Who runs Tandlo
Tandlo is operated by The Fabrik Consultancy Limited, a company registered in England and Wales, number 15485058, with its registered office at 51 Claridge Road, Manchester M21 9WQ. For privacy questions, a copy of your information, corrections or a complaint, email support@tandlo.app. This notice covers the Tandlo app, website, early-access list and invitation reply pages.
Tandlo is for adults managing family life. Children do not create accounts. Only add children and family information you are entitled to manage. A nickname and school year are usually enough; a child’s photo is optional.
What you give us
Clerk signs you in to Tandlo and keeps your session secure. You sign in with an email code, Apple or Google. Clerk holds your email address and its verification, the Apple or Google account you chose, and sign-in security records such as your IP address and device information. Tandlo never sees your Apple or Google password. Tandlo keeps the account identifier Clerk gives you and the name you choose to show in the app. Clerk also passes Tandlo your verified email addresses: we use them to apply an offer you were promised, such as early access, and we keep only a one-way hash of your main address, to check that a sign-in belongs to the right account. Clerk is based in the United States and is covered by the UK-US data bridge (Where information goes explains this safeguard).
Accounts from the earlier Tandlo beta may still sign in with Microsoft Entra External ID until each one has moved to Clerk. Entra sign-in is then switched off. For Entra’s email code, Entra passes your address and the code to our server, which sends it through Microsoft Azure Communication Services. We keep neither the address nor the code, only a one-way replay-prevention record for a day.
Optional Face ID, Touch ID or phone-passcode sign-in uses a credential bound to your device. Clerk receives the public credential, its identifier and device information so you can manage your sign-in methods. Your face, fingerprint and phone passcode stay on your device; they are not sent to Tandlo or Clerk. Email sign-in remains available.
You can add children’s names, school and year groups, an optional colour or photo, family memberships, events, tasks, homework, venues, notes and calendar feeds. You can also save a child’s dietary needs for invitations, such as an allergy, so you don’t have to type them each time you reply to a party with Tandlo. This can be health information, so we keep it only because you choose to save it: we record who saved it, when, and the words they agreed to. Every adult in your family can see and change it. It goes to an organiser only when you tick to include it in a reply, it is never sent to AI, and it is deleted when you remove it, or with the child, your family or your account. Your saved plans may include the original text or details you chose to import. Calendar feed links can contain access keys, so we treat them as private. Plans and tasks you make in Tandlo, with their notes and where they came from, are shown to the other adults in your family unless you keep one to yourself. If you switch sharing off in Family settings, none of them are. Imported calendars and forwarded email are not shared, except a calendar link you choose to share with your family (below). Linked homes never see notes.
Photos, PDFs and text shared into Tandlo initially stay in the receiving device’s private intake. When you ask Tandlo to read or plan, it sends the selected content to our background processing service. Encrypted inputs are kept for up to 24 hours; results are kept for up to 30 days so you can leave the screen and return to them. Acknowledging, cancelling or expiry clears the processing input. Photos are resized first; PDFs are processed to extract text.
When you make a plan from a photo or PDF you shared into Tandlo, we keep a copy with the plan, in our database in the UK, so you see it on every device you sign in to. The adults in your family see it with the plan unless you keep the plan Just me; linked homes and invitation guests never do. Photos are made smaller on your phone first, which removes their location and camera details. PDFs over 2 MB and other unsupported files stay on your phone. A reading result you have not added to a plan follows the background-processing retention above.
Tandlo keeps a few usage records with your account, to run the service and see whether it works: whether your family has confirmed its first date and set up forwarding, whether you finished the app tour, and how many AI reads each request used.
Apple takes payment for App Store purchases, and Tandlo never sees your card. RevenueCat handles subscriptions for us. It records your household’s subscription status and purchase history against an identifier for the household rather than your name or email address, and that identifier is linked to your Tandlo account. RevenueCat also receives the purchase and technical information it needs to check that a purchase is genuine and to prevent fraud. We do not turn on its collection of advertising identifiers. RevenueCat is based in the United States. Its data processing addendum uses the standard contractual clauses with the UK International Data Transfer Addendum.
Email, Gmail and calendars
Connecting email is optional, and there are two routes. If you connect Gmail, Google grants Tandlo read-only access and Tandlo stores the sign-in token encrypted against your account. Tandlo uses it only to fetch messages from the senders you named, such as your school or ParentPay, and cannot send, delete, label or move mail. Disconnecting removes the token and lets you delete everything Tandlo fetched. Tandlo's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements: it is used only to show you the messages and the dates and actions found in them, it is never sold, never used for advertising, and never used to train AI.
Forwarding is the other route. Mailgun’s EU receiving service receives email sent to your private Tandlo address and passes it to our API. We keep the message, sender details, delivery checks and supported PDF attachments so you can review them. Unconfirmed senders wait for your approval. Your forwarded mailbox is private to your account, except for senders you choose to share with your family. If you mark one of your senders "Everyone in the family", each email from it that you forward is copied for your family: the other adults can read it, see who dealt with it and delete the family’s copy, and Tandlo reads it once for the family. Senders you keep to "Just me", and mail someone else forwards to your address, stay yours.
We do not silently read WhatsApp groups or your whole email inbox. You choose what to share, forward or connect, and with Gmail you choose the senders. When you add a calendar link, Tandlo collects the calendar from that link. Device-calendar permissions are requested separately when needed.
School websites we monitor
When someone adds a school, Tandlo checks that school’s public website for newsletters, term dates and letters. We read only what the school has published openly, we honour robots.txt, and we do not sign in or reach anything behind a login. A school’s website is fetched once and shared with every family following it, rather than crawled again for each parent.
School documents are written for a whole community, so they can name children, parents and staff who have never used Tandlo. That information reaches us from the school rather than from you. We keep the extracted text of a document so you can check the original wording against what Tandlo suggests, and our reading model is instructed not to identify children or repeat pupil names and awards. We do not build a profile of anyone named in a school document, use it for advertising, or train our own model on it. A version of a document that has been replaced is removed 30 days later.
Our basis for this is legitimate interests: giving a parent the information their school already published for them. A school, or someone named in one of these documents, can ask us to stop. Email support@tandlo.app and we will suspend that school’s website, which ends all fetching of it whatever any family has chosen. You can also pause school updates for your own family at any time, on the school’s page in Tandlo.
Ask Tandlo and other services
To understand a request or read a selected email, image or document, Tandlo sends the relevant text or image and planning context, including the plans and tasks other adults in your family share with you, with their notes, to Microsoft Azure AI. This may include parent and child names, school years, dates, places and the content you selected, and, when you ask about a party your family is holding, its guests’ replies without their dietary notes. When you make an invitation picture, Tandlo sends Microsoft Azure AI in the EU what you choose to be its star (your description, with your family’s names taken out), the look you pick, and the two lines drawn into the picture: "You’re invited!" and a second line. Tandlo suggests the second line and never puts a name or age in it. If you change it to your own words, such as your child’s name and age, those words go to the picture service too. Dates, places and your photo never go. The picture stays with the plan until an adult in your family removes it, the plan is removed, or the plan’s organiser deletes their account, and guests with your invite link see it, including any name drawn on it. Our basis for drawing the words you choose, including your child’s name, is legitimate interests: making the invitation you asked for. Venue lookup sends your search to Azure Maps.
Tandlo asks each adult before anything they give it goes to AI, and records the answer. If you choose Not now, nothing is sent and you can still add plans, tasks and dates yourself. You can stop it at any time in Settings, your account, Stop using AI for me. Since 28 September 2026 what you give Tandlo to read or plan goes to Microsoft Azure AI, which processes it in the UK or the EU, under Microsoft’s data protection terms. The main model is an EU Data Zone deployment in Sweden Central, which keeps its processing within the EU; the UK treats the EU as giving personal data adequate protection. A smaller backup model, used only if the main one is unavailable, runs in the UK (UK South).
AI can get details wrong. Check the proposed child, date, place and task before saving. The app does not use your family content to train its own AI model. Microsoft describes its model data handling here; service safety and operational processing may also apply. Do not include information the task does not need.
What other people can see
Approved family members see shared children, schools and family membership details, and the plans and tasks each adult shares with the family, with their notes and the photo or PDF a plan was made from. An invitation belongs to its plan. Its words and choices, the pictures made for it, its reply link and the replies are kept with the plan on our server, and every adult in your family who can see the plan can see and change them, on any of their devices. A plan kept Just me keeps its invitation to you. Adults who leave or are removed from the family lose access straight away. A photo you add to an invitation is never uploaded; it stays on the phone you added it on. Forwarded messages (other than from senders an adult shares with the family) stay with their adult account, and so do calendar links unless you share one with your family. Some information stays only on a device until you bring it across or sync it.
If you create an invitation reply link, anyone holding that link can see the event details you choose to publish. They can also see the invitation design you choose to use (the artwork and your words, never your photo), which is deleted with the plan or your account. The adults in the organiser’s family who can see the plan can see guests’ names, their child’s first name, attendance, how many children are coming and optional notes, including dietary information. Do not include sensitive details in a public invitation. You can stop replies and revoke the link. Sharing or exporting outside Tandlo creates copies we cannot retrieve.
If you share a calendar link with your family, such as a school’s or club’s, Tandlo keeps the link on its server, sealed so it can’t be read without our separate key, and checks the calendar every few hours so every adult sees the same events. The other adults see the calendar’s name, the first name of who shared it, which children it is for, and each event’s title, time and place; never the link, its descriptions or who else was invited. Those events are included when an adult in your family asks Tandlo about their plans, as their own plans are. The link is only ever fetched from secure, public internet addresses. The adult who shared a calendar, or the family’s owner, can stop sharing it; either way the link goes back to whoever had it. Tandlo keeps it on the server, sealed, until it is back in their own synced plans, and deletes it then, or if they leave the family or delete their account; it never expires before that. If you leave the family or delete your account, the calendars you shared stop being shared, anyone else who had the same link gets theirs back, and the adults who were in the family are told which, with your first name, for 30 days. Shared calendars are never sent to a linked home.
If your family links with another home, such as a co-parent’s or grandparents’ (Family, Other homes), both families’ owners have to agree, and nothing is shared until an owner switches it on for a child. The other home then sees the plans made in Tandlo that include that child, with their title, day and time, even when a plan also includes other children; the place and who is taking them, which can name another adult in your family, only if you turn off Times only. Anyone with full access in your family can ask the other home to do a pickup for a child you share: the request shows its time, which child and the note as written, and its place only if Times only is off. The other home sees your family’s name, the first names of the children you offer when it matches them with its own, and the first name of an adult who asks for or answers a pickup. What it sees, including pickup notes, is included when it asks Tandlo about its plans, as its own plans are. It never sees plan notes, emails, school details, children you haven’t shared, the other adults in your family beyond those first names, anything kept Just me or Only this home, or your tasks. Either home can end the link at any time; it ends at once for both, every open link code of both families is cancelled, and nothing of yours is copied into the other home. Linking is free for both families.
If you reply to an invitation
This part is for guests replying on an invitation page made with Tandlo. You don’t need an account.
If you use Tandlo, you can reply with it instead (Reply with Tandlo). You choose which of your children are coming, and the reply goes to the family who invited you with their first names and, only for a child where you tick to include it, what you write about their dietary needs. It also adds the party to your family’s Tandlo calendar, where the adults in your family can see it unless you choose Just me, and keeps its date, time and place up to date as the organiser changes them. If the organiser removes the party or leaves Tandlo, it stays in your calendar, marked cancelled. If you replied on the invitation page from the same browser before, you can choose to make that reply your family’s. The two families are never linked: the organiser sees your reply, and nothing else of your family.
The page asks for your child’s first name, your name and how many children are coming, and, if you choose, dietary needs and a note for the organiser. They go to the family who invited you: the organiser, and the other adults in their family on Tandlo who can see the party, can see them, so they can plan it. When an adult in that family asks Tandlo about their plans, Tandlo’s AI reads the replies to answer them, except dietary needs: the AI is only told how many guests gave some. Replies are never used to train AI. They are kept with the invitation and deleted when an adult in that family removes your reply or stops the invite link, or the organiser removes the plan or deletes their account.
After replying you can ask for one reminder by email. We use that address for that reminder and nothing else, and keep it apart from offers. It is sent at 9am UK time the day before the party, and we delete your address once it has gone. We also delete it without sending anything if the party’s day passes, your reply is removed or changed to "Can’t make it", or an adult in that family stops the invite link, or the organiser removes the plan. We send it because you asked for it.
Offers and news from Tandlo are only sent if you tick the box, which starts unticked, and then confirm from the email we send you. We record the wording you agreed to, when, and that it came from an invitation page. If you don’t confirm within 14 days, we delete the request. Once you confirm, we keep your address until you unsubscribe or ask us to delete it. After you unsubscribe, we keep a note that you did for 30 days, then delete it. Our basis is your consent, which you can withdraw at any time.
After replying you can also tick to join our list. Only then do we ask for your email. We keep your address, the words you ticked, when, and that it came from an invitation page, so we can tell you when you can start with Tandlo; when you join, we get an email telling us. Joining this way is not an early-access place and does not come with its offer. We delete your address 12 months after you join, or sooner if you leave the list or ask us to. Our basis is your consent, which you can withdraw at any time.
Microsoft Azure Communication Services sends these emails for us, from notify@mail.tandlo.app, with its data kept in the UK. We don’t track whether you open them or click their links. Every email that can carry offers has an unsubscribe link, which works without an account or a password. To have your reply or your address deleted sooner, ask the family who invited you, or email support@tandlo.app.
Why we use information
We use account and family information to provide the service you ask for, keep access private, remember your plans and respond to support requests. Our legal bases are performance of the service agreement and legitimate interests in operating, securing and improving the beta. Optional permissions and early-access email sign-up are choices you can withdraw. We do not sell family information or use it for advertising.
The early-access form stores your email so we can tell you when a place is available. We delete the list 30 days after that email. If you arrived from one of our own links, it also stores the campaign tags in that link, such as which community post or email it was in, so we know which ones are worth doing again. It does not create an app account. Ask us to remove it whenever you wish. When you join, we get an email telling us, so we can see who has signed up. After Tandlo launches, when you set up a family, we check the email address you sign in with against this list, so the early-access offer applies itself. Optional guest dietary notes can reveal health or other sensitive information: provide them only if needed and with the person’s permission; the organiser is responsible for how they use those notes.
Phone notifications
If you enable alerts, Tandlo keeps an encrypted notification token with your account and installation. For background-reading and sender-check alerts, Expo's push service relays the token, a short generic status message and an opaque job or message identifier to Apple or Google. We do not put your documents, school messages, names, dates or AI replies in those push messages. Opening an alert checks your current account before showing private details. You can turn off notifications in your phone settings.
Where information goes
Our API, database and stored files are hosted on Microsoft Azure in UK South, in the UK. Microsoft Azure Communication Services sends our emails, such as guests’ reminders, confirmation emails and sign-in codes for earlier beta accounts, with its data kept in the UK. Mailgun receives forwarded email in its EU region, and Plausible counts visits to this website in the EU. UK law treats the EU as protecting personal data adequately.
What you ask Tandlo, what you give it to read or plan, and the invitation pictures it draws go to Microsoft Azure AI on EU Data Zone deployments in Sweden Central, which keep that processing in the EU. If the main model is unavailable, a smaller backup model in UK South is used instead.
Public school websites and the documents on them are read differently. Today they are mainly read on Microsoft Azure AI Global deployments, which Microsoft may process in any country where it runs the model, including countries outside the UK and the EU. This reading sends only what a school has published, never anything about your family, but a school’s documents can name pupils, parents and staff (see School websites we monitor).
Some services we use are based in the United States, and each has a safeguard that UK law recognises for sending personal data there. Clerk, which signs you in, is certified under the UK Extension to the EU-US Data Privacy Framework, known as the UK-US data bridge. If the data bridge stops applying, Clerk’s data processing addendum falls back to the standard contractual clauses with the UK Addendum. RevenueCat, which handles subscriptions, is not part of the data bridge; its data processing addendum uses the standard contractual clauses with the UK International Data Transfer Addendum. Expo, which relays phone notifications, and Cloudflare, which runs the security checks on our forms and on sign-in, are covered by the data bridge. Mailgun is a US company and is covered too, though forwarded email stays in its EU region.
Microsoft is covered by the data bridge as well, and its data protection addendum with us includes the standard contractual clauses for processing in other countries, such as the school-page reading above. Azure Maps, which looks up venues from your search and an approximate search area, uses Microsoft’s global service, so that lookup is not limited to the UK. Our website’s hosting and your phone’s own platform services may also involve processing in other countries, so we do not promise that every service processes data only in the UK.
Authorised operators may access information to resolve problems or fulfil privacy requests. Access is restricted, network traffic is encrypted and the database uses account and family access rules. Apple and Google may separately process app distribution, device services and feedback under their own privacy notices.
How long we keep it
Saved account and family records remain until removed. A photo or PDF kept with a plan is deleted when the plan is removed or its account is deleted. Onboarding drafts expire after seven days without an edit. Forwarded messages are set to expire after 30 days if accepted and seven days if held; attached PDFs follow the message. A family’s copy of a shared email, with its PDFs, is kept for 30 days. Expired content is hidden, with physical removal performed by cleanup when the service runs. This beta does not yet guarantee an immediate scheduled purge at the exact expiry time.
A guest’s reminder address is deleted once the reminder has been sent, or when the party’s day has passed. A request for offers that nobody confirms is deleted after 14 days, and a note that someone unsubscribed after 30 days. If you reply to an invitation explains each of these.
Database backups have a retention setting of up to 35 days. Operational logs use a 30-day retention setting and should not contain message bodies, subjects or verification codes. Service providers may retain their own security and delivery records. Microsoft may keep what Tandlo sends to Azure AI for up to 30 days to check for abuse. Azure Communication Services keeps delivery records, including the recipient’s address, for about 30 days, so a guest’s reminder address stays in those records for that long after we delete ours. Restoring a backup requires us to reapply deletion requests before opening access.
Deleting your account
In Tandlo, open Settings, your account, then Delete my account. The option is also available during family setup. The confirmation explains what will be removed before you commit.
Deletion removes your private server records, the photos and PDFs kept with your plans, forwarded messages and attachments, and closes your forwarding address and reply links. Copies of emails you shared with a family stay with that family until they expire. Families you created are removed too, including their children, school links and all members’ plans in those families. If you joined someone else’s family, your membership and private records are removed while their shared children and school information remain. Plans and tasks you shared are removed for the other adults too. Other adults’ accounts and public school information remain.
Your Clerk sign-in identity is removed as part of deletion; a failed provider request is retried. For a legacy account, its Microsoft sign-in identity is removed by the operator within 30 days. A receipt in the app confirms when that step is complete; you do not need to call or email to initiate deletion. A minimal deletion record, with a one-way account identifier rather than family content, prevents old sign-in sessions from recreating the account. Minimal cancellation receipts contain only account, family and share identifiers, without the document or photo. They prevent a removed upload from reappearing after reconnection and are deleted with the account or family. Device copies are cleared where the app can access them. Copies on other devices, exported calendars or recipients’ apps cannot be erased remotely.
Protecting public forms
We use Cloudflare Turnstile on the early-access forms to reduce automated and spam signups. Cloudflare processes browser and network information to check the request. We send it the verification token, rather than your signup email, campaign tags or family information. Our server checks the result before saving your signup.
Clerk sign-in can also load Cloudflare security challenges. Clerk and Cloudflare process browser and network information to protect sign-in.
Invitation replies, changes to a reply and email reminder requests also use Turnstile. The check runs in a separate frame on our Azure-hosted website. That frame receives only the type of request; it cannot read the invitation page, private link, guest key or form contents. Cloudflare processes browser and network information for the security check, while names, replies, dietary notes and reminder addresses go to Tandlo.
Read Cloudflare's privacy policy for how it processes this information.
Visits to this website
We use Plausible Analytics on our public marketing pages to understand which pages and referring sites bring visitors and whether an early-access signup succeeds. Plausible provides aggregate reports, including approximate location, device and browser information. We do not send it your email address, form contents or family information, and its analytics do not use cookies.
Family joining links and email preference pages do not load analytics. Invitation reply pages and the Family trial guide use the limited analytics described below, without loading third-party analytics JavaScript. Invitation forms also use the separate security check described above. We remove private query values and referring-page paths before sending analytics events. Public campaign tags can be included so we can compare our marketing.
Separately, the early-access form keeps campaign tags for this browser visit in session storage and saves them with your signup. Joining through our Moving from Maple page records that campaign; it does not prove you were a Maple customer. Your signup email stays in Tandlo's signup records, separate from Plausible reports. Read Plausible's data policy for how it processes analytics data in the EU.
Keeping your early-access offer
We keep a minimal salted record of eligible signup addresses and whether their offer has been claimed, separate from the contact list. It lets us honour your promised six months after the contact address is deleted and prevents a second claim. It is not a mailing list and cannot be used to send you email. A verified sign-in address is needed to claim the offer; unsubscribing from email does not cancel it.
Registration for the six-month early-access offer stays open until Tandlo is available in the App Store. You may claim it for 12 months after registration closes. Our basis for keeping this eligibility record is legitimate interests in honouring the offer and preventing duplicate grants. Unclaimed eligibility is deleted after the claim deadline; claimed eligibility and its owner record are deleted 90 days after the benefit ends. You can ask support@tandlo.app to erase eligibility sooner. Account deletion removes eligibility hashes associated with that account. If the offer was already given to an address that is then erased, we keep only a one-way hash of that address until the claim deadline, so the same offer cannot be claimed twice, and then delete it. Backup copies expire within 35 days, and erasure requests must be reapplied after a restore.
Requested Family trial links
The trial-link email form is not available yet. The following describes how it will work when enabled.
After replying to an invitation, you can ask for one email explaining how to try Tandlo Family. We use the address for that requested email only. It does not add you to a newsletter, our waiting list or an early-access gift list. Microsoft Azure Communication Services sends the email, without open-tracking pixels or a link that identifies you.
We remove the delivery address after the sending service accepts the email or after the final failed attempt. Undelivered requests are deleted within 30 days. A separate one-way address fingerprint prevents repeated requests for 24 hours and is removed within two days. We keep daily totals for requests and sending-service acceptance, with the generic invitation campaign, rather than anyone's address or invitation details.
Requesting or opening the link does not create an account, connect accounts or start a subscription. Apple checks introductory-offer eligibility and shows the renewal price before you confirm a subscription in the app. You can ask us to remove an unsent request sooner at support@tandlo.app.
Invitation-page visits
We use Plausible Analytics to count visits to invitation reply pages and the Family trial guide, views of Tandlo's benefits, accepted trial-link requests and clicks on the App Store, Instagram and Facebook links. These counts help us understand whether the invitation page brings new parents to Tandlo. A link request or Store click is not a completed account or a started trial.
We replace private invitation addresses with the generic page address /rsvp and a fixed invitation campaign. We do not send Plausible invitation keys, receipt keys, names, party details, replies, dietary notes, email addresses, email fingerprints, form values or the referring page. These pages use our own small tracking code rather than loading another company's JavaScript into the invitation.
Plausible uses the normal browser information and network address of the request to produce daily visitor counts; it does not store the raw IP address. This tracking uses no cookies or persistent identifiers, respects your browser's Do Not Track and Global Privacy Control settings, and is disabled on development and preview sites. Read Plausible's data policy.
Your choices and rights
You can correct family details, disconnect a source, delete individual items and request account deletion. You can request access, correction, deletion or a portable copy of your information, ask us to restrict its use, or object to processing. Some rights depend on the purpose and legal basis. We respond within one month; if a lawful extension is needed, we explain it within that month. Contact us using the address above; we may need to verify that the request is yours before disclosing information.
You can complain to your local data protection authority. In the UK, this is the Information Commissioner’s Office. We will update this notice as the beta changes and highlight material changes in the app or through an appropriate account contact.