Privacy Policy

1. Overview

TimTim (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy outlines how we collect, use, disclose, and protect personal and business information when you visit our website (https://mytimtim.com) or engage our services to design, build, and configure mobile applications for Shopify and WooCommerce.

2. Information We Collect

We collect information in the following ways:

• Information You Provide Directly: When you submit an inquiry form or communicate with us, we collect your name, email address, phone number, brand or company name, and store URL.
• Store Configuration & Assets: When building your mobile app, you provide brand assets (logos, color palettes, fonts) and authorized API credentials to connect with your Shopify or WooCommerce store. Authorized API credentials you provide are used only to connect your store to your app and are stored securely using industry-standard encryption, with access strictly restricted to authorized systems configuring your integration.
• Automatically Collected Data: When you navigate our site, we automatically log standard device and browsing information, including IP address, browser type, operating system, referring URLs, and interaction timestamps via analytics tools.

3. Merchant Store & Customer Data

4. How We Use Your Information

We use the collected information for the following business purposes:

• To evaluate, design, build, and configure your mobile application.
• To schedule onboarding and technical consultation calls via Calendly.
• To communicate project milestones, store reviews, and App Store / Google Play submissions.
• To process subscription payments and continuous app maintenance updates.
• To analyze website usage, measure marketing effectiveness, and prevent fraudulent activity.

5. Payment Processing & Merchant of Record

Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle handles billing, checkout transactions, currency conversion, sales tax/VAT calculations, invoicing, and refunds.

When you purchase a subscription through Paddle, Paddle acts as an independent data controller for your payment information and transaction records. We do not store, process, or have access to your full credit card numbers, CVVs, or sensitive financial credentials on our servers. All transaction processing adheres to strict PCI-DSS Level 1 compliance standards.

For full details on how Paddle collects and safeguards payment data, please review the Paddle Privacy Policy .

6. Third-Party Services & Recipients of Data

We share data only with select third-party service providers acting as processors or independent controllers to operate our platform:

• Paddle.com (Merchant of Record & Payment Gateway): Receives order, billing, customer name, email address, IP address, and transaction details strictly necessary to process subscription payments, calculate sales taxes, deliver invoices, and issue refunds.
• Google Analytics & Google Ads: We use cookies to collect aggregate traffic insights and track conversion performance. You can opt out of Google Analytics tracking through Google's opt-out browser add-on.
• Calendly: Used to schedule consultation meetings.
• Apple & Google Developer Platforms: You submit your apps through your own developer accounts. TimTim does not hold or store your Apple Developer or Google Play Console master account credentials; we provide you with the application binaries and guide you through publishing directly.

7. Data Retention & Security

We maintain appropriate technical and administrative safeguards to protect your business information against unauthorized access, loss, or alteration. We retain personal inquiry data only as long as necessary to fulfill the purposes outlined in this policy or comply with legal requirements.

Data may be processed in the United States, the United Kingdom, and countries where our development team and service infrastructure operate. For merchants and users in the UK and European Economic Area (EEA), our legal basis for processing personal data is the performance of our contract with you (GDPR Article 6(1)(b)) and our legitimate interest in delivering and maintaining secure mobile applications (GDPR Article 6(1)(f)). Where data is transferred internationally, we ensure appropriate safeguards are implemented, including standard contractual clauses.

8. Your Rights (GDPR & CCPA)

Depending on your location (including under UK GDPR, EU GDPR, and CCPA/CPRA), you may have statutory rights regarding your personal data, including:

• The right to access and receive a copy of your personal data.
• The right to request rectification of inaccurate or incomplete information.
• The right to request erasure (“right to be forgotten”) of your data from our systems.
• The right to object to or restrict processing of your information.
• The right to data portability.
• Right to complain to a supervisory authority: If you are located in the UK or EEA and believe that our processing of your personal data violates applicable data protection regulations, you have the statutory right to lodge a complaint with your competent supervisory authority (such as the UK Information Commissioner's Office (ICO) or your national Data Protection Authority in the EU).

To exercise any of these rights, please email us at support@mytimtim.com. We will respond to verified requests within one month of receipt, free of charge. In complex cases, this period may be extended by up to two further months with prior notice.