Privacy Policy
What FISH WITH THE MOON LTD collects when you use TanStarter Demo, why, and what you can do about it
Version 1.0 · Last updated 2026-08-13
1. Who is responsible for your data
FISH WITH THE MOON LTD is the data controller for the personal data described in this policy. Our registered office is Suite 13512, 61 Bridge Street, Kington, United Kingdom, HR5 3DJ.
For anything to do with privacy, including any of the requests in section 12, write to us at support@example.com.
We are established in the United Kingdom, so our lead supervisory authority is the Information Commissioner's Office (ICO).
2. What this policy covers
This policy covers the personal data we process when you visit tanstack-template.fishwiththemoon.uk, create an account, buy from us, or contact us. It applies to the website at https://tanstack-template.fishwiththemoon.uk and to the services we deliver through it.
It does not cover the sites of the third parties we link to, or the checkout and customer portal pages hosted on our payment provider's own domains. Those are governed by their own policies, which are linked from the table in section 7.
3. What we collect
We collect only what we need to run the service. We do not buy personal data from data brokers, and we do not build advertising profiles.
Account data
Your email address, your name if you give us one, your password in hashed form, and, if you sign in with Google, the basic profile information Google returns to us (your name, email address and profile picture). We also record when your account was created, when you last signed in, and which sessions and API keys are active.
Files you upload
The files you upload, together with their file names, sizes, types and the time they were uploaded. We do not inspect the contents of your files except where we are required to by law or where we are investigating a report of abuse.
Billing data
Which plan you are on, your subscription status and dates, your order and invoice records, the amounts charged, and the billing details our payment provider passes back to us, such as your billing country and the last four digits and brand of your card.
We never see or store your full card number, expiry date or security code. Those go directly to our payment provider, which is certified to the PCI DSS standard.
Credit balance and credit history
Your current credit balance, and one record per credit batch showing where it came from, how many credits it contained, when it expires, how many remain, and what each spend was used for. This history is what makes the rules in section 5A of our Terms of Service checkable by you.
Technical and security data
Your IP address, your browser and device type, the pages you request, and the time of each request. Requests reach us through Cloudflare's edge network, which processes your IP address in order to route the request, apply rate limits and block attacks. We use this data to keep the service available and secure, and to investigate abuse.
AI inputs and outputs
The text, images and other content you submit to an AI feature, and the output generated from it. See section 6.
Messages you send us
If you use the contact form or email us, we receive your name, your email address and the content of your message, along with anything else you choose to include.
Newsletter subscription
If you subscribe, we record your email address, the date you subscribed and your subscription status with our newsletter provider.
What we do not collect
We do not ask for and do not want special category data, such as data about your health, race, religion, political opinions, sex life or biometrics. Please do not send it to us.
4. Our legal bases
Under the UK GDPR we must have a legal basis for every use of your personal data. This is the pairing, use by use.
| What we do | Why | Legal basis |
|---|---|---|
| Create and maintain your account | To provide the service you signed up for | Performance of a contract |
| Process payments and keep invoices | To complete your purchase and meet tax law | Contract; legal obligation |
| Detect and prevent abuse | To keep the service available and secure | Legitimate interests |
| Measure how pages are used | To improve the product | Consent |
| Send you service emails such as email verification and password resets | To let you use and recover your account | Performance of a contract |
| Store and serve the files you upload | To provide the storage feature you are using | Performance of a contract |
| Issue, spend and expire credits, and keep the history | To meter the service and to show you a verifiable record | Performance of a contract |
| Send what you submit to a model provider and return the output | To deliver the AI feature you asked for | Performance of a contract |
| Answer your support and contact messages | To deal with what you asked us about | Legitimate interests; performance of a contract where it concerns your plan |
| Send you our newsletter | Because you asked to receive it | Consent |
| Keep records of consent, orders and security incidents | To be able to show that we complied | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have considered your rights and concluded that our interest in running a secure and functioning service does not override them. You can object at any time; see section 12.
Where we rely on consent, you can withdraw it at any time, and withdrawing it is as easy as giving it. Withdrawal does not affect anything we did before you withdrew.
5. How we use your data
We use your data to give you access to the service; to answer your questions; to keep the service available and secure and to investigate abuse; to meet our legal, tax and accounting obligations; and, where you have consented, to measure how the site is used so that we can improve it.
We also use it to create and maintain your account, and to send you the service messages that go with it, such as email verification and password resets.
Where you buy something, we use it to take payment, to give you access to the plan you paid for, and to issue receipts and invoices.
We do not make decisions about you that produce legal or similarly significant effects using automated processing alone.
6. AI processing
When you use an AI feature, what you submit is sent to a third-party model provider, which generates the output and returns it to us. Those providers are Cloudflare (Workers AI) and fal.ai, and they are listed in the table in section 7.
They process what you submit as our processors, for the sole purpose of producing your output.
We do not use your inputs or outputs to train or fine-tune our own models, and we do not permit our model providers to use them to train theirs, unless you have separately and explicitly agreed to it.
AI output can be inaccurate or misleading. Please review it before you rely on it. It is not professional advice.
7. The processors we use
These are the companies that process personal data on our behalf. Each is bound by a contract that limits them to our instructions.
| Provider | What it does for us | Data it processes | Where | Privacy policy |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosting and delivery: Workers for compute, D1 for the database, R2 for uploaded files, KV for caching, plus CDN and edge security | All data you send to the service, including account data, uploaded files, IP addresses and request metadata | United States, with processing at edge locations worldwide | cloudflare.com/privacypolicy |
| Cloudflare Workers AI | Text summarisation, translation, tagline generation, speech synthesis, image captioning and image generation | The text and images you submit to those features, and the output | United States | cloudflare.com/privacypolicy |
| fal.ai | Image generation and image editing | The prompts and images you submit to those features, and the output | United States | fal.ai/legal/privacy-policy |
| Stripe, Inc. | Checkout, subscription billing and the customer portal | Your name, email address, billing address, card details (which Stripe handles directly, not us) and transaction records | United States, Ireland | stripe.com/privacy |
| Creem | Checkout, subscription billing and the customer portal | Your name, email address, billing address, card details (which Creem handles directly, not us) and transaction records | European Union | creem.io/privacy |
| Waffo Pancake | Checkout, subscription billing and the customer portal, acting as merchant of record | Your name, email address, billing address, card details (which Waffo handles directly, not us) and transaction records | Global | waffo.ai/privacy |
| Resend, Inc. or Cloudflare Email, depending on how the site is configured | Sending transactional email: email verification, password resets, contact form messages and newsletter confirmations | Your email address and the contents of those messages | United States | resend.com/legal/privacy-policy · cloudflare.com/privacypolicy |
| beehiiv, Inc. or Resend, Inc., depending on how the site is configured | Managing the newsletter list and sending newsletters | Your email address and your subscription status | United States | beehiiv.com/privacy · resend.com/legal/privacy-policy |
| Google LLC (Google Analytics 4) | Measuring how the site is used. Only loaded after you consent | A pseudonymous identifier stored in cookies, your truncated IP address, pages viewed and device information | United States | policies.google.com/privacy |
| Microsoft Corporation (Clarity) | Measuring how the site is used, including session replay. Only loaded after you consent | A pseudonymous identifier stored in cookies, your IP address, pages viewed, and interactions such as clicks and scrolling | United States | privacy.microsoft.com |
| Plausible Insights OÜ | Measuring how the site is used. Sets no cookies. Only loaded after you consent | Pages viewed, referrer, browser, operating system, device type and country, all aggregated without persistent identifiers | European Union | plausible.io/privacy |
| Umami Software, Inc. | Measuring how the site is used. Sets no cookies. Only loaded after you consent. May instead be self-hosted by us, in which case no third party is involved | Pages viewed, referrer, browser, operating system, device type and country | United States, or our own infrastructure if self-hosted | umami.is/privacy |
| Discord Inc. or Lark Technologies (Feishu), depending on how the site is configured | Delivering an internal notification to our own team when a payment completes | Your display name, the amount paid and the transaction reference | United States, Singapore | discord.com/privacy · larksuite.com/privacy |
8. Sharing and disclosure
We do not sell your personal data, and we do not rent or trade it. We do not share it for cross-context behavioural advertising.
Besides the processors in section 7, we disclose personal data only:
- where you ask us to, or direct us to;
- to our professional advisers, such as accountants and lawyers, under a duty of confidence;
- where we are required to by law, by a court order or by a regulator. Where we are permitted to tell you about such a request, we will;
- to protect our rights, our users or the public, for example when investigating fraud or a threat to safety;
- to a buyer, if the business is sold or reorganised. You will be told before your data becomes subject to a different privacy policy.
9. Sending data outside the UK
We are based in the United Kingdom, and several of our providers are not. Where personal data is transferred outside the UK, we rely on one of the following: an adequacy decision covering the destination country; the UK International Data Transfer Agreement; or the UK Addendum to the European Commission's standard contractual clauses, together with the safeguards our providers publish for those transfers.
You can ask us at support@example.com for details of the safeguards that apply to a particular transfer.
10. How long we keep it
| Data | Retention |
|---|---|
| Account data | Deleted within 30 days of account closure; backups roll off within 35 days |
| Transaction and invoice records | 6 years, as required by UK tax and company law |
| Credit records that evidence a purchase | 6 years, kept with the transaction records they belong to |
| Credit records that do not relate to a purchase | With your account data: deleted within 30 days of account closure |
| Server and security logs | 90 days |
| Uploaded files | Deleted when you delete them |
| Support correspondence | 24 months |
| Cookie consent record | 12 months, stored in your browser |
Where the law requires us to keep something for longer, we keep it for that period and no longer.
11. How we protect it
Traffic between your browser and the service is encrypted with TLS. Passwords are stored hashed, never in plain text, and we never store full card numbers. Access to production data is limited to the people who need it to do their job, and everyone with access is under a duty of confidence. We keep the platform and its dependencies patched, and we rely on Cloudflare's edge for rate limiting and attack mitigation.
No service can promise perfect security. Please use a strong, unique password and tell us at support@example.com if you think your account has been compromised.
If a personal data breach occurs, we notify the supervisory authority and affected users as required by law.
12. Your rights
Under the UK GDPR you have the following rights.
- Access. Ask for a copy of the personal data we hold about you.
- Rectification. Ask us to correct data that is wrong or incomplete. You can change most of your account details yourself in Settings.
- Erasure. Ask us to delete your personal data. There is no delete button inside the product, so please email us at support@example.com from the address on your account and we will close the account and delete it. We may need to keep invoice records for the 6-year period in section 10 even after the rest is deleted.
- Portability. Ask for the data you gave us in a structured, machine-readable format, or ask us to send it to someone else.
- Restriction. Ask us to pause processing while a dispute about accuracy or legitimate interests is resolved.
- Objection. Object to processing we base on legitimate interests. We will stop unless we have compelling grounds that override your rights.
- Withdraw consent. Withdraw a consent you gave, at any time. For analytics, where analytics is in use on this site, use the "Cookie preferences" link, available on every page: in the footer on our public pages, and at the bottom of the page where there is no footer. For the newsletter, use the unsubscribe link in any newsletter email.
- Complain. Complain to the ICO at ico.org.uk/make-a-complaint or by calling 0303 123 1113. If you are in the EEA, you can complain to the supervisory authority where you live. We would rather you came to us first so we can put it right.
To exercise any of these, email support@example.com. We reply within 30 calendar days. If a request is unusually complex we may extend that by up to two further months, and we will tell you why within the first 30 days. There is no charge unless a request is manifestly unfounded or excessive.
We may ask you to confirm your identity before we act, so that we do not disclose your data to someone else.
If you live in California, you also have the rights to know, delete and correct your personal information, and to opt out of its sale or sharing, under the CCPA as amended by the CPRA. We do not sell or share personal information as those terms are defined, and we do not discriminate against you for exercising a right. We honour the Global Privacy Control signal to the extent our analytics providers act on it; we do not yet detect the signal ourselves, so where analytics is in use on this site, please also use the "Cookie preferences" link, available at the bottom of every page, to record your choice on this site.
13. Children
The service is not intended for children. You must be at least 18 years old to use it, which matches section 2 of our Terms of Service. We do not knowingly collect personal data from children. If you believe a child has given us personal data, write to support@example.com and we will delete it.
14. Cookies
We use cookies and similar technologies. Which cookies we set, what they do, how long they last and how to change your choice are set out in our Cookie Policy. Analytics cookies are only set after you consent, and where analytics is in use on this site, you can change or withdraw that consent at any time using the "Cookie preferences" link at the bottom of every page.
15. Changes to this policy
We may update this policy. Where a change is material, we will give you at least 15 days' notice by email or by a notice inside the service before it takes effect. The version number and date at the top of this page tell you which text is currently in force.
16. Contact us
FISH WITH THE MOON LTD Suite 13512, 61 Bridge Street, Kington, United Kingdom, HR5 3DJ support@example.com
You can also use the contact form. We aim to reply to every message within 2 working days, and to formal data protection requests within 30 calendar days.