Privacy policy

Last updated: 2 June 2026

This notice explains how we collect and use personal data when you use the TilingPlan website and application. We aim to be clear and proportionate: we collect what we need to run the service, improve it, and meet our legal obligations — and no more.

1. Who we are

TilingPlan (tilingplan.com) is a tiling layout tool for professional tilers and related trades. The data controller is the operator of TilingPlan (“we”, “us”, “our”).

For privacy questions or to exercise your rights, email [email protected].

2. Who this notice applies to

Visitors to our marketing pages (for example /, /pricing, /help)
Users of the tiling editor at /app, with or without an account
Registered users who save projects to the cloud, manage a profile, or use account features

If you use TilingPlan on behalf of a company, you are responsible for ensuring your use complies with your organisation’s policies. We process your account and profile data as described here.

3. Personal data we collect

Depending on how you use TilingPlan, we may process the following categories of data.

Account and identity

Email address and authentication identifiers (Supabase Auth)
Sign-in method (email/password or passwordless email link)
Account creation and last sign-in timestamps

Profile (optional, except where needed for onboarding)

Display name, company name, phone number
Marketing preferences (marketing_opt_in) and when you opted in
Referral code and whether you were referred by another user
Brand logo file path when you upload a logo for exports (paid tiers)

Projects and content you create

Floor plan data, tile choices, layout settings, and project metadata
Project snapshots stored in our database and object storage when you save to the cloud
Guide images and related assets you upload to trace a plan
Exported layout images you generate in the app (processed in your browser; we do not receive the image unless you save or share it through our service)

Free tier without an account: work stays in your browser for the current session. We do not store your project in the cloud until you create an account and save.

Device storage: signed-in users may have project data cached locally (IndexedDB) for offline use and faster loading. This stays on your device until cleared by you or the app.

Subscription and billing

Plan tier, entitlement limits, and subscription status in our database
For paid plans, payment and invoice data are processed by Stripe, our payment provider. We do not store full card numbers on our servers.

Referrals

Referral relationships between referrer and referee accounts
Referral reward and billing metadata needed to operate the referral programme

Usage and analytics

Product analytics events (for example page views, editor session started, project saved, export completed, sign-up completed) with properties such as plan tier, feature gated, and session ID
A subset of business events mirrored to our usage_events table (signed-in users only) for internal reporting
Client error reports and optional sampled session replay context
Marketing attribution stored in your browser session (UTM parameters, referrer URL) when you arrive from a campaign link — not your email

We identify signed-in users in analytics by account ID only — not by email or display name. We do not send project JSON, guide image bytes, or export files to analytics providers.

Technical and security

IP address, browser type, and device information (via our hosting and analytics infrastructure)
Logs related to authentication, API requests, and abuse prevention

Support and correspondence

Information you send when you contact us about your account or this policy

4. How we use your data and our lawful bases

Under UK GDPR we need a lawful basis for each purpose. The table below summarises the main processing activities.

Purpose	Typical data	Lawful basis
Provide the service — accounts, editor, cloud save, exports	Account, profile, projects, assets	Contract (Art. 6(1)(b))
Operate referrals and entitlements	Referral codes, relationships, tier limits	Contract / Legitimate interests (running the programme fairly)
Product analytics and error monitoring	Event names, session ID, tier, anonymous or account ID	Legitimate interests (understanding use, fixing faults, improving the product). You may object (see section 9).
Marketing communications	Email, marketing opt-in	Consent (Art. 6(1)(a)) — only if you opt in
GDPR access, export, and erasure requests	Account and related records	Legal obligation / Legitimate interests (responding to rights requests)
Security, fraud prevention, and enforcing terms	Auth logs, IP, account identifiers	Legitimate interests (keeping the service secure)

We do not use your personal data for automated decision-making that has legal or similarly significant effects on you.

5. Who we share data with

We use trusted service providers (“processors”) who process data on our instructions and only for the purposes described in this notice.

Supabase — authentication, database, and file storage for projects, guide images, and brand assets
PostHog (EU-hosted) — product analytics, error capture, and sampled session replay
Stripe — payment processing and subscription management for paid plans
Hosting provider — delivery of the web application (for example static hosting and edge functions)

We may also disclose data where required by law, to protect our rights, or in connection with a business transfer (we would notify users where practicable).

We do not sell your personal data.

6. International transfers

Our primary infrastructure is hosted in the UK/EEA where possible. PostHog is configured for EU hosting.

If any provider processes data outside the UK, we rely on appropriate safeguards such as UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), or EU Standard Contractual Clauses (as applicable). You may request more information about transfers and safeguards by contacting us.

7. How long we keep data

Account and profile — while your account is active, then deleted or anonymised when you delete your account (see section 8).
Cloud projects and files — until you delete them or delete your account; we then remove associated storage objects.
Usage events (database) — retained for internal reporting for a limited period, then aggregated or deleted; typically aligned with your account lifecycle.
Analytics (PostHog) — retained according to our PostHog project settings; identifiable analytics data is linked to your account ID after sign-in. Contact us to request deletion of PostHog data associated with your account.
Referral billing records after account delete — some referral billing rows may be kept in anonymised form (referrer and referee IDs removed) so we can honour programme caps and audit obligations. No personal profile data remains in those rows.
Backups — deleted data may persist in encrypted backups for a short period before being overwritten.

8. Account deletion and data export

You can exercise several rights directly in the app:

Access & portability — download a ZIP archive of your personal data from Account settings (self-serve export, limited to one request per 24 hours). The archive includes profile, projects, snapshots, assets metadata, referrals, and related records as described in the export README inside the ZIP.
Erasure — permanently delete your account from Account settings. You must re-authenticate and type DELETE to confirm. This removes your login, profile, cloud projects, and stored files subject to the anonymised retention noted above.
Rectification — update profile fields on your Account page.
Withdraw marketing consent — turn off marketing opt-in on your Account page.

After deletion you are signed out and offline project cache on your device may be cleared. Local browser data outside our control may remain until you clear site data in your browser.

9. Your other rights

Under UK GDPR you also have the right to:

Restrict or object to certain processing (including analytics based on legitimate interests)
Not be subject to solely automated decisions with significant effects (we do not use these)
Lodge a complaint with the UK Information Commissioner’s Office (ICO) — ico.org.uk/make-a-complaint

To object to analytics or request erasure of analytics data held by our processors, email [email protected]. You can also block analytics scripts in your browser; the app remains usable without them.

10. Cookies and similar technologies

We use cookies and browser storage for essential operation and for product analytics.

Strictly necessary — authentication session cookies (Supabase) so you can stay signed in.
Functional — local/session storage for offline projects, marketing attribution (UTM/referrer in session), pending referral codes, and intro-tour state.
Analytics — PostHog may set cookies or use local storage for an anonymous or identified distinct ID, page views, and sampled session replay (approximately 10% of sessions). We do not use PostHog autocapture.

Where required under UK PECR, we obtain your consent before setting non-essential analytics cookies. You can withdraw consent at any time by emailing [email protected].

11. Security

We use industry-standard measures including encrypted connections (HTTPS), row-level security on database access, authenticated API routes, and access controls on storage buckets. No method of transmission or storage is 100% secure; please use a strong password and keep your credentials confidential.

12. Children

TilingPlan is aimed at trade professionals and is not intended for children under 16. We do not knowingly collect personal data from children. Contact us if you believe a child has provided data and we will delete it.

13. Changes to this notice

We may update this policy when our processing changes (for example new features, billing, or analytics). We will post the new version on this page and update the “Last updated” date. Material changes may also be highlighted in the app or by email where appropriate.

14. Contact

Privacy enquiries and data subject requests: [email protected]

See also our Terms of service, Account settings, Help centre, and FAQ.