Privacy Policy

1. Who we are

Spatial Regal Digital Ltd is the controller for account, billing, and website data. For customer traffic that transits The Crown, The Keep, and Portcullis, we act as a processor under the Data Processing Addendum.

As a Ghanaian controller we keep the registration required by the Data Protection Act, 2012 (Act 843): a data controller must register with the Data Protection Commission before processing personal data (sections 46 to 56), and registration is renewed every two years (section 50).

Contact privacy at privacy@tinyzipper.com.

2. Data we collect

Account data: name, email, hashed password or SSO claims, workspace membership, plan, and payment tokens handled by our payment processor.

Service data: hostnames, DNS records, WAF rules, Portcullis site keys, and configuration you store in the dashboard.

Edge telemetry: request metadata (IP, user-agent, JA3/JA4-class fingerprints, path, status, cache outcome), Portcullis challenge outcomes, and security events. We do not store full origin response bodies in Watchtower by default.

Widget signals: timing, proof-of-work solution, and coarse interaction signals used only to issue or deny a Portcullis token.

The Service is for organisations and adults: you must be at least 18 to hold an account, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, write to privacy@tinyzipper.com and we will delete it.

3. Why we process it

To authenticate you, provision named services, deliver and protect customer sites, prevent abuse, bill plans, and improve reliability. Legal bases include contract, legitimate interests in securing a multi-tenant network, and consent where required for optional cookies.

4. Sharing

We share data with subprocessors listed at /legal/subprocessors, with authorities when legally compelled, and with you (the tenant) for your own logs. We do not sell personal data.

5. Retention and rights

Account data is kept for the life of the workspace plus 30 days. Security logs are kept 7–90 days depending on plan. You may request access, correction, deletion, restriction, portability, or export via privacy@tinyzipper.com, and we answer verified requests without undue delay — within one month where the GDPR applies. Where we rely on legitimate interests you may object to that processing.

We do not sell personal data or share it for cross-context behavioural advertising. If you are in California, you may exercise the rights the CCPA gives you (to know, delete, and opt out) at the same address. Unhappy with an answer, you can complain to your regulator — in Ghana, the Data Protection Commission; elsewhere, your local supervisory authority.

6. International transfers

Edge nodes may process request metadata in the region closest to the visitor. Account data for this deployment is stored in the region configured for the project. Transfers rely on the contractual clauses in the DPA, which govern them wherever the GDPR or Act 843 applies.

7. Breach notification

If we become aware of a personal data breach, we notify the Data Protection Commission of Ghana without delay and, where feasible, within 72 hours of becoming aware, and we notify affected individuals where the breach poses a real risk to their rights and freedoms. Where the GDPR applies to a breach, we notify the competent supervisory authority within 72 hours when the breach is likely to result in a risk to people (Article 33), and we notify you as our customer without undue delay so you can meet your own duties.

8. When the law changes

This policy states the law as at 12 November 2026. Two changes are in motion and are not yet law: Ghana's Data Protection (Amendment) Bill would replace Act 843 with higher penalties, mandatory data protection impact assessments, privacy by design and default, and duties around biometrics, online identifiers, cross-border transfers, and AI; and the EU's Digital Omnibus — the Council agreed its position on 21 October 2026, but Parliament has not — would amend the GDPR and the cookie rules.

Until both are enacted, Act 843 and the GDPR (including the 72-hour breach rule) continue to apply unchanged. We update this policy when the law moves, and post material changes with a new “Last updated” date.