Privacy Policy

Tiny Tulip is responsible for personal data used to operate accounts, communicate with users, secure the platform and manage the service. You can contact us at the address or email listed below.

When an organisation uses the platform to upload or manage personal data about its staff, suppliers, customers or other people, that organisation normally decides why and how the data is used. In that situation, the organisation is the controller and Tiny Tulip processes the data on its instructions. Questions about that data should first be directed to the organisation that provided it.

Depending on how you use Tiny Tulip, we may handle:

• Account data: name, email address, account identifier, role, market membership and authentication records.
• Operational data: tasks, comments, feedback, procedures, approvals, run history, supplier contacts, orders, inventory and product records that you or your organisation enter or import.
• Files and media: documents, spreadsheets, images, attachments and scripts you upload or select from a connected service.
• Connection data: identifiers, permissions, access tokens and configuration needed to connect Amazon, Google, Claude or other services. Secret values are not intended to appear in ordinary activity logs.
• Technical and usage data: IP address, device and browser information, timestamps, requested pages, errors, security events and actions taken in the platform.
• Communications: messages, support requests and feedback you send to us.

We receive this data from you, your organisation, connected services you authorise and the devices or runner software used to access the platform.

• to create accounts, authenticate users and apply access permissions;
• to provide requested features and store, display, import or export operational records;
• to run workflows, scripts, integrations and human approval steps you configure;
• to maintain, troubleshoot, secure and improve the platform;
• to answer questions and send service, security and account communications;
• to prevent misuse, investigate incidents and enforce our terms; and
• to comply with legal obligations and establish, exercise or defend legal claims.

Where the GDPR applies, we rely on one or more of these legal bases:

• Contract: processing needed to provide the platform and respond to your requests.
• Legitimate interests: securing, maintaining and improving the service, supporting users and protecting our legal rights, balanced against your rights and expectations.
• Legal obligation: processing required by applicable law, court order or a valid regulatory request.
• Consent: where we specifically ask for it. You may withdraw consent at any time without affecting earlier processing.

When we process data for an organisation as its processor, that organisation determines the appropriate legal basis.

If you connect a third-party service, Tiny Tulip receives and sends data within the permissions you approve and according to the actions you request. For example, Google Drive may provide a selected inventory workbook, Google Calendar may receive scheduled work, Amazon may provide catalogue, inventory, sales and finance information, and Claude may exchange instructions and platform records through the connector.

Browser automations and Python scripts run through separate runner software on a computer controlled by you or your organisation. Inputs, status, output and error information may be sent between that runner and Tiny Tulip to complete and record a run. Scripts can access resources made available on that computer, so your organisation is responsible for the runner’s environment and the code it chooses to execute.

Third-party services process data under their own privacy policies. You can withdraw future access by disconnecting a service in Tiny Tulip and, where appropriate, in the third party’s account settings. Disconnecting does not automatically erase records previously imported.

We may share personal data only as needed with:

• authorised users and administrators in your organisation or workspace;
• hosting, storage, authentication, monitoring and other technology providers;
• services you choose to connect and recipients you direct us to contact;
• professional advisers where necessary for legal, financial or security matters;
• authorities or other parties when required by law or necessary to protect rights and safety; and
• a successor in a merger, reorganisation, financing or sale, subject to appropriate safeguards.

We do not sell personal data.

Some service providers or connected services may process data outside the European Economic Area. Where required, we use recognised safeguards such as an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism. Connected services you select may make their own international transfers under their policies.

We keep personal data only for as long as needed for the purposes described here. Account and workspace data is generally retained while the relevant account or service relationship is active. Operational records may be retained according to your organisation’s instructions and legitimate record-keeping needs. Security, audit, support and transaction records may be kept longer where reasonably necessary to prevent abuse, resolve disputes or meet legal obligations.

When data is no longer needed, we delete or anonymise it. Deletion from active systems may not immediately remove encrypted backup copies; those copies are isolated and expire through the normal backup cycle. You can ask about retention for a particular type of data by contacting us.

We use technical and organisational measures designed to protect personal data, including account authentication, role- and market-based permissions, access controls, encrypted network transport, protected file storage, activity records and restricted handling of credentials. We review and adapt safeguards as the platform changes.

No internet service can guarantee absolute security. Use a strong, unique password, protect authentication secrets, grant only necessary permissions and notify us promptly if you suspect unauthorised access.

Tiny Tulip uses cookies or similar browser storage that are necessary to sign you in, maintain your session, protect the service and remember essential settings. We may also collect limited diagnostic information to identify errors and understand service performance. We do not use the platform to serve third-party behavioural advertising.

Blocking necessary browser storage may prevent sign-in or other parts of the platform from working correctly.

Depending on where you live and the circumstances, you may have the right to access, correct, delete or restrict your personal data; object to certain processing; receive portable data; withdraw consent; and complain to a supervisory authority. These rights can be subject to legal limits and exceptions.

To make a request, email us at info@tinytulip.nl. We may need to verify your identity. If your data was provided by an organisation using Tiny Tulip, contact that organisation first; we will support it in responding where required.

In the Netherlands, you may complain to the Autoriteit Persoonsgegevens. You may also contact the supervisory authority in the EU or EEA country where you live or work. We encourage you to contact us first so we can try to address your concern.

Tiny Tulip can automate operational tasks based on rules and instructions chosen by users. We do not use your personal data to make solely automated decisions on Tiny Tulip’s own behalf that produce legal or similarly significant effects. Your organisation is responsible for the workflows it configures and for adding appropriate human review.

The platform is intended for business use and is not directed to children. Do not create an account or submit personal data if you are under 16. If you believe a child has provided data, contact us so we can investigate and remove it where appropriate.

We may update this policy when the platform, our practices or legal requirements change. We will publish the current version on this page and revise the effective date. If a change materially affects how we use personal data, we will take reasonable steps to notify account holders before it takes effect.

For the rules governing use of the platform, read our Terms of Service.