Privacy Policy

Tuyyo (tuyyo.io) is operated by Wilber Ventura, doing business as Tuyyo, in Texas, United States. For the businesses that use Tuyyo we are the service provider for the client data they enter, and we are responsible for the account and billing data we hold about them. This policy goes with our Terms of Service.

• Business users — owners and team members who sign in to Tuyyo.
• Client-portal visitors — people who receive a quote or invoice from a business that uses Tuyyo and open it through a private link.
• Business card visitors — people who open a team member’s Tuyyo business card through its link or QR code and, if they choose, share their details through it.
• Website visitors — anyone reading tuyyo.io.

From business users

• Account: your name, email address, password (stored hashed by our sign-in provider; Tuyyo never stores it), your role, and the version and time you accepted our Terms and this policy.
• Business profile: business name, email, logo, brand color and default tax rate.
• The data you enter: clients and their contacts (names, emails, phone numbers, addresses), jobs and tasks, items and prices, quotes and invoices, payments you record, and the activity history of your account.
• Billing after the beta: your subscription plan and status. Your card is held by Stripe; Tuyyo never sees the card number.
• Stripe Connect: when you connect Stripe we store your Stripe account id and its status (whether charges and payouts are enabled). Identity, bank and tax details go directly to Stripe.
• Technical data: IP addresses, browser and device information in server logs, needed to run and secure the service.

From client-portal visitors

• The name, email address and phone number the business entered for you, and the documents sent to you.
• Whether and when you opened a document, and — if you approve a quote — the signature you draw together with the time, IP address and browser details, kept as the signing record.
• If you pay online: your card or bank details go straight to Stripe. Tuyyo receives the amount, the payment method type (card or bank) and the payment status.

From business card visitors

• What a team member puts on their business card (name, photo, job title, contact details, business) is public to anyone who has the card's link or QR code. Cards are not listed in search engines.
• If you use “Share your details” on a card: your name, your email address and/or phone number, your message and your permission to be contacted go to that business. The card's person and the people who manage the business's team see them.
• When our spam check confirms the share, it can be added to the business's clients by itself as a new lead — or, if your email and phone match a client the business already has, as a note on that client. Otherwise someone at the business decides whether to add it.
• To limit abuse we keep a one-way hash of your IP address for two days, and Cloudflare Turnstile checks that a person, not a bot, sends the form (Cloudflare sees your IP address and browser details for that check).
• To correct or delete what you shared, contact the business (its details are on the card), or contact us and we will help or pass your request on.

From website visitors: standard server logs only. tuyyo.io runs no analytics or advertising trackers during the beta.

• To run the service: show you your data, calculate totals, send the quotes, invoices and reminders you ask us to send (by email, and by text where enabled), and notify you when a client views, signs or pays.
• To process payments through Stripe and, after the beta, to bill your subscription.
• To keep Tuyyo secure, prevent abuse and fix problems.
• To talk to you about your account, the beta and important changes. We do not send marketing email without asking first, and you can opt out at any time.
• To comply with the law.

We do not sell personal information, we do not show ads, and we do not use your data to train AI models.

These companies process data on our behalf to run Tuyyo (our subprocessors):

• Stripe: when a business connects Stripe, we share its business details and transaction data with Stripe so Stripe can run the connected account, and Stripe processes payment data under its own Privacy Policy.
• The business you deal with: everything a business enters or receives in its account is visible to that business and its team.
• Legal requests: we disclose data when the law requires it, for example a valid court order.
• A successor: if Tuyyo is sold or merged, data moves with it under this policy; we would tell you first.

• The business you are dealing with decides what information to enter about you and is responsible for it; Tuyyo processes it on the business's behalf. To correct or delete your details, contact the business — its reply-to address is on every email it sends you. You can also contact us and we will help or pass your request on.
• Portal links are private links: anyone who has the link can open the document, so do not forward it. Links expire after a while and the business can send a fresh one.
• Paying online: your card or bank details go directly to Stripe; Tuyyo never sees or stores them.
• Signing online: by approving a quote you agree to sign electronically; the signature and its record are kept for the business as proof of approval.

Tuyyo uses only the cookies needed to keep you signed in, and a small amount of browser storage for preferences such as light or dark mode. The client portal and tuyyo.io set no tracking or advertising cookies, so there is no cookie banner. Stripe’s hosted checkout and onboarding pages set their own cookies under Stripe’s policy.

• While your account is active, for as long as you need it.
• After you close your account or ask us to delete it, we delete or anonymize your data within 90 days — except what we must keep for tax, accounting, payment-dispute and legal reasons (for example payment and signing records), and encrypted backups, which expire on their own schedule.
• Server logs are kept for a limited time and then discarded.
• Details shared through a business card: once the business adds or dismisses a share, it leaves the card's list 90 days later; a share nobody has handled is deleted after a year unless the business keeps it (a year at a time). What the business adds to its clients is kept as its client data, like anything else it enters.

Data is encrypted in transit and at rest by our providers. Each business’s data is isolated by database access rules, so one business can never read another’s. Card and bank details are handled by Stripe, a PCI DSS Level 1 provider; Tuyyo never stores them. Access to production systems is limited to the operator. No system is perfectly secure; if a security incident affects your data we tell you as the law requires.

You can see and change most of your data in the app. You can also ask us to access or export your data, correct it, delete your account and its data, or stop a particular use. Contact us (below) and we answer within 30 days. Depending on where you live you may have specific legal rights; we honor valid requests regardless of where you live, and we never treat you differently for making one.

Tuyyo is for businesses and is not directed at anyone under 18. We do not knowingly collect information from children.

Tuyyo is operated from the United States and your data is stored there by the providers listed above. If you use Tuyyo from somewhere else, your data is processed in the United States.

We update this policy as Tuyyo grows — the version and date are at the top of this page. For material changes we tell you by email or in the app before they take effect.

Questions or a privacy request? Email us at support@tuyyo.io. We read every message.

Operator: Wilber Ventura, doing business as Tuyyo, Texas, United States.