This policy explains what personal data is collected on tinwell.org, why, how long it is kept and what your rights are. tinwell.org is run by Nebula Design, a trading name of Nebula IT Services Limited (“Nebula”, “we”, “us”), a company registered in England and Wales under company number 08323677, whose registered office is at Building 2 Riverside Court, Chipping Sodbury, Bristol, BS37 6JX. Nebula is the data controller for the personal data described here. If you have a question about this policy or your data, email info@nebula.design.
Last updated: 14 October 2026.
What this policy covers
It covers this website, the interactive demo of the Tinwell plugin, the launch-day email list and the licence checkout. It does not cover what happens on a charity’s own website that uses the Tinwell plugin. There, the charity is the data controller for its donors’ data and its own privacy notice applies. Tinwell stores donations and donor records in the charity’s own WordPress database, and Nebula does not receive donor data from charities’ websites.
Data we collect and why
Visiting the site
Our hosting provider keeps standard server logs (IP address, browser type, the pages requested and the time) to keep the site secure and running. Our legal basis is our legitimate interest in running a secure website.
If you opt in through the cookie banner, we use Google Analytics to understand how the site is used, such as which pages are read and how people arrive. Google Analytics sets cookies and processes your IP address to estimate your general location; we do not use it to identify you. If you opt out, or make no choice, Google Analytics does not load at all. Our legal basis is your consent, which you can withdraw at any time from the cookie settings link at the foot of this page.
Joining the launch-day list
If you give us your email address on the coming-soon page, we keep it so we can email you once when Tinwell launches. Our legal basis is your consent. You can ask us to remove you at any time.
Getting the Ledger by email
If you subscribe to the Ledger, our release notes and articles, we keep your email address, whether you asked for release notes only, and when you signed up and confirmed. We email you a link to confirm first, and only email you about new Ledger posts after you click it. Every email has a one-click unsubscribe link. Our legal basis is your consent, which you can withdraw at any time by unsubscribing or emailing us.
Requesting the demo
To view the interactive demo you give us your email address. We email you a link, record that the address asked for a link and, when the link is opened, that it was used, along with the page you asked from. Opening the link sets a cookie on your device for one day so you are not asked again. We keep the email address in our list of demo requests and may email you about Tinwell; you can ask us to stop at any time. Our legal basis is your consent, which you give when you request the link, and our legitimate interest in following up a request for a product demonstration.
Buying a licence
At the checkout we collect your name, your organisation, your email address and your billing address. If you buy more than one licence, we also collect the website, organisation, contact name and email address for each licence, so the right person receives each licence key. Card details are entered directly into Stripe’s secure payment fields and never reach our servers. We keep order records, including invoices, for as long as the law requires for tax and accounting purposes. Our legal basis is the performance of our contract with you, and our legal obligations.
Licence checks
When Tinwell is installed on a website, the plugin checks its licence key with our licence service at licence.nebula.design so that updates and support can be switched on. This check identifies the licence and the website it is used on; it does not include any donor or donation data. Our legal basis is the performance of our contract with the licence holder.
Support and enquiries
If you email us, we keep the correspondence for as long as we need to deal with your enquiry and for a reasonable period afterwards, so we have a record of what was agreed. Our legal basis is our legitimate interest in responding to you, or the performance of a contract if you are a customer.
Cookies and similar technologies
When you first visit, a banner asks whether you are happy for us to use analytics cookies. Nothing optional runs until you choose, and you can change your mind at any time with the cookie settings link: Cookie settings
These are the cookies and stored items the site uses:
- Your cookie choice (airlock_consent): remembers whether you opted in or out, for six months. It is needed to respect your choice, so it does not need consent.
- Demo access (tinwell_demo and tinwell_demo_ok): set only if you open a demo link, for one day, so the demo pages let you in. It is needed for the service you asked for.
- Google Analytics (_ga and _ga_*): set only if you opt in, to tell visits apart. They last up to two years unless you clear them or opt out, and opting out removes them.
- WordPress login cookies: set only for our own staff when they sign in to manage the site.
- Your basket: the licences in your basket are kept in your browser’s local storage, not in a cookie, and are not sent to us until you go to the checkout.
Full details of the analytics cookies:
Who we share data with
We use a small number of service providers to run the site, each of which processes personal data only on our instructions or under its own terms as an independent controller where that applies:
- Stripe, to take payment, run the yearly subscription and issue invoices. Stripe’s own privacy policy also applies to the card payment.
- Brevo, which delivers the emails the site sends, such as demo links, Ledger updates, order confirmations and licence keys.
- Google, for Google Analytics, only if you opt in.
- Our web hosting provider, which hosts the website and its database.
- Professional advisers, and authorities where the law requires us to share data.
We do not sell personal data, and we do not use it for advertising.
Some of these providers process data outside the UK, for example in the European Economic Area or the United States. Where they do, the transfer is covered by UK adequacy regulations (including the UK extension to the EU-US Data Privacy Framework where the provider is certified) or by the International Data Transfer Agreement or the UK addendum to the EU standard contractual clauses.
How long we keep it
- Launch-day email addresses: until we send the launch email, then deleted unless you also asked for the demo or bought a licence.
- Demo requests: up to two years after your last contact with us, or sooner if you ask.
- Ledger email subscriptions: until you unsubscribe; unconfirmed sign-ups are removed after 30 days.
- Orders, invoices and licence records: six years after the end of the financial year they relate to, as UK tax law requires, and for as long as the licence is active.
- Support emails: up to two years after the enquiry is resolved.
- Google Analytics data: for the retention period set in our Google Analytics account, which is no longer than 14 months.
- Server logs: for the period set by our hosting provider for security purposes, after which they are deleted automatically.
- The cookie consent record (which choice was made and when, without your IP address): for as long as we need to show that consent was given.
Your rights
Under UK data protection law you can ask for a copy of the personal data we hold about you, ask us to correct it or delete it, object to or ask us to restrict our use of it, ask for it in a portable format, and withdraw consent at any time where consent is our legal basis. To use any of these rights, email info@nebula.design. We will reply within one month. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk, although we would appreciate the chance to put things right first.
Changes to this policy
We will post any changes on this page and update the date at the top. If a change affects how we use data you have already given us, we will tell you by email where we can.