1. Who we are
Tuppence (tuppence.ai) is a payments platform for developers and AI agents. It is operated by Tuppence AI Ltd, a private limited company registered in England and Wales, with its registered office at 38 Greenvale Road, London SE9 1PD, United Kingdom (“we”, “us”, “our”). We are the controller of the personal data described in this notice, except where section 2 says otherwise.
This notice covers personal data about people who visit this website, joined our pre-launch waitlist, sign up for or use Tuppence, work for the businesses that use Tuppence, or pay those businesses through Tuppence. It is written in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and, for people in the United States, the US state privacy laws described in section 12.
For anything about your personal data, including exercising your rights, email contact@tuppence.ai with “Privacy” in the subject line, or write to us at the address above. Our director is responsible for data protection at Tuppence.
2. Controller and processor
Depending on the situation, we act in one of two roles:
- As a controller, when we decide why and how personal data is used. This covers the businesses that use Tuppence and their users (names, emails, sign-in and security details), the people we verify when a business goes live, fraud-prevention data, waitlist sign-ups, and people who contact us.
- As a processor (in US terms, a service provider), when we handle data about payers (the customers of businesses that use Tuppence) on that business’s behalf. If you paid a business through a Tuppence checkout page, payment link or subscription, that business is the controller and its own privacy notice applies. Section 13 of our Terms of Service sets out the terms of that processing.
Stripe, which processes card payments, provides Tuppence cards through its issuing partners and verifies identities (Stripe Identity), is a separate controller of the personal data it collects to provide its regulated services and meet its own legal obligations, under its own privacy policy. We use the fraud-prevention data in section 3 as a controller in our own right.
3. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account and user | Name, work email, phone number if you add one, business name, hashed password, two-factor authentication settings, team roles | You, your colleagues; Google or Apple if you sign in with them |
| Verification (going live) | Business details; details of directors, owners and representatives such as name, date of birth, home address, contact details and identification or tax numbers (including a Social Security Number where Stripe requires one); bank account details; documents you upload; what Stripe tell us about your business | You and Stripe; passed to Stripe for its checks, and kept by us in an encrypted store |
| Identity documents and selfie | Images of photo ID (front and back) and a selfie captured through Stripe Identity, and the details read from the ID | Collected by Stripe; a copy is kept by us in an encrypted store |
| Payer data (as processor) | Payer name, email and billing address, card brand and last four digits, payment amounts and status, subscription, booking and usage records | Payers, through checkout and pay pages; the business using Tuppence; Stripe |
| API and security logs | API requests and responses with secrets redacted, IP address, user agent, audit log of actions in your account | Your use of the dashboard, iPhone app, API and agent tools |
| Fraud prevention | Card fingerprints (a reference Stripe gives each card, not the card number), card country and type, payers’ IP addresses, the IP addresses, approximate locations and device identifiers used to access accounts, and a fingerprint of each payout bank account. We use these to spot fraud and to link accounts that share them. | Payments, sign-ins and account changes; Stripe; a geolocation database we hold ourselves |
| Support | Conversations through “Get help”, including with our AI assistant, files you attach, emails and feedback on help articles | You |
| Waitlist | Email address, and optionally company name, what you are interested in and which page you signed up from | You, through our pre-launch waitlist form |
This website uses no analytics or tracking. It sets two cookies, tuppence_region and tuppence_lang, only when you choose a country or a language. See our Cookie Policy.
Sensitive data. Identification numbers, identity documents and selfies are sensitive. Stripe Identity compares your selfie with your photo ID to confirm that you are the person on it; Stripe does this as a controller, with your explicit consent, which it asks for at the start of the check. We keep a copy of the images as part of your verification records to meet our legal obligations, but we do not use them to identify you by biometric means ourselves.
4. Card data we never see
Your payers’ full card numbers, CVCs and PINs never reach Tuppence’s systems. Payers type card details straight into Stripe’s own fields on hosted pages, and Stripe holds them. We only keep a token that refers to the card, the card brand and its last four digits. The same applies to Tuppence cards: Stripe holds the full card details, and shows them to the cardholder through its own secure fields.
5. How we use it and our lawful bases
We only use personal data where we have a lawful basis under the UK GDPR. The table below sets out our main purposes where we are the controller.
| Purpose | Lawful basis |
|---|---|
| Creating and running accounts, and providing the dashboard, iPhone app, API and agent tools | Contract, or legitimate interests in providing our services to business customers |
| Verifying businesses and the people behind them, and preventing fraud, money laundering and sanctions breaches | Legal obligation; legitimate interests in preventing crime and protecting our customers, payers and payment partners |
| Processing payments, payouts, card spend and cashback, and keeping financial records | Contract; legal obligation |
| Securing the service, keeping API and audit logs, and investigating incidents | Legitimate interests in protecting our customers and systems |
| Answering support requests, including through our AI assistant | Contract; legitimate interests in helping you quickly |
| Service emails and notifications (for example, security alerts and payout notices) | Contract; legitimate interests |
| Managing the waitlist and inviting you to live access | Legitimate interests in telling people who asked when Tuppence is ready for them |
| Product updates to business contacts | Legitimate interests, or consent where the Privacy and Electronic Communications Regulations require it |
| Recovering money a business owes us, and establishing, exercising or defending legal claims | Legitimate interests in recovering what we are owed and protecting our legal rights |
| Complying with regulators, courts and law enforcement | Legal obligation |
Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You can ask us for more information about that assessment. Where we process criminal offence data for fraud prevention, we rely on the condition for preventing or detecting unlawful acts in the Data Protection Act 2018.
6. AI, agents and automated decisions
Businesses may connect their own AI agents to Tuppence. Those agents act for the business, which is responsible for them.
Our own AI assistant, in “Get help” and the dashboard, uses a large language model provided by Anthropic. When you use it, your messages and the account context needed to answer them are sent to Anthropic to generate a reply. We do not use your data or payer data to train AI models, and under Anthropic’s commercial terms, data sent through its API is not used to train its models. Answers from our AI assistant may be wrong; please check anything important with us.
Some fraud-prevention and verification checks, ours and Stripe’s, are automated. A person at Tuppence reviews every business before its first payout. If an automated decision would have a legal or similarly significant effect on you (for example, declining to verify your identity), you can ask for a person to review it, give your point of view and contest the decision.
7. Who we share it with
We never sell personal data. We share it only where needed, with:
- Stripe, which provides card payment processing, payouts, identity verification (Stripe Identity) and card issuing (Stripe Issuing, with its issuing partners);
- any other Stripe account, acquirer, payment processor or sub-processor we use, or move to, to process payments. We share verification records with them so they can set up and verify your business without you providing everything again, and we ask you first where they need you to accept their own terms;
- our sub-processors, under contracts that require them to protect it (listed below);
- the business you paid, if you are a payer, and systems it connects to Tuppence through webhooks or the API;
- regulators, law enforcement and courts, where the law requires it;
- professional advisers, such as auditors, lawyers and insurers, and debt collection agencies where a business owes us money;
- a buyer or investor, if we sell, merge or restructure our business, under appropriate confidentiality protections.
| Sub-processor | What it does for us | Where |
|---|---|---|
| Google Cloud | Hosting, databases and file storage | London (europe-west2) |
| Cloudflare | Network edge, security and bot protection for booking pages | Global network |
| Resend | Sending emails, such as receipts, alerts and sign-in codes | United States |
| OpenSanctions | Checking businesses and the people behind them against sanctions lists and lists of politically exposed people. We send names, dates of birth, nationalities and countries, and company names and registration numbers | European Union |
| Anthropic | The language model behind our AI assistant | United States |
| Expo | Delivering push notifications to the iPhone app | United States |
| Twilio | Sending text and WhatsApp messages, where a business switches them on | United States |
| Slack | Internal alerts to our team about sign-ups, verification and risk | United States |
We will update this list before we add or replace a sub-processor.
8. Where it is stored
We host Tuppence on Google Cloud in the europe-west2 region (London). Some of our providers, including Stripe and the sub-processors listed above, process personal data in other countries, mainly the United States. When personal data is transferred outside the UK, we make sure it is protected by:
- UK adequacy regulations for the destination, including the UK Extension to the EU–US Data Privacy Framework where the recipient is certified under it; or
- the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment and any additional safeguards needed.
You can ask us for a copy of the relevant safeguards at contact@tuppence.ai.
9. How long we keep it
We keep personal data only for as long as we need it for the purposes above, including meeting legal, accounting and regulatory requirements. A scheduled job deletes data when its period ends.
| Data | Retention period |
|---|---|
| API request logs | 30 days, with secrets redacted |
| Webhook delivery logs and declined payment attempts | 30 days |
| Audit logs | Seven years |
| Payment, payout, card and other financial records | Seven years after the transaction |
| Account and user data | For the life of the account. After it closes, what forms part of our financial records and audit log is kept for seven years; the rest is deleted or anonymized. |
| Verification details we hold | For the life of the account and at least five years after it closes (or after we decline or you abandon verification), or longer where the law requires. This includes identity document images, selfies and bank account details. We do not delete them on request during that time, because anti-money-laundering law requires us to keep them. |
| Verification decisions and reviewers’ notes | At least seven years after the decision |
| Fraud-prevention data (card fingerprints, IP addresses, device identifiers, bank account fingerprints, and links between accounts) | Two years after it was last seen |
| Support conversations, including with our AI assistant | Two years after the last message |
| Waitlist sign-ups | Until you are invited and sign up, or ask us to remove you |
| One-time sign-in and verification codes | One day |
When retention periods end, we securely delete or anonymize the data. Where legal proceedings or regulatory investigations are ongoing, we may keep relevant data for longer.
10. Security
We protect personal data with technical and organizational measures appropriate to the risk, including encryption in transit and at rest, a separately encrypted store for verification records, hashed passwords, two-factor authentication, restricted API keys, access controls and audit logging. You can read more on our security page. No system is completely secure, so we cannot guarantee that personal data will never be accessed without permission, but we work to keep that risk low. If a personal data breach occurs that is likely to result in a risk to you, we will tell you, and the regulators that must be told, where the law requires.
11. Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you and receive a copy;
- rectification of inaccurate or incomplete data;
- erasure, where there is no good reason for us to keep it;
- restrict how we use it in certain circumstances;
- object to processing based on legitimate interests, and to direct marketing at any time;
- data portability, to receive data you provided in a structured, machine-readable format;
- not be subject to solely automated decisions with legal or similarly significant effects, as described in section 6;
- withdraw consent at any time, where we rely on consent.
To exercise a right, email contact@tuppence.ai or write to us. We may need to verify your identity first. We will respond within one month, or tell you if we need longer because your request is complex. Some rights are limited: for example, we cannot delete records we are legally required to keep, and we will tell you which records those are.
If you are a payer, the business you paid is the controller of your data. We will pass your request to them and help them respond.
12. US state privacy rights
This section is for residents of US states with comprehensive privacy laws, including California (the California Consumer Privacy Act, as amended by the California Privacy Rights Act), Colorado, Connecticut, Virginia, Texas, Oregon and others. We also consider requests from residents of other US states, but where a state’s law does not apply to us, we do so voluntarily and may decline or limit a request.
- What we collect. In the last 12 months we have collected the categories in section 3: identifiers (such as name, email, IP address and account ID); customer records (such as address, phone number and bank account details); commercial information (payments and payouts); internet and network activity (API and security logs); approximate geolocation; professional information (your role at your business); and sensitive personal information (government identification numbers, identity document images, account sign-in details and a selfie used by Stripe for identity matching). Sources and purposes are in sections 3 and 5, and how long we keep each kind is in section 9.
- No sale or sharing. We do not sell personal information, and we do not “share” it for cross-context behavioral advertising. We have not done so in the last 12 months, and we do not knowingly sell or share the personal information of anyone under 16.
- Sensitive personal information is used only to verify businesses and the people behind them, prevent fraud, keep accounts secure and meet our legal obligations, not to infer characteristics about you. That is why we do not offer a separate right to limit it.
- Disclosures for a business purpose. We disclose the categories above to Stripe, our sub-processors and the other recipients in section 7, for the purposes described there.
- Your rights. You can ask to know what personal information we have collected about you and how we use and disclose it, to get a copy of it, to correct it and to delete it, subject to the exceptions the law allows (for example, records we must keep to meet anti-money-laundering obligations).
- How to ask. Email contact@tuppence.ai with “Privacy” in the subject line. We will confirm receipt within 10 business days and respond within 45 days, or tell you if we need up to 45 more. We will verify your request by matching details we already hold, such as the email address on your account. You can ask an authorized agent to make a request for you; we will ask for your signed permission and may ask you to verify your identity directly.
- Appeals. If we decline your request, you can appeal by replying to our decision. We will respond to an appeal within 45 days and, if we still decline, tell you how to contact your state attorney general.
- No discrimination. We will not treat you differently for exercising your rights.
We honor Global Privacy Control signals, though there is nothing for them to opt you out of: this website runs no advertising or tracking.
13. Emails and marketing
Service emails (such as security alerts, payout notices and, for payers, receipts and failed-payment reminders sent on a business’s behalf) are not marketing. If you joined our waitlist or have an account, we may send you product updates where the law allows. Every such email includes an unsubscribe link.
14. Children
Tuppence is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18 other than as payer data processed for a business.
15. Changes to this notice
We will update this notice when our practices change. If the changes are significant, we will tell account holders by email or in the dashboard before they take effect. The date at the top shows when it was last updated.
16. Contact and complaints
If you have questions about this notice or how we handle your data, email contact@tuppence.ai, write to Tuppence AI Ltd, 38 Greenvale Road, London SE9 1PD, United Kingdom, or use our contact page.
If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk, or to your state attorney general or, in California, the California Privacy Protection Agency. We would appreciate the chance to put things right first, so please contact us before you do.
17. About this notice
This notice explains how we handle personal data, as data protection law requires. It is not a contract and does not create contractual rights or obligations beyond those the law gives you. For businesses that use Tuppence, our responsibilities for personal data are set out in our Terms of Service, including the limits on our liability in section 17, to the extent the law allows. Nothing in this notice or in our Terms limits your rights under data protection law, or our duties under it, that cannot be limited.