Welcome to TunedBooks. We are committed to protecting your privacy and the security of your personal and business information. This Privacy Policy applies to all users globally and complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Nigeria Data Protection Act (NDPA) 2023, and applicable international data protection laws.

Information You Provide

• Account information: full name, email address, phone number
• Business details: business name, address, business type and sector
• Tax identifiers: VAT Registration Number (VRN), National Insurance Number (NINO), Tax Identification Number (TIN)
• Business records: transactions, sales, purchases, expenses, customer data, inventory, financial summaries
• Payment information: processed by Apple, Google, Paystack, or Stripe- we do NOT store full card details
• Communications: messages sent through customer support, feedback, and survey responses

Information Automatically Collected

• Usage data: log-in times, features used, pages visited, time spent in app
• Device information: device type, operating system, unique device identifiers, IP address
• HMRC OAuth tokens (only once MTD submission is available and you connect HMRC): secure access tokens allowing us to submit to HMRC on your behalf (never your HMRC password)
• Fraud prevention data (only once MTD submission is available and you connect HMRC): device ID, OS version, screen size, timezone, local IP address- required by UK law (Finance Act 2020) to be sent to HMRC with every API call

We process your personal data under the following lawful bases:

Specifically We Use Your Data To

• Create and manage your account
• Provide business management, invoicing, and record-keeping features
• Once HMRC grants production access, submit Making Tax Digital VAT returns to HMRC on your behalf (UK users; not yet available)
• Generate invoices with the fields FIRS requires (Nigerian users)
• Process your subscription payments
• Send important service updates, security alerts, and notifications
• Analyse app usage to improve features and fix technical issues
• Detect and prevent fraud and security threats
• Comply with legal obligations in applicable jurisdictions

TunedBooks is not yet HMRC recognised. Our Making Tax Digital VAT submission is going through HMRC's approval process and will be switched on for customers once production access is granted. No data is sent to HMRC today.

Once submission is switched on and you choose to connect TunedBooks to HMRC, the following will apply in addition to the rest of this policy:

What We Will Do

• Submit VAT returns to HMRC on your behalf via OAuth 2.0
• Store a secure OAuth 2.0 access token so you stay connected to HMRC between sessions
• Send fraud prevention headers to HMRC as required by the Finance Act 2020
• Maintain a secure audit log of all HMRC submissions in your account

What We Never Do

• Store your HMRC username or password- ever
• Access more HMRC data than you explicitly authorise via the OAuth consent screen
• Submit returns to HMRC without your explicit confirmation in the app

This section applies to TunedSupport, our customer support platform. TunedSupport gives businesses one shared inbox for customer conversations from WhatsApp Business, Instagram Direct and Facebook Messenger. It is operated by Tuned Digital Solutions Limited (RC 9022196). We also use TunedSupport as the in-house support desk for TunedBooks customers.

Our Role

When a business connects its WhatsApp Business number or Facebook and Instagram Page to TunedSupport, that business is the data controller for its customer conversations. Tuned Digital Solutions Limited acts as a data processor, handling those conversations only on the business's instructions and only to provide the TunedSupport service.

Data We Receive From Meta Platforms

• Messages sent by customers to the business's connected WhatsApp Business number, Instagram account or Facebook Page, including text and any attachments they send
• The sender's name or profile name, and the phone number or platform account ID they messaged from
• Message status information such as delivered and read
• The business's WhatsApp Business Account, Page and Instagram account identifiers, and the access token granted through Meta's login

How We Use It

• Only to receive, store and display conversations to the support agents of the business that owns them
• To send agents' replies back to customers on the business's behalf
• To keep the service secure and working, for example detecting failed message deliveries

Each business can only see its own conversations. Data from one business is never shown to, or combined with, another business's data.

Connecting and Disconnecting

Businesses connect their own accounts through Meta's secure login and only grant the permissions shown on Meta's consent screen. A business can disconnect at any time from its TunedSupport settings or by removing TunedSupport's access in Meta Business settings. When a business disconnects, we stop receiving its messages immediately and delete the stored access token.

Retention

• Conversation data: kept while the business's TunedSupport account is active and its accounts are connected
• After disconnection or account closure: conversation data deleted within 30 days
• Access tokens: deleted immediately on disconnection
• Backups: overwritten within 30 days of deletion from the live system

Legal Basis and Your Rights

We process this data to perform our contract with the business that subscribes to TunedSupport. We comply with the Nigeria Data Protection Act (NDPA) 2023 and UK GDPR. You have the rights described in the "Your Rights" section of this policy, including access, correction and deletion, and you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng) or the UK Information Commissioner's Office (ico.org.uk).

What We Send

When enabled, we send push notifications for:

• New orders from Chowdeck marketplace
• New orders from Shopify store
• New orders from eBay listings
• Account security alerts
• Service updates and announcements

Data Collected for Notifications

• Device identifier (token)- used only to target your device
• Notification preferences (which services enabled)
• Notification interaction data (read/unread status)
• Device type, OS version (for Firebase Cloud Messaging)

How to Disable

• In-app: Go to Settings → Notifications → Toggle off services
• Device-level: Settings → [Your App] → Notifications → Turn Off

Shared With

• Firebase Cloud Messaging (Google)- for delivery
• Apple Push Notification service (Apple, iOS only)- for delivery
• Chowdeck, Shopify, eBay- order data only

We Share Data Only With

• HMRC- once MTD submission is available, tax submissions made on your behalf with your explicit authorisation (UK users)
• FIRS- via official e-invoicing systems where applicable (Nigerian users)
• Google/Firebase- cloud infrastructure provider under a Data Processing Agreement (DPA)
• Apple/Google- subscription payment processing under their own privacy policies
• Paystack- payment processing for Nigerian users under a DPA
• Stripe- payment processing for web/global users under a DPA
• Legal authorities- only when required by UK, Nigerian, or other applicable law, with notice to you where permitted

Your business data is highly sensitive. We implement industry-leading security measures:

Retention Periods

• Active account data: retained while your account is active
• Financial and transaction records: 7 years after account closure (UK and Nigerian tax law requirement)
• HMRC submission audit logs (once MTD submission is available): 7 years (HMRC requirement)
• HMRC OAuth tokens: until you disconnect or your account is deleted
• Support communications: 3 years
• Marketing consent records: until withdrawn or 2 years of inactivity
• Deleted accounts: personal profile data deleted within 30 days; financial records retained 7 years for legal compliance

Depending on your location, you have the following rights over your personal data:

UK Users- Rights Under UK GDPR

• Right to access- request a copy of your personal data
• Right to rectification- correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten")- request deletion (Settings → Delete Account, or see how to delete your TunedBooks account)
• Right to data portability- export your data in machine-readable format (Settings → Export Data)
• Right to object- object to processing for direct marketing
• Right to restrict processing- limit how we use your data in certain circumstances
• Right to withdraw consent- once MTD submission is available, disconnect HMRC at any time (Settings → HMRC Connection → Disconnect)
• Right to lodge a complaint with the ICO: ico.org.uk | 0303 123 1113

Nigerian Users- Rights Under NDPA 2023

• Right to access your personal data
• Right to correction of inaccurate data
• Right to deletion of your data (Settings → Delete Account, or see how to delete your TunedBooks account)
• Right to data portability (Settings → Export Data)
• Right to object to processing
• Right to lodge a complaint with the NDPC: ndpc.gov.ng

To exercise any right, contact us at privacy@tunedbooks.online. We will respond within 30 days.

TunedBooks uses Google Cloud Platform (Firebase) infrastructure. Your data may be processed in the following locations:

Data Processing Locations

• United States- Google Cloud us-central1 (primary server location)
• Nigeria- NDPC-compliant processing for Nigerian users

Types of Cookies We Use

• Essential cookies: required for login, security, and core functionality
• Performance cookies: track feature usage and app performance to improve the service
• Functional cookies: remember your preferences such as dark mode and language

We do not use advertising or third-party tracking cookies. You can manage cookies in Settings → Privacy or in your device/browser settings.

In the event of a personal data breach, we will:

For UK Users

• Notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware
• Once connected to HMRC's production systems, notify HMRC within 72 hours via the HMRC developer support portal
• Notify affected users without undue delay where the breach poses a high risk to your rights

For Nigerian Users

• Notify the Nigeria Data Protection Commission (NDPC) within 72 hours as required by NDPA 2023
• Notify affected users as required by law

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes via email and in-app notification at least 30 days in advance. Minor changes will be reflected in the "Last Updated" date above. Continued use of TunedBooks after the effective date constitutes acceptance.