Privacy Policy

Last updated: April 25, 2026

Introduction

Tymbo is an event management platform operated by Duckino s.r.o. (Company ID: 07135254, VAT: CZ07135254), registered at Příčná 1892/4, 110 00 Prague 1 – Nové Město, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague. This privacy policy explains what personal data we process, on what legal basis, how long we retain it, and what rights you have.

Data We Collect

We collect only data necessary for the service to function:

  • Contact and login details — email address and name
  • Content you create — events, runbooks, activities, notes, and other content
  • Technical records — access logs and error logs for stability and security

How and Why We Use Your Data

We process your data under the following legal bases (Art. 6 GDPR):

  • Performance of contract (Art. 6(1)(b)) — providing and operating the Tymbo service and data synchronization
  • Legitimate interests (Art. 6(1)(f)) — security, fraud prevention, and service improvement
  • Legal obligation (Art. 6(1)(c)) — retaining records as required by law

Storage, Security, and Retention

Data is stored on secure servers within the European Union. All communication is encrypted using HTTPS/TLS. We retain data for active accounts for the duration of the contractual relationship. Upon account deletion, all data is permanently removed within 90 days. Operational logs are retained for a maximum of 90 days.

Data Processors and Recipients

We do not sell or share your personal data for marketing purposes. We use the following processors to operate the service: Resend (transactional email delivery), Stripe (payment processing), and infrastructure and monitoring providers with servers located in the EU. Each processor is bound by a data processing agreement. We share data with public authorities only when required by law.

Cookies and Sessions

We use a session cookie (HttpOnly, SameSite=Strict, 24-hour validity) and a refresh cookie (30-day validity) for authentication and session management. These cookies are functionally necessary for the service to operate and do not require your consent.

Your Rights

As a data subject, you have the following rights:

  • Access — the right to obtain a copy of your personal data (Art. 15 GDPR)
  • Rectification — the right to correct inaccurate or incomplete data (Art. 16)
  • Erasure — the right to delete your account and all associated data (Art. 17)
  • Portability and objection — the right to data portability and to object to processing (Arts. 20–21)
  • Complaint — the right to lodge a complaint with the Office for Personal Data Protection (www.uoou.cz)

Contact

The data controller is Duckino s.r.o. For privacy-related questions, contact us at info@tymbo.app.