This Privacy Policy explains how Texty Technologies Ltd ("Texty", "we", "us", "our") collects and uses personal data when you use the Texty platform at texty.app, our payment pages, and related services (the "Service").
Texty is a company registered in England and Wales under company number 17274662, with its registered office at 102 Willmott Road, Sutton Coldfield, United Kingdom B75 5NW. We are registered with the UK Information Commissioner's Office (ICO) under registration number [ICO NUMBER].
Contact: [email protected]
Data protection contact: [email protected]
This policy is written for two groups of people:
We explain below what applies to each.
Data-protection law distinguishes between a controller (who decides why and how personal data is processed) and a processor(who processes data on a controller's behalf and instructions). Texty's role depends on the data:
(a) Merchant account data — Texty is a controller.
For the personal data of Merchants (and the individuals behind them) that we use to provide accounts, charge fees, run the platform and meet our legal obligations, Texty is the controller.
(b) Customer data entered by a Merchant — Texty is a processor for that Merchant.
When a Merchant enters a Customer's details (such as name, mobile number, email and invoice description) into the Service to send a payment request, the Merchant is the controller of that data and Texty acts as the Merchant's processor, processing it on the Merchant's instructions to deliver the Service. Our processing on the Merchant's behalf is governed by the data-processing terms in our Merchant Terms of Service.
(c) Customer data used for Texty's own purposes — Texty is a controller.
For certain narrow purposes — preventing fraud and abuse, securing and operating the platform, meeting our own legal obligations, and improving the Service — Texty is a controller of the relevant data, including some Customer data.
(d) Payment and identity data handled by Stripe — Stripe is a separate controller.
Payment processing and identity verification (KYC) are carried out by Stripe, which acts as a separate, independent controller (and/or processor under its own terms) for the data it handles, under its own privacy policy. Card details and verification data are handled by Stripe, not stored by Texty.
This policy describes the processing for which Texty is a controller. Where Texty is a Merchant's processor (point (b)), the relevant Merchant's own privacy notice governs how that Merchant uses the data, and Customers should refer to that Merchant for controller-level information.
2.1 From Merchants
2.2 From Customers
We do not intentionally collect special-category data (such as health data) through the Service, and ask that you do not submit it.
Where Texty is a controller, we rely on the following lawful bases under the UK GDPR:
| Purpose | Whose data | Lawful basis |
|---|---|---|
| Creating and operating Merchant accounts and providing the Service | Merchants | Performance of a contract |
| Processing payment requests and sending receipts | Merchants; Customers | Performance of a contract (Merchant); legitimate interests (delivering the payment the Customer is making, and sending the receipt) |
| Charging and collecting the Platform Fee | Merchants | Performance of a contract |
| Preventing, detecting and investigating fraud, abuse and security threats | Merchants; Customers | Legitimate interests (protecting the Service and its users); legal obligation |
| Meeting legal, regulatory, accounting and tax obligations | Merchants; Customers | Legal obligation |
| Operating, maintaining, securing and improving the Service, including analytics | Merchants; Customers | Legitimate interests (running and improving a secure, reliable service) |
| Communicating with you about the Service (service messages) | Merchants; Customers | Performance of a contract; legitimate interests |
| Sending marketing about Texty (where applicable) | Merchants | Consent or legitimate interests, as required by law — you can opt out at any time |
| Establishing, exercising or defending legal claims | Merchants; Customers | Legitimate interests |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and we will provide further detail on request. Where we rely on consent, you can withdraw it at any time.
We use a small number of necessary cookies and similar technologies to operate the Service and keep it secure, and we use analytics (currently Vercel Analytics) to understand how the Service is used. Where required by law, we will ask for your consent to non-essential cookies and you can manage your preferences. See our Cookie Policy.
We share personal data with:
We require our service providers to protect personal data and to use it only for the purposes we specify. We do not sell personal data.
Some of our providers may process personal data outside the UK. Where that happens, we ensure an appropriate safeguard is in place — such as the data being in a country covered by UK "adequacy" regulations, or the use of the UK International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses) together with any additional measures needed to protect the data. You can ask us for more information about the safeguards we use.
We keep personal data only for as long as necessary for the purposes described in this policy, including:
When data is no longer needed, we delete it or anonymise it. Where Texty holds Customer data as a Merchant's processor, retention is also subject to the Merchant's instructions and our agreement with the Merchant.
Under UK data-protection law you have rights to: access your personal data; have inaccurate data corrected; have data erased in certain circumstances; restrict or object to certain processing; data portability; and to withdraw consent where we rely on it. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except where permitted by law.
To exercise your rights, contact us at [email protected]. We will respond within the time required by law (usually one month). There is normally no charge.
Important: if your data was entered into the Service by a Merchant (so that the Merchant is the controller), we may need to direct your request to that Merchant or act only on the Merchant's instructions, and we will help you reach the right controller.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk, although we would welcome the chance to address your concerns first.
We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls and the security features of our providers (Stripe, Supabase and Vercel). No system is completely secure, but we work to protect your data and to respond promptly to any security incident.
The Service is for businesses and their customers and is not directed at children. We do not knowingly collect data from anyone under 18 as a Merchant.
We may update this policy from time to time. We will post the updated version with a new "Last updated" date and, where appropriate, notify you.
If you have any questions about this policy or how we handle your data, contact us at [email protected] or write to us at 102 Willmott Road, Sutton Coldfield, United Kingdom B75 5NW.