GDPR — how TinyOrange handles personal data
How TinyOrange handles personal data, in one screen.
Who we are
TinyOrange is Edd Smith, trading as TinyOrange, in the UK. For anything about your data: tinyorange.cloud@gmail.com.
What we hold and why
Only what the apps need to do their job. Your name and email address, from your Google account, to sign you in. Whatever you and your business enter into an app to use it — jobs, checks, hours, invoices, books, notices, photographs. Nothing else, and nothing bought in.
Whose data it is
If you run a business on our apps, anything your team enters about your customers is yours. You decide what goes in and who in your business sees it; we keep it and never look at it. In GDPR terms you are the controller of that data and we are the processor. Your own account details (name, email) we hold as controller.
Where it is kept
In Google's cloud, in London. Our apps are built on Google Firebase; the database and your files live in Google's London region. A small live status feed used while a file is uploading runs in Google's Belgium region and carries no personal data beyond an account id. Google are a processor for us under their standard data-processing terms.
Who can see it
The people your business has added, with the role you gave them. TinyOrange staff can create and suspend a business's account and are blocked, by the access rules themselves, from reading or writing a business's data.
What we never do
Sell it. Use it for advertising. Email your customers. Train anything on it. Share it with anyone except Google, who host it.
How long we keep it
For as long as your account is active. Close your account, or ask, and it is deleted.
Your rights
You can ask to see what we hold about you, have it corrected, have it deleted, or have a copy to take elsewhere. Email us and it happens. If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk.
If something goes wrong
If we ever learn that your data has been exposed we will tell you, and the ICO where the law requires, within 72 hours.
Last updated 20 September 2026.