Effective 2026-09-30
Ambient Labs Computing, LLC ("we", "us", or "our") operates Tilly. This Privacy Policy explains what information we collect, how we use it, and the choices you have.
We collect: (1) account information you provide, such as your name, email address, and phone number, and sign-in details handled by our authentication provider; (2) business and client data you enter into Tilly, including your business profile, services and prices, availability, your clients’ names and contact details, appointments, notes, tags, and messages exchanged with clients; (3) payment-related information for bookings and subscriptions — we do not store payment card numbers ourselves, and only keep identifiers and status returned by our payment providers; (4) information from your device such as push notification tokens, IP address, and browser or device type, used to operate and secure the service; and (5) usage and marketing data, described under Analytics below. If you use Tilly on behalf of your clients, you are responsible for having the right to give us their information, and we process it to provide the service to you.
We use collected information to provide and improve Tilly, communicate with you about your account or updates, maintain the security and integrity of the service, and comply with legal obligations.
The Tilly application uses self-hosted Umami to record product usage events (for example, which screens are opened and which actions are completed) and self-hosted GlitchTip to record errors (the error message, page address, and basic browser or device details). These services run on infrastructure we operate, use pseudonymous identifiers rather than your email address or name, and do not receive the content of your clients, notes, or messages. On our public marketing pages, if you click “Accept” on the cookie banner, we also load Meta Pixel, Google Ads conversion tracking, and our own internal tracker to measure how visitors reach and use our site and to show relevant ads; these tools may set cookies or similar identifiers and receive information such as pages viewed, referral source, and campaign parameters. If you click “Decline,” these marketing tools are not loaded, and you can change your choice at any time by clearing this site’s data in your browser. We do not sell your personal information.
We share information only with service providers who help us operate Tilly, each acting on our behalf: Auth0 (authentication and sign-in), Square and Stripe (payment processing and billing), Twilio (sending and receiving SMS messages), Mailgun (sending and receiving email), Anthropic (processing text, and photos you upload such as a price list, to power Tilly’s AI assistant and service-import features, only the content needed for the request), Expo and the Apple and Google push notification services (delivering push notifications), and Cloudflare (hosting, storage, and content delivery). If you accept marketing cookies, Meta and Google also receive the marketing data described above. We otherwise share information only when required by law, to protect our rights, or with your consent. We do not sell your personal information.
We retain your account and business data, including client records and appointments, for as long as your account remains active and as needed to provide Tilly, comply with legal and tax obligations, resolve disputes, and enforce our agreements. When we process a verified deletion request (see Account Deletion below), we delete or anonymize the associated personal data, except for records we must keep for legal, tax, or accounting purposes (for example, payment records held by Square and Stripe under their own obligations). Copies may persist briefly in routine backups until those backups are cycled out.
Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise any of these rights, email us at hello@tillycrm.com from the address on your account so we can verify your identity. If a client of yours wants to access or delete information you hold in Tilly, please direct the request to that business; we will assist the business in responding.
You can delete your Tilly account yourself at any time: in the mobile app, go to More → Delete account; on the web, go to Admin → Profile → Delete account. Instructions are also available at https://www.tillycrm.com/delete-account. Deletion is immediate. We delete your account and sign-in, device registrations and provider profile, and, if you are the only member of your business, the business and its client, appointment and settings data, and we cancel any paid subscription. If you own a business that still has other members, you must remove them or transfer ownership first. We may retain (a) records that payment providers retain under their own obligations and (b) information we must keep to comply with law or resolve disputes. If you cannot sign in, email hello@tillycrm.com from the address on your account and we will delete it for you.
We use safeguards to protect your information, including encrypting data in transit with HTTPS/TLS, delegating authentication to Auth0, verifying webhook signatures from payment and messaging providers, and restricting access to production systems and data to authorized personnel. Payment card details are handled directly by our payment providers and do not reach our servers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Tilly is a business tool for salon and beauty professionals. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us at hello@tillycrm.com so we can remove it.
We may update this Privacy Policy from time to time. We will post the updated version here with a new effective date.
If you have questions about this Privacy Policy, contact us at hello@tillycrm.com.