Privacy

• Tagline's pages have no analytics, no advertising and no tracking tools.
• The demo and the link auditor work in your browser. What you build or paste there is not sent to a server.
• If you make an account, Tagline stores your email address and what you save in your workspace, and other members of a workspace can see your email address.
• The only cookies are two that the services delivering the site set so that it works and stays secure.
• No data is sold, there are no ads and no marketing emails. The only emails are sign-in links.
• You can ask for your account and workspace data to be deleted by emailing tagline.privacy at gmail dot com.

Tagline is a free portfolio project run by Jonathan Burns, an individual rather than a company. I am the person responsible for your information under UK data protection law. You can contact me at tagline.privacy at gmail dot com.

Demo and link auditor: what you enter stays in your browser

The demo workspace and the link auditor run in your browser. What you build, paste or type in them is not sent to a server and I never see it. The demo keeps its data in your browser tab's session storage once you start using it, so it survives a reload and disappears when you close the tab. The auditor keeps the link you paste in the page's memory. If you choose "Open in builder", it is passed to the builder through your tab's session storage and removed as soon as the builder has read it.

Loading the pages themselves is different, as it is on any website: your browser asks the site's hosting provider for them, and the provider sees your IP address and browser details in the ordinary way (see "Who handles your data").

Accounts and workspaces: stored with the hosting providers

If you sign in, Tagline stores:

• your email address;
• a display name, which is the part of your email address before the @;
• the workspace name, its rules (approved sources, mediums and campaign fields) and its templates;
• the links you save, any notes you add, and who created each one;
• who belongs to each workspace, their role and when they joined.

Your email address is saved as soon as you submit it on the sign-in page, before you click the link in the email. If you are invited to a workspace, an account is created for your address straight away. Tagline does not ask for or store a password: you sign in with a link emailed to you.

Other members of a workspace can see the email address and name of every member, and every link saved there with the name of the person who made it and any note. Workspace admins can also see invitations: the email addresses invited and when. If someone invites you to a workspace, your email address is stored against that workspace until it is removed, and signing in with that address adds you to it.

I can see everything in the database, and the providers' staff could in principle. If you leave a workspace, or are removed from it, the links you made there stay, with your name on them, until they are deleted.

• Lovable hosts the site and runs its back end (Lovable Cloud).
• Supabase provides the database and the sign-in service behind Lovable Cloud. The account and workspace data above is stored there. When you sign in or use a workspace, your browser contacts Supabase directly, which sees your IP address and browser details and may keep its own technical records of sign-ins and requests.
• Cloudflare sits in front of the site as a network and security layer, so it sees requests to the site, including IP addresses.
• Lovable's built-in email service (part of Lovable Cloud) delivers the sign-in emails.

Your account data is stored in the EU (Ireland). Some providers may also process data outside the UK, including in the US. They rely on their own legal safeguards for international transfers, set out in their data-processing terms.

The site's fonts are served from the site itself, not from Google. Links to other sites, such as Buy Me a Coffee, only connect to those sites if you click them, and Tagline loads nothing from them. Apart from the providers above, I do not share your information with anyone, unless the law requires it.

Only to run the service: to sign you in, show you your workspace and let the people you invite use it. That is necessary to run the service for you, or for the workspace you were invited to. Tagline does not sell data, show ads or send marketing emails. The only emails it sends are sign-in links, including the ones sent when someone is invited to a workspace.

Tagline sets no cookies of its own and adds no analytics, advertising or tracking tools to its pages. The services that deliver the site keep ordinary request logs (see "Who handles your data"), and they set two cookies that the site needs to work and stay secure:

• __cf_bm: set by Cloudflare as bot protection, and lasts about 30 minutes.
• __dpl: set by the hosting platform to identify the version of the site you are using, and lasts 24 hours.

Both are set automatically to keep the site secure and serving the right version, so there is no cookie banner. Tagline does not use either of them for analytics or advertising. If you click a sign-in link, Cloudflare may also set its __cf_bm cookie on the sign-in service's own address (supabase.co).

In your browser's session storage, which is cleared when you close the tab, the demo keeps its data and the site remembers how far down each page you had scrolled, so that going back returns you to the same place. If you sign in, your sign-in session, which includes your email address, is kept in local storage so you stay signed in, along with the id of the workspace you last opened and whether you dismissed a message about Buy Me a Coffee. Signing out removes your sign-in session and the last workspace id. The Buy Me a Coffee flag stays until you clear this site's data in your browser.

Your information is kept until you ask for it to be deleted. A workspace admin can remove you from a workspace or delete links in it, but that does not delete your account or email address. Backups are kept for about 14 days.

To have your account and workspace data deleted, email tagline.privacy at gmail dot com. I will do it within a month. In a workspace shared with other people, I will remove your account and name from it and delete the links you made there; other members' work stays. If you are the only admin of a shared workspace, I will first ask another member to take over, or tell the members before the workspace is deleted. The providers' own technical logs and backups are outside my control and clear on their own schedule.

Under UK GDPR you can ask to see the information Tagline holds about you, have it corrected or deleted, ask for its use to be restricted, object to it being used, and ask for a copy you can reuse. Email tagline.privacy at gmail dot com and I will deal with it within a month.

If you are unhappy with how your information has been handled, please tell me first. You can also complain to the Information Commissioner's Office at ico.org.uk.

I update the date at the top whenever this page changes.