1. Introduction

This Privacy Policy explains how LPY Holdings ("we," "us," or "our"), operator of TinyTurns (https://tinyturns.co), collects, uses, shares, and protects your personal information when you use our Service. By using our Service, you consent to the practices described in this Privacy Policy.

2. Information We Collect

2.1 Information You Provide

We collect information that you voluntarily provide to us, including:

Account Information: Name, email address, username, password, and profile information
Content: Text, images, files, and other content you create, upload, or share through the Service
Communications: Messages you send to us, including support requests and feedback
Payment Information: Billing details and payment information (processed through third-party payment processors)
Profile Data: Optional information such as profile pictures, bio, preferences, and settings

2.2 Automatically Collected Information

We automatically collect certain information when you use our Service:

Usage Data: Pages visited, features used, time spent, click patterns, and interaction with content
Device Information: Device type, operating system, browser type, IP address, device identifiers
Location Data: General geographic location based on IP address
Cookies and Tracking Technologies: Information collected through cookies, web beacons, and similar technologies
Log Data: Server logs, error reports, and diagnostic information

2.3 Analytics Information

We use PostHog, a third-party analytics service, to collect and analyze:

User behavior and interaction patterns
Feature usage statistics
Performance metrics
Session recordings (when enabled)
Heatmaps and click tracking
User funnels and conversion data
Technical performance data

PostHog may collect and process data on our behalf. For more information about PostHog's privacy practices, please visit: https://posthog.com/privacy

2.4 Information from Third Parties

We may receive information about you from:

Social media platforms (if you connect your account)
Authentication services (if you use single sign-on)
Public databases and data providers
Business partners and affiliates

3. How We Use Your Information

We use the collected information for the following purposes:

3.1 Service Delivery

Provide, maintain, and improve the Service
Create and manage your account
Process transactions and send related information
Respond to your requests, questions, and support needs
Send service-related announcements and updates

3.2 Content Moderation and Safety

Analyze content using OpenAI: We use OpenAI's API to analyze user-generated content for:

Detection of prohibited content (including self-harm, violence, hate speech)
Spam and abuse prevention
Content quality assessment
Safety and security purposes

Enforce our Terms of Service and community guidelines
Detect and prevent fraud, abuse, and illegal activities
Protect the safety and security of users

Important Note about OpenAI:

When we send content to OpenAI for analysis:

Content is processed according to OpenAI's API data usage policies
OpenAI does not use API data to train their models (per OpenAI's API terms)
Data transmission is encrypted
We only send content necessary for moderation purposes
For more information, see OpenAI's privacy policy: https://openai.com/privacy

3.3 Analytics and Improvement

Analyze usage patterns and trends through PostHog
Understand how users interact with features
Measure effectiveness of features and campaigns
Conduct research and development
Generate aggregated, anonymized statistics

3.4 Communication

Send you technical notices and security alerts
Provide customer support
Send newsletters and promotional materials (with your consent)
Conduct surveys and gather feedback

3.5 Legal and Compliance

Comply with legal obligations
Enforce our Terms of Service
Protect our rights and property
Resolve disputes and prevent harm

3.6 AI-Generated Insights

Generate insights, recommendations, and content based on your usage

Important: Any insights generated by our Service are for informational purposes only and do not constitute professional advice (legal, medical, financial, or otherwise). Always consult qualified professionals for important decisions.

4. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

4.1 Service Providers

We share information with third-party service providers who perform services on our behalf:

OpenAI: For content analysis and moderation purposes
PostHog: For analytics and product improvement
Supabase: For database management, authentication, and data storage
Cloud Hosting Providers: For data storage and server infrastructure
Payment Processors: For processing transactions
Email Services: For sending transactional and marketing emails
Customer Support Tools: For managing support requests

All service providers are contractually obligated to protect your information and use it only for specified purposes.

4.2 Legal Requirements

We may disclose your information if required by law or in response to:

Court orders, subpoenas, or legal process
Government or regulatory requests
Investigations of potential violations
Protection of our rights, property, or safety
Emergency situations involving safety threats

4.3 Business Transfers

If we are involved in a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred to the acquiring entity.

4.4 With Your Consent

We may share your information with third parties when you explicitly consent to such sharing.

4.5 Aggregated Data

We may share aggregated, anonymized data that cannot identify you individually for research, marketing, or other purposes.

5. Data Retention

We retain your personal information for a minimum of 2 years and for as long as necessary to:

Provide the Service and maintain your account
Comply with legal obligations
Resolve disputes and enforce agreements
Achieve the purposes described in this Privacy Policy

Specific Retention Periods:

Account data: Retained while your account is active, plus a minimum of 2 years after account closure
Content: Retained while your account is active, with a minimum retention of 2 years
Analytics data (PostHog): Retained for a minimum of 2 years for analysis purposes
Moderation logs: Retained for a minimum of 2 years for safety and compliance
Legal and compliance records: Retained for a minimum of 2 years or as required by applicable law

You may request deletion of your data as described in Section 8, subject to our minimum retention requirements and legal obligations.

6. Data Security

We take reasonable measures to protect your information from unauthorized access, use, or disclosure. However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security and you provide information at your own risk.

7. Cookies and Tracking Technologies

7.1 Types of Cookies

We use the following types of cookies:

Essential Cookies: Necessary for the Service to function
Analytics Cookies: Used by PostHog to understand usage patterns
Functional Cookies: Remember your preferences and settings
Marketing Cookies: Track effectiveness of marketing campaigns (with consent)

7.2 Third-Party Cookies

PostHog and other service providers may set cookies on our behalf. These are governed by their respective privacy policies.

7.3 Cookie Management

You can control cookies through your browser settings. Note that disabling cookies may affect Service functionality. To opt out of PostHog tracking, you can:

Use our privacy settings (if available)
Enable "Do Not Track" in your browser
Visit PostHog's opt-out page

8. Your Rights and Choices

Depending on your location, you may have the following rights:

8.1 Access and Portability

Request access to your personal information
Receive a copy of your data in a portable format

8.2 Correction

Update or correct inaccurate information
Complete incomplete information

8.3 Deletion

Request deletion of your personal information (subject to our minimum 2-year retention period and legal retention requirements)
Close your account

8.4 Objection and Restriction

Object to certain processing activities
Request restriction of processing in certain circumstances

8.5 Withdraw Consent

Withdraw consent for processing based on consent (without affecting prior processing)

8.6 Marketing Communications

Opt out of marketing emails by clicking "unsubscribe"
Manage communication preferences in account settings

8.7 Do Not Track

We currently do not respond to Do Not Track signals, but you can use privacy settings to control tracking.

To exercise these rights, please contact us using the information in Section 13.

9. Children's Privacy

Our Service is not intended for anyone under 18 years of age. We do not knowingly collect personal information from individuals under 18. If we discover we have collected information from a minor without appropriate consent, we will delete it promptly. If you believe someone under 18 has provided us with personal information, please contact us immediately.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. We take appropriate measures to ensure your information receives adequate protection, including:

Standard Contractual Clauses approved by the European Commission
Privacy Shield frameworks (where applicable)
Other legally approved transfer mechanisms

11. Region-Specific Information

11.1 European Economic Area (EEA) and UK

If you are in the EEA or UK:

Our legal basis for processing includes consent, contract performance, legal obligations, and legitimate interests
You have additional rights under GDPR, including the right to lodge a complaint with a supervisory authority
Data transfers comply with GDPR requirements

11.2 California Residents

If you are a California resident:

You have rights under the California Consumer Privacy Act (CCPA)
We do not sell personal information
You can request disclosure of information collection and sharing practices
You have the right to non-discrimination for exercising your rights

11.3 Other Jurisdictions

Additional rights may apply based on your local laws. Please contact us for information specific to your region.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

Posting the updated Privacy Policy on our website with a new "Last Updated" date
Sending an email notification to registered users
Displaying a prominent notice within the Service

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after changes become effective constitutes acceptance of the updated Privacy Policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Email: lpyholdings@gmail.com

Company: LPY Holdings

Website: https://tinyturns.co

Response Time

We will respond to your request within 30 days or as required by applicable law.

14. Third-Party Links

Our Service may contain links to third-party websites or services. This Privacy Policy does not apply to those third parties. We are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party sites you visit.

15. Additional Information

15.1 PostHog Analytics Details

PostHog collects and processes the following data on our behalf:

User interactions and events
Session duration and frequency
Feature flags and A/B test data
User properties and custom attributes
Technical performance metrics

You can learn more about PostHog's data practices at: https://posthog.com/privacy

15.2 OpenAI Content Analysis Details

When content is analyzed by OpenAI:

Only content flagged for review or randomly sampled content is analyzed
Analysis is performed via API calls
OpenAI processes data according to their API terms
Data is not retained by OpenAI beyond processing requirements
Results are used solely for moderation and safety purposes

You can learn more about OpenAI's data practices at: https://openai.com/privacy

15.3 Supabase Infrastructure Details

Supabase provides our database and authentication infrastructure:

User account data and authentication credentials are stored securely
Data is encrypted both in transit and at rest
Supabase complies with SOC 2 Type II standards
Database backups are performed regularly
Access to data is controlled through strict security policies

You can learn more about Supabase's security and privacy practices at: https://supabase.com/privacy

By using our Service, you acknowledge that you have read and understood this Privacy Policy.