Privacy Policy

Controller and contact

The personal data controller for this landing page is currently the Tofu Script beta team.

If a formal company entity is added later, this Privacy Policy will be updated to include the company's registered legal name, registered address, and relevant registration details.

For privacy-related questions or requests, you can contact us at:

Email: [email protected]

Personal data we collect

When you submit the beta application form, we collect:

• your name;
• your email address;
• your optional preference regarding a follow-up interview;
• your acknowledgement of the Privacy Policy;
• the date and time of your privacy acknowledgement;
• the version of the Privacy Policy shown to you;
• your analytics preference state;
• relevant UTM and campaign parameters from the URL;
• the landing page path;
• the date and time of your submission.

Our hosting and infrastructure providers may also process limited technical information necessary to deliver, maintain, and protect the website. This may include IP addresses, request timestamps, browser or device information, and security logs.

We do not intentionally collect special categories of personal data, such as health information, biometric data, religious beliefs, or political opinions. Please do not provide this type of information through the beta form.

How we collect personal data

We collect personal data:

• directly from you when you complete and submit the beta application form;
• from the URL through which you access the landing page, including UTM parameters and the landing path;
• from your privacy and analytics choices on the website;
• through our hosting and security infrastructure where technical processing is necessary to operate and protect the website.

Why we use personal data

We use beta application data to:

• receive and review your beta application;
• respond to your request;
• select and contact potential beta participants;
• administer the closed beta;
• understand the types of production workflows that potential participants want to test;
• arrange an optional follow-up interview where you have indicated that you are interested;
• prevent spam, fraud, and abuse;
• maintain the security and reliability of the website and beta workflow;
• maintain a record of the privacy information and choices presented at the time of submission.

We record the analytics preference associated with a beta submission to maintain an accurate record of the privacy choice made by the applicant.

Legal bases

Depending on the purpose of processing, we rely on the following legal bases:

Steps taken at your request

We process your name, email address, and application information to receive, review, and respond to your beta request and to take steps at your request before entering into a possible service or beta relationship.

Legitimate interests

We rely on legitimate interests to:

• operate and administer the closed beta;
• understand potential participant workflows;
• communicate with applicants about their requests;
• prevent spam, fraud, and abuse;
• protect the website and associated systems;
• maintain appropriate operational, privacy, and consent records.

Our legitimate interests are operating a secure beta programme, evaluating interest in the product, improving the beta workflow, and protecting our services and users.

Required and optional information

Your name and email address are required so that we can review and respond to your beta application.

If you do not provide the required information, we will not be able to process your application.

Your preference regarding a follow-up interview is optional. Declining an interview or optional analytics does not prevent you from submitting a beta application.

Analytics and local storage

We do not currently use a third-party analytics provider. The website does not currently transmit page-view, click, scroll, form-interaction, or similar analytics events to an external analytics service.

If you select “Accept analytics”, the website records your preference in your browser. Under the current website configuration, no analytics events are transmitted to or stored by an external analytics provider.

Your privacy preference is stored in your browser's local storage so that the website can remember your choice and does not need to display the privacy banner on every visit. It remains in your browser until you clear the website's local data or the preference is replaced.

You can reset the preference stored in your browser by clearing the website's local storage or site data through your browser settings.

Before activating a third-party analytics provider, we will:

• update this Privacy Policy;
• identify the analytics provider;
• explain what information is collected;
• explain the purposes and legal basis of the processing;
• explain the applicable retention period;
• provide a way to change or withdraw your analytics choice where required.

Where data is stored

Beta application data is submitted to our website backend and stored in Cloudflare D1 and Google Sheets for the purpose of reviewing and managing beta applications.

Access to beta application data is limited to people who need it to administer the beta and related communications.

We do not sell or rent personal data.

Service providers and recipients

We use third-party service providers to operate the website and manage beta applications. These currently include:

• Cloudflare entities providing website infrastructure, security, backend, and Cloudflare D1 database services;
• Google entities providing Google Sheets and associated storage services.

These providers may process personal data on our behalf or as otherwise described in their applicable service terms.

We may also disclose personal data where required by law or where reasonably necessary to establish, exercise, or defend legal claims.

International transfers

Cloudflare and Google may process personal data in countries outside your country of residence or outside the European Economic Area.

Where GDPR restrictions on international transfers apply, we rely on the transfer safeguards made available under the relevant provider arrangements. These may include:

• an adequacy decision adopted by the European Commission;
• the European Commission's Standard Contractual Clauses;
• the EU–US Data Privacy Framework, where applicable;
• supplementary technical and organisational safeguards where required.

You may contact us to request further information about the safeguards relevant to the processing of your personal data.

Retention

We retain beta application data for no longer than 24 months from the date of submission, unless:

• you enter into an active beta, contractual, or business relationship with us;
• we are required to retain information to comply with a legal obligation;
• limited retention is necessary to establish, exercise, or defend legal claims;
• security or abuse-prevention information must be retained for a separately applicable period.

At the end of the applicable retention period, we delete or anonymise the relevant personal data.

Records of privacy acknowledgements and analytics preferences may be retained for as long as reasonably necessary to demonstrate what information and choices were presented at the time of submission.

Your rights

Subject to the conditions and limitations of applicable data protection law, you may have the right to:

• request confirmation of whether we process your personal data;
• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request deletion of your personal data;
• request restriction of processing;
• receive certain personal data in a structured, commonly used, and machine-readable format;
• object to processing based on legitimate interests;
• withdraw consent where processing is based on consent;
• lodge a complaint with a competent data protection supervisory authority.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

You can exercise your rights by contacting us using the email address provided in the “Controller and contact” section above.

We may request reasonable information to confirm your identity before responding to a request.

You are not required to contact us before submitting a complaint to a supervisory authority. However, you may contact us first so that we have an opportunity to address your concern.

Security

We use technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, disclosure, access, or destruction.

These measures include:

• encrypted transmission using HTTPS;
• access controls for Cloudflare and Google services;
• restricted access to beta application data;
• secure handling of credentials and secret keys;
• limiting access to people who need the information for beta operations.

No method of internet transmission or electronic storage can be guaranteed to be completely secure.

Changes

We may update this Privacy Policy. When we make changes, we will publish the updated version and revise the effective date at the top of this Privacy Policy. Where required, we will request new consent before beginning processing that is not covered by an existing valid consent.