Privacy Policy

This policy explains what personal data Taxiway collects, why we collect it, and the rights you have over it. We are committed to handling your data lawfully, fairly and transparently in line with the UK GDPR and the Data Protection Act 2018.

1. Who we are

Taxiway is a service operated by Lloyd IT Limited, a company registered in England and Wales. We are the "data controller" responsible for your personal data.

If you have any questions about this policy or how we handle your data, contact us at [email protected].

2. The data we collect

We collect and process the following categories of personal data:

• Account data: your name, email address, username, password (stored hashed) and any organisation details you provide when you sign up.
• Billing data: your subscription plan, billing history and partial payment details. Card numbers are handled by Stripe and are never stored on our systems (see "Payments" below).
• Usage and technical data: IP address, browser and device type, pages visited, and how you interact with our website and dashboard, collected through logs and privacy-friendly analytics.
• Support and communications: the contents of emails and messages you send us, and our replies.
• Deployment metadata: configuration you enter to run the service, such as repository names, service names, environment variable keys and connected-server details. We do not seek access to the application data that runs on servers you own (see our Data Policy).

3. How and why we use your data

We only use your personal data where the law allows us to. The table below sets out our purposes and the lawful basis for each.

Purpose	Lawful basis
Creating and managing your account; providing the service	Performance of a contract
Taking payment and managing subscriptions	Performance of a contract
Sending service, security and billing notifications	Performance of a contract / legal obligation
Securing, maintaining and improving the service	Legitimate interests
Understanding website usage through analytics	Consent / legitimate interests
Sending marketing emails (where you opt in)	Consent
Meeting our legal, tax and accounting obligations	Legal obligation

Where we rely on consent, you can withdraw it at any time. Where we rely on legitimate interests, we have weighed those interests against your rights and will tell you what they are on request.

4. Payments

Payments are processed by Stripe using Stripe-managed payments. When you subscribe, your card and payment details are collected and processed directly by Stripe under its own privacy policy. We do not see or store your full card number. We receive only the information needed to manage your subscription, such as your billing status, the last four digits of your card and your invoices.

5. Cookies and analytics

We use a small number of cookies and similar technologies that are strictly necessary to run the site and keep you signed in. We also use privacy-friendly analytics to understand how the site is used. Where cookies are not strictly necessary, we ask for your consent before setting them, and you can change your choice at any time through your browser or our cookie controls.

6. Who we share your data with

We do not sell your personal data. We share it only with trusted third parties who process it on our behalf (our "sub-processors"), each bound by contract to protect it and use it only as we instruct:

Provider	Purpose	Region
Stripe	Payment processing, subscription billing, tax and invoicing	USA / EU / UK
Cloudflare	Website hosting, DNS, CDN and security	Global (UK/EU edge)
Resend	Transactional and account email	USA / EU

We may also disclose your data where required by law, to enforce our terms, or to protect the rights, safety and property of Taxiway, our users or others.

7. International transfers

Some of our providers are based outside the UK. Where your data is transferred abroad, we make sure it is protected by an adequacy decision or by appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

8. How long we keep your data

We keep your personal data only for as long as we need it. Account data is kept while your account is active and for a reasonable period afterwards. Billing and tax records are kept for at least six years to meet UK legal requirements. We delete or anonymise data when it is no longer needed.

9. How we protect your data

We use appropriate technical and organisational measures to keep your data secure, including encryption in transit, hashed passwords, access controls and regular review of our security practices. No system is perfectly secure, but we work to protect your data and will notify you and the ICO of any breach where we are legally required to do so.

10. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to how we process your data;
• receive your data in a portable format;
• withdraw consent at any time where we rely on it; and
• not be subject to solely automated decisions with legal effect.

To exercise any of these rights, email [email protected]. We will respond within one month. There is normally no charge.

11. Children

Our service is not directed at children and is intended for users aged 18 or over. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this policy from time to time. When we make material changes we will update the "last updated" date above and, where appropriate, notify you by email or through the service.

13. Complaints

If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the ICO at ico.org.uk, by calling 0303 123 1113, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Questions about this policy? Email [email protected] .