Privacy Policy

1. Introduction

Welcome to Taylee ("we", "our", "us"). We are committed to protecting your privacy and handling your personal data responsibly.

This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the Taylee mobile application ("the App").

We are registered in the United Kingdom and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Your name
• Email address
• Password (encrypted)
• Whether you consent to marketing communications

2.2 Family Information

To personalise activity recommendations, we collect:

• Children's first names
• Your children's birth month and year, which we use to work out their age for suggestions. We do not ask for the day.
• Children's interests (selected from categories)

2.3 Location Information

• Your postcode (to find local activities)
• Your region (for school holiday detection)

Precise GPS location: If you choose to use the "Current Location" feature, we temporarily access your device's GPS coordinates to find activities near your current position. This is only collected when you explicitly activate this feature and is not stored on our servers or retained after your session.

2.4 Optional Sensitive Information

With your explicit consent, you may choose to provide:

• Dietary requirements (allergies, religious dietary needs)
• Additional support needs (to find suitable accessible activities)

This sensitive information is:

• Only collected with explicit consent
• Stored securely in the UK
• Anonymised before being sent to AI services
• Never shared with third parties for marketing

2.5 Usage Information

We automatically collect:

• Activities you save, complete, or dismiss
• Your preferences and feedback
• Pseudonymous app usage analytics (which screens you view, which features you use, session length, and errors). See Section 8.3 for exactly what is and is not collected
• Device information (for technical support)

2.6 Calendar Information

If you choose to add activities to your calendar:

• We create calendar events on your device
• We do NOT read or access your existing calendar

3. How We Use Your Information

4. How We Share Your Information

4.1 AI Services

Activity recommendations (Anthropic)

To generate activity recommendations and power the chat assistant, we send information to Anthropic's Claude AI service. Before sending:

• Children's names are replaced with generic labels (e.g., "Child 1")
• Your full postcode is never sent. We share only your town or postcode district (for example, 'EH1 area')
• Your wider region (for example, 'Scotland') is included to detect local school holidays
• Sensitive data (dietary, SEN) is anonymised

Anthropic does not use your data to train their AI models.

Voice transcription (OpenAI)

If you use the voice input feature, your recording is sent to OpenAI's Whisper service to be turned into text. Only the audio is sent: no account details, no children's information, no location. Because we cannot know in advance what a recording contains, anything you say forms part of what is sent. OpenAI does not use your recording to train their AI models, and retains API data for up to 30 days for abuse monitoring before deleting it. The recording is removed from your device as soon as it has been transcribed.

4.2 Firebase (Google Cloud)

We use Firebase for:

• User authentication
• Secure data storage
• Push notifications
• App analytics (pseudonymous usage data, see Section 8.3)
• Crash and error diagnostics (see Section 8.4)

Account and family data is stored in Google's UK/EU data centres. Analytics data is described in Sections 6.3 and 8.3.

4.3 Weather Services

We send your general location (postcode area) to weather services to provide weather-aware recommendations.

4.4 Venue Information

We use Google Places API to find venue details. Only your general location is shared, not personal information.

4.5 Payment Processors

When paid plans launch, subscriptions will be processed by Apple (App Store) or Google (Play Store). We do not receive or store your payment card details.

4.6 We Never

• Sell your personal data
• Share your data with advertisers
• Share children's information with third parties for marketing
• Use your data to build advertising profiles

5. Children's Privacy

Taylee helps parents plan activities for their children. We take children's privacy seriously:

• We collect minimal information about children (first name, age, interests only)
• Children's names are anonymised before being sent to AI services
• We do not allow children under 18 to create accounts
• Only parents/guardians can input information about children
• We comply with the Children's Code (Age Appropriate Design Code)

6. Data Storage and Security

6.1 Where We Store Data

6.2 Security Measures

• All data transmitted using TLS encryption
• Passwords hashed using industry-standard algorithms
• Firebase security rules restrict data access
• Regular security reviews

6.3 International Data Transfers

Some of our third-party service providers process data outside the United Kingdom:

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR, including Standard Contractual Clauses approved by the Information Commissioner's Office.

6.4 Data Retention

7. Your Rights

Under UK GDPR, you have the right to:

7.1 Access Your Data

Request a copy of all personal data we hold about you.

7.2 Correct Your Data

Update inaccurate or incomplete information via the app or by contacting us.

7.3 Delete Your Data

Request deletion of your account and all associated data. You can do this in Settings > Delete Account, or by contacting us.

7.4 Export Your Data

Request your data in a portable format.

7.5 Withdraw Consent

Withdraw consent for optional data processing (dietary, SEN, marketing) at any time in Settings.

7.6 Object to Processing

Object to processing based on legitimate interests. To object to usage analytics, email us at privacy@taylee.app and we will turn off analytics collection for your account.

7.7 Automated Decision-Making and Profiling

Taylee uses AI to generate personalised activity recommendations based on your children's ages, interests, location, and weather conditions. This constitutes profiling under UK GDPR Article 22.

However:

• No decisions with legal or similarly significant effects are made solely by automated means
• All recommendations are suggestions only. You decide which activities to pursue
• You can adjust your preferences at any time to influence recommendations
• You can contact us at privacy@taylee.app to request human review of how your data is used for recommendations

7.8 Lodge a Complaint

You have the right to complain to the Information Commissioner's Office (ICO):

• Website: https://ico.org.uk
• Telephone: 0303 123 1113

8. Cookies and Tracking

The Taylee app does not use cookies. We use minimal local storage on your device to:

• Remember your preferences
• Keep you logged in
• Cache data for offline use

8.1 Website Analytics

Our website (taylee.app) uses Plausible Analytics, a privacy-friendly analytics service. Plausible:

• Does not use cookies
• Does not collect personal data
• Does not track users across websites
• Collects only aggregate data (page views, referral sources, device type)

No consent banner is required as Plausible is compliant with UK GDPR and the Privacy and Electronic Communications Regulations (PECR) without collecting personal data.

8.2 Website beta sign-up

If you sign up for the beta at taylee.app, we collect your name, email address, postcode, phone type and how you heard about Taylee, through a form provided by Tally (Tally BV, Belgium), who process this data on our behalf. The form also records the page and campaign link that brought you to it. Sign-ups are stored in Airtable (Formagrid Inc, USA), who also process this data on our behalf; Section 6.3 sets out the safeguard for this transfer. We use these details solely to send your beta invite, to contact you about Taylee's launch and to understand where demand is coming from. Apple (TestFlight) sends iPhone invites to the email address you give us, using the name and email address you provide. For Android, we add your email address to our Google Play tester list and email you the opt-in link ourselves. We do not use these details for any other marketing unless you separately opt in. You can ask us to delete your sign-up details at any time by emailing privacy@taylee.app.

8.3 App Analytics

We use Google Analytics for Firebase to understand how the Taylee app is used, so we can improve it: which screens are viewed, which features are used (searches, plans created, activities saved, directions tapped), whether a search returned results, how long a request took, session length, onboarding progress, and app events such as errors.

This data is pseudonymous, not anonymous. Each event is linked to an identifier derived from your account id by one-way hashing (Google Analytics calls this the User-ID feature). It lets us see that the same account did several things over time; it does not let us read your name, email or postcode from the analytics data, and we do not send them to it. We do not use Google Analytics advertising features or Google Signals, and analytics data is not shared with Google for advertising or ad personalisation. Firebase Analytics also records the approximate area your connection comes from (the city or region, never a precise location). We do not combine this with your postcode, your children's details or anything you type, and we do not use it to identify you.

We have deliberately built our analytics so that it cannot see your family's personal information. The following are never sent to analytics: your children's names, their interests, additional support needs, or dietary information; their exact age (we record only a broad age band); the content of your messages or searches; your precise location, your postcode or your address; and any identifier linking analytics data to a specific child. This is enforced in our app by a filter that removes such data before anything is sent.

Google Analytics keeps this data for 14 months. A daily copy is exported to Google BigQuery, held in the London region, so we can run our own analysis. Google processes this data on our behalf under its Firebase, Google Analytics and Google Cloud data processing terms.

Our servers also keep a technical log of each request for 30 days, carrying the same hashed identifier, the type of request, timings and the cost of answering it. These logs never contain your message text, your postcode, your location or your children's names.

Deleting your account (Section 7.3) removes the link between you and these identifiers. Analytics records already exported are kept in pseudonymous form until the retention periods above expire.

8.4 Crash and Error Reporting

We use Firebase Crashlytics to detect and diagnose technical problems. When the app encounters an error, we record the type of error and where in the code it occurred. We do not send the content of your messages, your searches, or your children's details in crash reports.

9. Third-Party Links

Taylee may display links to venue websites or booking pages. We are not responsible for the privacy practices of these external sites.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• In-app notification
• Email (if you've opted in to communications)

The "Last Updated" date at the top indicates when changes were made.

11. Contact Us

For privacy-related enquiries or to exercise your rights:

We aim to respond to all requests within 30 days.

12. Additional Information for Scottish Users

Taylee is developed in Scotland. While UK GDPR applies throughout the United Kingdom, Scottish users may have additional rights under Scots law. If you have questions about your rights, please contact us.

This Privacy Policy is governed by the laws of Scotland and the United Kingdom.