At Tilkly we take your privacy seriously. This policy explains what personal information we collect, how we use it, and what rights you have when you use our website builder at tilkly.com.
Data Controller: Tilkly is operated by EI Jyoti SINGH (entrepreneur individuel), 169 Avenue de Grande Bretagne, 31300 Toulouse, France.
SIREN: 104 629 845 · SIRET: 10462984500017
Hosting: Hostinger, Paris, France
Questions? Email privacy@tilkly.com.
Information We Collect
| Category | What it is | Where it comes from |
|---|---|---|
| Account data | Your name and email address | You, when you register |
| Website content | Your pages, words, images, and uploaded files | You, while creating your website |
| Website settings | Your Tilkly address, any web address you connect, and your display choices | You, in Settings |
| Service and security activity | Connection details needed to keep Tilkly safe, working, and reliable | Created automatically when the service is used |
| Abuse reports | The reported website address, category, description, optional email, and a privacy-protected connection reference for moderation | Visitors who send a report |
| Contact form replies | Information visitors send through forms on your website, such as their name, email, message, privacy choice, and an abuse-prevention reference | Visitors to your website |
| Contacts | Contact details, organisations, opportunities, tasks, notes, labels, privacy choices, and where each contact came from. We also keep the information needed to make sure form replies and contacts stay accurate. | You and visitors to your website |
| Usage counts | Counts and dates used to show how much of each included allowance you have used | Created automatically when the service is used |
| Support and feedback | The subject, message, progress, account reference, and dates needed to answer your request | You, when asking for help or sharing feedback |
| Account activity | The action, time, and security connection details needed to protect your account | Created automatically when you use your account |
| Google Analytics setting (optional) | The Google Analytics reference you choose to add. Nothing is added if you leave it blank. | You, in Settings |
| AI-generated content |
The website descriptions you send to the AI helper are shared with Google Gemini so it can create your content. A short recent history is kept for your account so you can continue your work. Google Gemini paid service: Your descriptions are not used to train Google’s models. Please avoid adding personal or confidential information. |
You, when using AI generation |
| Payment data | Stripe handles your card details. We receive only the payment reference, amount, currency, purchase type, and result. We never see full card numbers. | You, at checkout, with payment handled by Stripe |
| Connected Stripe account | If you connect Stripe to accept customer payments, we save the account reference needed to send you the money and apply our 1% platform fee. We do not access your balance or payouts. | You, when connecting Stripe in Settings |
Payments and Stripe
We use Stripe as our sole payment processor for these flows:
- AI credits and voluntary support. Tilkly is the seller. We receive the payment reference, amount, currency, purchase type, result, and your account reference, but no card details.
- Customer payments through connected Stripe accounts. If you accept payments on your website, you are the seller. Tilkly provides the payment page, keeps a 1% platform fee, and sends the rest to your Stripe account. You are responsible for your customers’ payment information.
Stripe processes data in the US and other jurisdictions, relying on Standard Contractual Clauses for cross-border transfers.
We keep payment references, amounts, results, and dates for at least seven years to meet tax and fraud-prevention duties. Tilkly never stores card numbers.
How We Use Your Information
- To run the service: keep your website online, sign you in safely, and show your published pages to visitors.
- To communicate with you: send sign-in codes and essential security, legal, and account-deletion messages. Tilkly does not send marketing emails or emails from your contact list.
- To improve things: analyse aggregated, anonymised usage patterns to spot bugs and improve performance.
- To comply with the law: retain logs as required and respond to valid legal requests.
Legal Basis for Processing (GDPR)
- Contract performance (Art. 6(1)(b)): account creation, site hosting, and publishing your pages.
- Legitimate interest (Art. 6(1)(f)): protecting accounts, keeping the service available, and preventing abuse.
- Consent (Art. 6(1)(a)): optional visitor insights, which you can turn off through your cookie choice, and content created with the AI helper.
- Legal obligation (Art. 6(1)(c)): responding to lawful data requests.
When You Are the Data Controller
When visitors send a contact form through a website you built with Tilkly, you decide why and how that information is used. Tilkly stores the replies and contact records so you can answer from your workspace. We do not use them for another purpose.
As the controller, it’s your responsibility to have a valid legal basis and a privacy notice for your own visitors.
Where Your Information Is Kept
Your published website files are kept by Cloudflare in locations around the world so visitors can open them quickly. Your account information is kept on:
- Hostinger hosting in Paris, France: this is in the European Economic Area, so this account processing does not require an international transfer.
All data is encrypted in transit. We do not sell, rent, or share your personal data with advertising networks or data brokers.
How Long We Keep Your Data
- Account information: kept while your account is open. Account records are deleted immediately when you delete the account, and any remaining published files are removed from Cloudflare within 30 days.
- Security and account activity: connection addresses and action records are deleted after 24 hours.
- Form submissions: stored until you delete them from your dashboard, or until account deletion - with an automatic 90-day maximum.
- Contacts: kept while your account is open or until you delete them, unless the law requires longer. You can keep up to 250 contacts. If the list is full, you can still edit and download existing contacts, and new replies remain available until you make room.
- Support and feedback: kept while needed to answer your request, prevent abuse, and maintain a useful support record, then deleted or made anonymous under our support retention schedule.
- Usage counts: dates and totals are kept only as long as needed to calculate the allowances shown in the service. Visitor insights are limited to 90 days.
- Abuse reports: the reporter’s email and connection address are hidden after 30 days. A privacy-protected connection reference and the report are kept for up to 365 days for moderation and legal safety.
- Published files and uploads: removed from active storage when you delete a page, file, or account. Temporary delivery and backup copies disappear through their normal schedules.
- Backups: kept for 7 days, with 28 saved copies made every 6 hours, then permanently deleted.
- Website access records: kept for up to 30 days.
Cookies and Saved Preferences
Tilkly uses only the cookies needed to keep your account and choices working:
- Sign-in cookies: keep you signed in safely.
- Language cookie: remembers your language for 30 days.
- Cookie-choice cookie: remembers your choice for one year.
- Safety cookie: protects important account and form actions.
Your browser also remembers a few display choices, such as your selected page.
- Simple visitor counts are collected only after you accept optional cookies. Tilkly does not try to recognise visitors across other websites.
- We do not add third-party advertising tools to Tilkly pages.
If you connect Google Analytics, it runs on your published website only after a visitor agrees. Under the GDPR, you are responsible for asking your visitors for permission.
For full details, see our Cookie Policy.
Your Rights
Request a copy of all personal data we hold about you.
Update inaccurate data directly in Account Settings.
Delete your account and all data instantly from Account Settings → Delete My Account.
Export your site data anytime using the Export function in your dashboard.
Object to or restrict certain processing by contacting us.
Email privacy@tilkly.com for any request. We’ll respond within one month (up to three months for complex requests, with prior notice).
You also have the right to lodge a complaint with your local EU supervisory authority. In France, contact the CNIL.
Security
- One-time codes sent to your email let you sign in without a stored password.
- Information is encrypted while it travels between you and Tilkly.
- Signed-in sessions are short and renewed safely when needed.
- Repeated sign-in attempts are limited to help stop account attacks.
- Every page uses additional browser protections.
No system is 100% secure. If you find a vulnerability, please disclose it responsibly to security@tilkly.com.
Children’s Privacy
Tilkly is not directed at children under 16. We don’t knowingly collect personal data from anyone under 16. If we discover that we have, we’ll delete it promptly.
Data Breach Notification
If a breach is likely to put your rights at risk, we’ll notify affected users without undue delay and inform the relevant supervisory authority within 72 hours of becoming aware. We’ll reach you at the email address associated with your account.
Companies That Help Us Run Tilkly
| Company | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Stores and quickly delivers published website files, connects web addresses, and protects websites from attacks | Global (US HQ) SCC |
| Hostinger | Runs the Tilkly service and keeps account information | Paris, France EU |
| Google LLC (Gemini) | Creates text from descriptions you send to the AI helper | US / global SCC |
| Backblaze B2 | Keeps protected backup copies | EU/US (provider-selected region) EU |
| Stripe | Handles AI credit purchases, support contributions, and customer payments | US SCC |
| Spaceship (Spacemail) | Sends sign-in codes and approved security, legal, or account-deletion notices | EU (Lithuania) EU |
EU No cross-border transfer SCC Transfer covered by Standard Contractual Clauses
Changes to This Policy
We may update this Privacy Policy occasionally. We’ll let you know about significant changes by posting the updated version here and updating the “Last updated” date. Where the law requires it, we’ll ask for fresh consent before changes take effect. Simply continuing to use the Service is not treated as consent under the GDPR.
Contact Us
We’re a small team and we actually read our email.
- 🔒 Privacy questions: privacy@tilkly.com
- 💬 General support: support@tilkly.com
- 🔐 Security issues: security@tilkly.com