Legal

Privacy Policy

Last updated: August 10, 2026

1. Overview

Ordinary Random Objects AB, trading as Tilligo, is the controller for account, public-site, and direct customer relationship data described in this policy.

Tilligo provides a dashboard and embeddable widget for website owners. This policy describes account data, widget runtime data, browser storage, email delivery metadata, campaign attribution, and service-provider processing.

2. Information We Process

2.1 Account and billing data

Name, email address, password hash, account role, and organization membership.
Organization name, plan, status, authorized domains, and widget configuration.
Stripe customer, subscription, invoice, and payment-method identifiers.
Terms, Privacy Policy, and DPA acceptance version and timestamp.

2.2 Widget visitor runtime data

When a customer installs the widget, Tilligo receives the public API key and requesting domain to authorize configuration loading. Security and abuse controls may transiently inspect request metadata under the broader logging rules in this policy. Widget analytics is separate and starts only after the customer enables Insights and the customer site grants Statistics or Analytics consent; persistent widget preferences start only after Preferences consent.

After the widget is runtime-ready, Tilligo records a privacy-minimal installation heartbeat: the organization, configured allowed-domain pattern, and first and last runtime-ready timestamps. It does not retain an IP address, user agent, path, referrer, raw hostname, visitor identifier, or session identifier. This installation state is retained until the organization is deleted.

2.3 Aggregate widget analytics

When Insights is enabled and Statistics or Analytics consent has been granted, Tilligo can produce detailed organization-level aggregates for widget initializations, opens, interactions, allowlisted feature uses, adjustment categories, panel-engagement duration, approximate widget-session, adjustment-session, feature-session, and coarse device-category totals. These are untrusted browser estimates and are never used by themselves for billing, entitlement, verified visitor counts, or accessibility-outcome claims.

The API classifies the User-Agent transiently as desktop, mobile, tablet, or other and then discards it. Raw IP addresses, user agents, request domains, page URLs, referrers, client session identifiers, and event payloads are not retained in widget analytics. Session and batch values are purpose-specific HMAC inputs and are not stored as enumerable visitor records.

Short-lived Redis data expires after 48 hours for duplicate protection, 14 days for daily aggregates, and 30 days for monthly aggregates. Bounded daily and monthly rollups are copied to the service database for account-lifetime reporting and are deleted when the organization is deleted, subject to backups and legal retention obligations described below.

2.4 Email delivery and link attribution

Tilligo does not enable open or click tracking for transactional or lifecycle emails at launch. We process delivery, bounce, and complaint metadata needed to operate, secure, and troubleshoot email delivery.

Links may include campaign-level UTM parameters. These parameters are shared across a campaign and do not contain an email address, user ID, or recipient-specific identifier.

2.5 Tilligo public-funnel analytics

If Analytics is configured and you consent, Tilligo loads Google Tag Manager and Google Analytics to measure an allowlisted public funnel. Approved data is limited to canonical route names, language, fixed CTA placements, successful signup, and checkout-start plan/billing enums. We do not send email addresses, user or organization IDs, query strings, hashes, raw URLs, or referrers through this integration.

Tilligo uses this analytics as controller for its own public service improvement. Google receives analytics data as provider and may process it outside the EEA under its applicable contractual transfer safeguards. The launch configuration recommends 2-month GA4 event-data retention. You can reject or withdraw Analytics at any time through Cookie settings; Tilligo then stops events, removes the first-party analytics cookies it can access, and reloads without GTM.

3. Browser Storage

The Tilligo site uses the necessary HttpOnly tilligo_consent cookie to store a signed choice for 180 days. The widget on Tilligo's public site stores accessibility and display settings locally so selected adjustments remain applied across page navigation and later visits. This storage is used only for the requested widget function, not analytics or advertising. Separately, the widget on customer sites can use browser storage after preference consent. Current widget keys include tilligo-widget-settings-v2, tilligo-widget-language, and tilligo_widget_last_init. See the Cookie and Similar Technologies Policy for details.

4. How We Use Information

Provide dashboard accounts, organizations, widget configuration, and support.
Process subscriptions, invoices, trials, and billing recovery.
Secure the service, rate-limit abuse, investigate incidents, and maintain logs.
Show aggregated usage and adoption data to customers.
Send service, lifecycle, verification, and billing emails.
Measure the consented public signup funnel using a fixed, privacy-reviewed event vocabulary.

5. Customers and Visitor Notices

Customers decide whether and how to install the widget on their own sites. Customers are responsible for giving visitors required privacy/cookie notices and obtaining any required consent before enabling optional analytics or preference persistence. The widget complements customer accessibility work and does not make a site legally compliant by itself.

6. Service Providers

We use service providers to operate Tilligo, including hosting, database, payments, and email delivery. See the Subprocessors page for the current launch list.

7. Retention and Rights

We retain account data while an account is active and as needed for support, security, billing, legal, and tax obligations. Authenticated users can request a data export or account deletion from the profile page. Active subscription owners may need to cancel billing or transfer ownership before destructive deletion can be completed.

Aggregate widget analytics rollups are retained while the customer account is active so the dashboard can show historical trends. They contain bounded counters and estimates rather than raw visitor events and cascade-delete with the organization, subject to routine backup replacement and applicable legal holds.

8. Contact

Privacy requests can be sent to privacy@tilligo.app or by post to Ordinary Random Objects AB, Västermorvägen 73, 777 91 Smedjebacken, Sweden.