Privacy Policy

This privacy policy (the “Policy”) is issued by Tones & Tells (“we”, “us” or “our”) and explains how we collect, use, store, share and otherwise process personal data in connection with the website at tonesandtells.com (the “Platform”), including where you join our waitlist, register as a creator or user, or otherwise interact with us.

This Policy is issued in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 (“DPA 2018”), the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), and other applicable data protection legislation in force in the United Kingdom from time to time (together, “Data Protection Legislation”).

The Platform operates as a recommendation and discovery platform for parenting and family-related content. Creators publish recommendation content via third-party social media platforms (including Instagram and TikTok), and selected content is displayed on the Platform for users to browse. Each item of recommendation content may include a link to a third-party retailer, brand, service provider or affiliate destination. No purchases, bookings or other transactions are completed on the Platform; all such transactions are concluded directly between the user and the relevant third party.

This Policy applies to two categories of persons who interact with the Platform, each of whom is referred to as “you” or “your” in this Policy: (a) Platform Users, meaning visitors to the Platform, waitlist subscribers, and registered users (including parents and families) who browse or otherwise interact with the Platform; and (b) Creators, meaning individuals who register as creators or contributors and maintain a profile on the Platform. Where a provision of this Policy applies exclusively to one category, this is stated in the relevant clause. Where no distinction is made, the provision applies to both.

We encourage you to read this Policy carefully before using the Platform. It explains how we collect, use, and protect your personal data and sets out your rights under the Data Protection Legislation. If you have any questions about how we process your personal data, please contact us using the details in clause 18. Note for Creators: additional provisions that apply specifically to you are identified in the relevant clauses below and in our separate Creator and Contributor Terms.

This Policy should be read together with our Website Terms and Conditions, Cookie Policy, Affiliate Disclosure and (where applicable) our Creator and Contributor Terms. Each of those documents forms part of the compliance and regulatory framework applicable to your use of the Platform. Nothing in those documents limits or derogates from your rights under the Data Protection Legislation.

For the purposes of the Data Protection Legislation, the data controller in respect of your personal data is Tones & Tells.

We have not appointed a statutory Data Protection Officer, as we are not required to do so under Article 37 UK GDPR. The obligation to appoint a DPO does not apply to us because: (i) we are not a public authority or body; (ii) our core activities do not consist of large-scale, systematic monitoring of individuals; and (iii) we do not carry out large-scale processing of special category or criminal offence data. All data protection enquiries, including requests to exercise the rights described in clause 13, should be directed to the contact details set out in clause 2.3. We keep our processing activities under regular review and will appoint a DPO if our processing activities change such that the obligation arises.

Data protection contact — Email: tonesandtells@gmail.com.

Should we appoint a Data Protection Officer or equivalent privacy lead in the future, this Policy will be updated to reflect their contact details.

We collect and process the following categories of personal data about you, depending on the nature of your interaction with the Platform:

• Identity data: name, username or profile name and, in the case of creators, profile biography, content category and linked social media handle;
• Contact data: email address and, where voluntarily provided, telephone number or postal address;
• Account data: login credentials (processed via our authentication provider and not retained by us in plain text), account status and registration details;
• Profile and content data: information submitted by creators in connection with profile creation, recommendation content, posts and product or content listings, including uploaded images and media;
• Technical data: IP address, browser type and version, device and operating system information, and related technical identifiers collected automatically in connection with website hosting and security;
• Usage data: information concerning your use of the Platform, including pages viewed, recommendations selected and interactions with creator content;
• Financial and payout data (Creators only): where commission earned through creator recommendations is passed to creators, we may collect, or facilitate the collection of, payment details necessary to process payouts, whether directly or via our affiliate network partner. This data category applies to Creators only and will be processed in accordance with clause 5 once the commission model is confirmed;
• Marketing and communications data: your marketing preferences and communication choices, including waitlist registration and any opt-in or opt-out instruction given to us.

We do not collect, and have no current plans to collect, any special category data within the meaning of Article 9 UK GDPR (including data concerning health, religious or philosophical belief, or sexual orientation), nor any payment card data from users, as no payment processing takes place on the Platform. Creators may publish content that incidentally references health conditions, religious views, or other special category matters in the context of parenting and family recommendations. We do not process such information as special category data and do not treat it as such. If we become aware that special category data has been submitted to us directly, we will take appropriate steps to delete or anonymise it unless a condition under Article 9(2) UK GDPR applies.

Where you are required to provide personal data to us by law, or under the terms of a contract between us, and you fail to provide that data on request, we may be unable to perform that contract, including by declining to create or maintain your account or creator profile. The data categories that are strictly necessary for the purposes described in clause 5 are: Identity data, Contact data, and Account data. Where data is optional, this is indicated at the point of collection. We will notify you if the absence of any particular data category prevents us from providing the relevant service at the relevant time.

We collect personal data about you through the following methods:

• Direct interactions — where you join our waitlist, register an account, complete a creator or contact form, or otherwise correspond with us by email or through the Platform;
• Account registration and authentication — where you create a user or creator account, processed through our third-party authentication provider (details set out in clause 8);
• Form submissions — data submitted through forms on the Platform, including creator applications, transmitted via our third-party email notification provider and stored in our secure database (details set out in clause 8);
• Content and media uploads — images and media uploaded in connection with creator profiles or recommendation content, stored via our third-party media management provider (details set out in clause 8);
• Automated technologies — to the limited extent described in clause 7 (Cookies and Tracking Technologies) below; and
• Third parties — where applicable, information received from affiliate networks or social media platforms in connection with creator verification or affiliate link tracking; and, in the case of Creators, limited publicly available information associated with linked social media accounts (such as Instagram or TikTok handles, profile names, and content metadata) where this is provided by you or ingested in connection with your profile on the Platform. We do not scrape or collect private social media data. Our legal basis for this processing is performance of our contract with Creators (Article 6(1)(b) UK GDPR) and our legitimate interests in operating the Platform (Article 6(1)(f) UK GDPR).

We will only process your personal data where the law permits us to do so. The table below identifies, for each purpose of processing, the categories of personal data used and the legal basis relied upon under Article 6(1) UK GDPR.

Where we rely on legitimate interests as a legal basis, we have undertaken a legitimate interests assessment (“LIA”) in respect of each such processing activity. In each case, we have identified the specific legitimate interest pursued, assessed whether the processing is necessary to achieve that interest and balanced our interests against the potential impact on your rights and freedoms. We have concluded that our legitimate interests are not overridden in each case. The purposes for which we rely on this basis include: operating and securing the Platform; facilitating creator discovery and affiliate relationships; and improving the user experience. A copy of our LIA records is available on request using the contact details in clause 18.

Where we rely on your consent, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal as further described in clause 13.

Right to complain to a supervisory authority (Article 77) — you have the right to lodge a complaint at any time with the Information Commissioner’s Office (“ICO”), the United Kingdom’s supervisory authority for data protection matters. Full details of how to contact the ICO are set out in clause 14. We would, however, welcome the opportunity to address any concern you may have directly before you contact the ICO, and we encourage you to contact us in the first instance using the details in clause 18.

Where processing is necessary for compliance with a legal obligation, we will identify the specific obligation relied upon on request.

Use of automated tools and artificial intelligence — the Platform may use software tools, including artificial intelligence (“AI”), to assist with creating creator profile summaries, categorising recommendation content, and improving the presentation of creator content on the Platform. The use of such tools is limited to supporting the preparation and display of content; all content published on the Platform is reviewed by a member of the Tones & Tells team before publication. As at the date of this Policy, these tools do not make decisions that produce legal or similarly significant effects concerning any individual and do not constitute solely automated decision-making within the meaning of Article 22 UK GDPR. We commit to reviewing this position regularly as the Platform’s AI functionality develops. Should our use of AI change such that it produces legal or similarly significant effects, we will update this Policy, notify affected users, and put in place the rights and safeguards required by Article 22 UK GDPR. Our legal basis for this processing is our legitimate interests in operating and improving the Platform (Article 6(1)(f) UK GDPR), and, in relation to profile and content data submitted by creators, performance of our contract with those creators (Article 6(1)(b) UK GDPR).

Where you join our waitlist, or otherwise provide your contact details and indicate that you wish to hear from us, we may send you marketing communications concerning the Platform’s launch, new features, and related parenting and family content. Marketing communications will be sent primarily by email. Should we introduce additional electronic marketing channels in the future, including push notifications, SMS, or in-app messaging, we will only use those channels where we have obtained the appropriate prior consent required by PECR and will update this Policy accordingly.

In accordance with Regulation 22 PECR, we will only send you direct marketing communications by electronic means where you have given your prior, freely given, specific and informed consent. You will not be added to any marketing list without a clear, affirmative opt-in. Where you are an existing registered user of the Platform, we may also contact you by electronic means about our own similar products or services under the soft opt-in provision in Regulation 22(3) PECR, provided that you were given a clear opportunity to opt out at the time your details were collected and at the time of each subsequent communication. You may opt out of such communications at any time using the mechanism described in clause 6.3.

Every marketing communication we send will include a clear mechanism to unsubscribe. You may withdraw your consent and opt out of marketing communications at any time using that mechanism, or by contacting us using the details in clause 18. Opting out of marketing communications does not affect our ability to send you transactional or account-related communications necessary for the operation of the Platform.

The Platform may use cookies and similar tracking technologies to distinguish you from other users, to support core website functionality and, once introduced, to understand how the Platform is used.

As at the date of this Policy, the Platform has not implemented any analytics, advertising or marketing cookies. The only cookies or similar technologies currently in use are those that are strictly necessary for the operation of the Platform, for example session and authentication cookies used by our login system, which are exempt from the consent requirement under Regulation 6(4) PECR.

As the Platform develops, we anticipate introducing some or all of the following categories of cookies:

• Strictly necessary cookies — required for core website functionality and account authentication, and exempt from consent under PECR;
• Analytics cookies — to help us understand how visitors use the Platform, for example via Google Analytics or Meta analytics, if and when introduced;
• Functional cookies — to remember your preferences and improve your experience of the Platform; and
• Marketing and targeting cookies — to support affiliate link tracking and any future advertising activity.

Save where an exemption under Regulation 6(4) PECR applies, we will not set non-essential cookies on your device unless and until you have given your consent. As at the date of this Policy, no non-essential cookies are in use and no cookie consent banner is therefore currently deployed. A cookie consent banner will be implemented at the point at which any non-essential cookie is introduced to the Platform, prior to that cookie being set. Once introduced, you may withdraw your consent and amend your cookie preferences at any time through that consent mechanism.

Full details of the specific cookies in use, their purpose and duration, and how to manage your preferences, are, or will be, set out in our separate Cookie Policy.

We engage a number of third-party service providers to operate the Platform. As at the date of this Policy, the following providers are in active use:

We do not currently use payment processors, advertising trackers, or third-party analytics tools, including Google Analytics or the Meta Pixel. Should any of the following be introduced as the Platform develops, this Policy will be updated prior to their implementation:

• website hosting or builder platform changes, for example if Webflow or an alternative is adopted in place of, or alongside, the current Next.js and Vercel build;
• an email or marketing platform, such as Mailchimp or an equivalent provider, which is currently under consideration;
• analytics tools, such as Google Analytics or Meta and Instagram analytics, which are currently under consideration;
• a cookie consent management platform, such as CookieYes, which is currently under consideration; and
• payment processing tools, none of which are currently in use, as no payments are processed through the Platform.

We require all third-party service providers who process personal data on our behalf to do so only in accordance with our written instructions and applicable law. In accordance with Article 28 UK GDPR, we enter into a written data processing agreement (“DPA”) with each such provider in all cases before any processing commences. Each DPA sets out the subject matter, duration, nature and purpose of the processing, the type of personal data involved, and the obligations and rights of the parties. We will not engage a sub-processor without ensuring equivalent contractual protections are in place.

We may disclose your personal data to the following categories of recipients:

• Service providers — the technology and infrastructure providers identified in clause 8, who process data on our behalf to operate the Platform;
• Affiliate networks and partners — including Impact, for the purpose of verifying affiliate relationships and, once live, tracking and processing affiliate commissions;
• Social media platforms — such as Instagram, TikTok and Facebook, where you elect to link your creator profile or social accounts to the Platform;
• Professional advisers — including our legal, accountancy and audit advisers, where necessary for the proper conduct of our business;
• Regulators and law enforcement — including HM Revenue & Customs, the Information Commissioner’s Office, courts and other competent authorities, where required by law or necessary to establish, exercise or defend our legal rights; and
• Business transferees — in connection with any actual or prospective sale, merger, reorganisation or transfer of all or part of our business or assets. Any such transferee will be required to process your personal data in accordance with obligations no less protective than those set out in this Policy. Where a transfer would constitute a material change to the manner in which your data is processed, you will be notified in advance in accordance with clause 17.

We do not sell your personal data to third parties. The affiliate commissions generated through creator links on the Platform are earned through the commercial relationships between the Platform, creators, and affiliate network partners, and do not involve the transfer of personal data in exchange for monetary consideration. Personal data shared with affiliate network partners (as identified in clause 8) is shared solely for the purposes of verifying affiliate relationships and processing commissions, on the basis described in clause 5.

Certain of our service providers, including Vercel, AWS, Cloudinary, Resend and Impact, may store or process personal data outside the United Kingdom, including in the United States and other jurisdictions in which those providers or their sub-processors operate.

Where personal data is transferred outside the United Kingdom, we ensure that an appropriate level of protection is maintained by relying on one or more of the following safeguards, as applicable to the relevant transfer:

• a finding of adequacy made by the Secretary of State in respect of the destination country pursuant to section 17A of the Data Protection Act 2018;
• transfers to providers certified under the UK Extension to the EU-U.S. Data Privacy Framework (the UK-US Data Bridge), where the receiving provider is so certified;
• the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, entered into with the relevant provider; or
• such other appropriate safeguard as is recognised under Chapter V UK GDPR from time to time.

Further details of the specific safeguard relied upon in respect of a particular transfer are available on request using the contact details in clause 18.

We have implemented technical and organisational measures designed to protect your personal data against accidental loss, unauthorised access, alteration or disclosure, including:

• Technical safeguards — encrypted data storage via AWS RDS, secure authentication via NextAuth, and the use of reputable, security-conscious infrastructure providers, including Vercel, AWS and Cloudinary;
• Organisational safeguards — restricting access to personal data to personnel and contractors who require it to perform their role, and requiring service providers to maintain equivalent security standards; and
• Access controls — role-based access controls applied to our database and administrative systems.

We maintain procedures to detect, investigate and respond to any suspected personal data breach. Where a breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the Information Commissioner’s Office without undue delay and, in any event, within 72 hours of becoming aware of the breach, in accordance with Article 33 UK GDPR. Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, in accordance with Article 34 UK GDPR, unless an exemption under that Article applies. Such notification will describe the nature of the breach, likely consequences, and steps we have taken or propose to take to address it.

While we take reasonable steps to protect your personal data, no method of transmission over the internet, or method of electronic storage, is entirely secure, and we cannot guarantee absolute security.

We retain personal data only for as long as is reasonably necessary to fulfil the purposes for which it was collected, including for the purpose of satisfying any applicable legal, regulatory, tax, accounting or reporting requirement.

In determining the appropriate retention period for any category of personal data, we have regard to the amount, nature and sensitivity of the data, the potential risk of harm arising from unauthorised use or disclosure, the purposes for which it is processed and whether those purposes may be achieved by other means, and any applicable legal, regulatory, tax or accounting requirement.

Our intended retention periods are as follows: (i) account and creator profile data is retained for the duration of the account plus a further period of 6 years from account closure, consistent with the standard UK limitation period under the Limitation Act 1980; (ii) waitlist and marketing data is retained until you withdraw consent or unsubscribe, following which it will be deleted within 30 days; (iii) financial and payout data, where applicable, is retained for a minimum of 6 years in accordance with section 388 of the Companies Act 2006 and applicable HMRC record-keeping requirements; (iv) technical data (including IP addresses and browser identifiers) is retained for a maximum of 12 months from the date of collection, unless a longer period is required for security or legal purposes; and (v) usage data is retained for a maximum of 12 months from the date of collection. These periods will be reviewed and updated as the Platform develops.

Where you exercise your right to erasure under clause 13, we will delete or anonymise your personal data save to the extent we are required or permitted to retain it for a legitimate legal, regulatory, tax or accounting purpose.

Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data, each of which is qualified by the exemptions and limitations set out in the Data Protection Legislation:

• Right of access (Article 15) — to request a copy of the personal data we hold about you, together with information about how and why we process it (a “subject access request”);
• Right to rectification (Article 16) — to request that we correct any inaccurate or incomplete personal data we hold about you;
• Right to erasure (Article 17) — to request that we delete your personal data where there is no compelling reason for its continued processing (the “right to be forgotten”);
• Right to restrict processing (Article 18) — to request that we restrict, but not delete, your personal data in certain circumstances, for example while we verify its accuracy;
• Right to object (Article 21) — to object to our processing of your personal data where we rely on legitimate interests, and at any time to processing for direct marketing purposes;
• Right to data portability (Article 20) — to request the transfer of your personal data to you or to a third party in a structured, commonly used, machine-readable format, where processing is based on consent or contract and carried out by automated means;
• Rights relating to automated decision-making (Article 22) — we do not currently carry out any processing involving solely automated decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you. Should this change, this Policy will be updated and you will be separately notified of the rights available to you; and
• Right to withdraw consent — where we rely on your consent, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact us using the details in clause 18. We will respond within one calendar month of receipt of a valid request, as required by Article 12 UK GDPR, save that this period may be extended by a further two months where the request is complex or numerous, in which case we will notify you of the extension and the reason for it. There is no fee for making a request unless it is manifestly unfounded, repetitive or excessive, in which case we may charge a reasonable administrative fee or decline to act on the request.

We may need to request specific information from you to help us confirm your identity before responding to a request made under this clause 13, as a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

If you have any concerns regarding our handling of your personal data, we would welcome the opportunity to address them directly. Please contact us in the first instance using the details in clause 18.

You also have the right to lodge a complaint at any time with the Information Commissioner’s Office, the United Kingdom’s supervisory authority for data protection matters:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Telephone: 0303 123 1113. Website: ico.org.uk.

The Platform contains links to third-party websites, retailers, service providers and affiliate destinations, including those reached via creator recommendations. Following such a link, or enabling any associated connection, may allow the relevant third party to collect or share data about you in accordance with its own privacy policy.

We do not control these third-party websites and accept no responsibility for their independently operated privacy practices. We encourage you to review the privacy policy of every third-party website you visit, in particular before completing any purchase, booking or other transaction, as all such transactions are concluded entirely outside the Platform. We exercise reasonable care in the selection of affiliate partners and require our affiliate network provider to operate within applicable law; however, we do not accept liability for the privacy practices of those partners’ own websites or platforms, which operate independently of the Platform.

The Platform is intended for use by parents, families and creators aged 18 years or over. We do not knowingly collect personal data directly from children, and registration as a user or creator is not intended for, and is not permitted by, individuals under the age of 18. At the point of registration, all users are required to confirm that they are aged 18 or over. We do not currently employ automated age verification technology. We are aware of the ICO’s Age Appropriate Design Code (the “Children’s Code”) and acknowledge that the Platform’s parenting and family content focus may attract users who are under 18 or who interact on behalf of children. We take the following steps to mitigate risk: (i) registration requires an affirmative 18+ confirmation; (ii) where we become aware that a person under 18 has registered, we will take steps to delete their account and associated data; and (iii) we do not collect, process or target advertising based on data that we have reason to believe relates to an individual under 18. We will keep our approach to age assurance under review as the Platform develops and as regulatory guidance evolves.

Recommendation content displayed on the Platform may relate to children and families; this does not, however, involve the collection of personal data about any child by us, save to the extent of any incidental reference contained within publicly available creator content, which is not processed by us as personal data relating to a child.

If you become aware that a child has provided us with personal data without appropriate parental or guardian consent, please contact us using the details in clause 18, and we will take steps to investigate and, where appropriate, delete that information.

We may amend this Policy from time to time to reflect changes in our practices, the Platform, our third-party service providers, or the Data Protection Legislation, in particular as we transition from testing to full launch.

Any amendment will be published on this page with an updated “Last Updated” date. Where an amendment is material, we will take reasonable steps to notify you, for example by email or by way of a notice on the Platform. For these purposes, a material change includes: (i) a change in the identity of the data controller; (ii) the introduction of a new purpose of processing not previously disclosed; (iii) a new category of personal data being collected; (iv) a new international transfer or a change in the safeguard relied upon; or (v) any change that is likely to have a significant effect on your rights or the way in which your data is used.

This Policy was last updated on 29 June 2026 and takes effect from 29 June 2026.

If you have any questions about this Policy, or wish to exercise any of the rights described in clause 13, please contact us at the details below. We aim to acknowledge all general enquiries within 5 working days. Formal requests to exercise your data subject rights will be responded to within the timeframe set out in clause 13.2.

Tones & Tells — Email: tonesandtells@gmail.com.