required to resolve a billing dispute. Payment metadata is kept for as long as UK accounting law requires records to be retained.

Who else sees it

We use a small number of processors to run the service. None of them use your data for their own purposes beyond providing their service to us.

International transfers

Every processor listed above is based in the UK or the EU. We do not currently transfer personal data outside the UK/EEA, so no additional safeguard (such as Standard Contractual Clauses or a UK International Data Transfer Agreement) is currently needed. We will update this section if that changes — for example, if we introduce a processor based elsewhere.

Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected, or incomplete data completed.
• Ask us to erase your data, or restrict or object to certain processing, subject to our own legal obligations (for example, accounting records we must keep).
• Receive your data in a portable, machine-readable format.

To exercise any of these rights, email accounts@infracto.co.uk. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data properly.

Children

Tamora is a professional event-production tool and is not directed at, or intended for use by, children. We do not knowingly collect personal data from anyone under 18.

Changes to this policy

If we make a material change to this policy, we will update the effective date above and, where the change is significant, notify account holders by email.