NUMBERSTAND

Privacy Policy

Last updated 13 October 2026

This Privacy Policy explains how NUMBERSTAND ("NUMBERSTAND", "we", "us", "our") handles personal data when you visit numberstand.com, buy a NUMBERSTAND desk display (the "Device"), use the companion web app (the "App"), or connect other services to it. Together these are the "Service". We have written it to be read, not skimmed past — if anything is unclear, email info@numberstand.com.

1. Who we are and how to contact us

NUMBERSTAND is a trading name of The Startup System Ltd, a company incorporated in Northern Ireland on 24 February 2025 (company number NI726700), registered office 12 Glenholm Drive, Belfast, Northern Ireland, BT8 6LW, which is the data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where it applies to you, the EU General Data Protection Regulation (EU GDPR). For any privacy question, request or complaint, contact us at info@numberstand.com. We aim to reply within 5 working days and to complete any rights request within one month.

2. Summary

  • We collect only what we need to sell you a Device, run your account and show your numbers on your desk.
  • Connected accounts (YouTube, TikTok, Instagram, banking, payment platforms) are always optional, read-only, and can be disconnected at any time. We never post content or manage messages.
  • We never sell your personal data, never use it for advertising, and never use your connected-account data to train AI models.
  • Card details are handled by Stripe. We never see or store them.

3. Data we collect

3.1 Data you give us

  • Order data: name, email, shipping and billing address, phone number (if given for delivery), items ordered, amount paid, payment status and order history.
  • Account data: email address, a one-way hashed password (we cannot read it), and account creation and sign-in times. Accounts are created only after a purchase.
  • Content you add to the App: business names and logos, metrics, targets and figures you type in, goals, quotes, to-dos, countdowns, milestones, streaks, screen layouts and display settings.
  • Voice notes: if you use the microphone to add to-dos, the recording is sent for transcription and then discarded. We keep only the resulting text, and only if you confirm it.
  • Support messages: anything you send us by email, including attachments.

3.2 Data collected automatically

  • Device data: pairing status, the business boards assigned to it, and the time it last checked in. Your Device is identified by a random secret stored on it; we store only a one-way hash of that secret.
  • Technical data: IP address, browser type, device type, and server logs of requests and errors, used to keep the Service secure and working.
  • Local storage: see section 9.

3.3 Data from services you connect

Only if you choose to connect them, and only on a read-only basis. Connecting any service is optional; the Device and App work without them.

  • YouTube (via Google sign-in, using the YouTube Data API): with the read-only scope youtube.readonly we retrieve your channel name, channel ID, channel profile image, subscriber count, total view count and video count. We do not access your videos' content, comments, private or unlisted videos, watch history, playlists, subscriptions, YouTube Analytics or your Gmail, Drive or other Google data.
  • TikTok (via TikTok Login Kit): with the scopes user.info.basic and, once approved by TikTok, user.info.stats, we read your open ID, display name, avatar, username, follower count, following count, likes count and video count.
  • Instagram (via Instagram Login for professional accounts): username, account ID, profile information, follower count, media (post) count and like counts on your recent posts.
  • Bank accounts (optional, where available): we may offer read-only banking connections through an approved, regulated open-banking or financial-data provider. Potential providers include Stripe Financial Connections and other FCA-authorised providers; availability depends on your country and bank, and not every provider is live at all times. Where offered, we may receive your bank name, account names and types, currency, balances and transactions (amount, date, description and an identifier), used only to calculate your balance and money in and out. We cannot move money, make payments or change anything at your bank. Bank consent is time-limited (often 90 days), after which you may be asked to reconnect.
  • Payment and sales platforms (such as Stripe), where you connect them: totals of your charges, revenue and customer counts, used to fill in your revenue and users figures. We do not read your customers' card details.

All social connections (YouTube, TikTok and Instagram) are read-only. NUMBERSTAND does not publish, upload, edit or delete content, and does not read, send or manage messages on your behalf.

We store periodic snapshots of connected figures (typically one per day — for example subscriber or follower counts) so we can calculate growth over time and your progress towards targets you set, because most platforms do not provide this history.

3.4 Google user data

NUMBERSTAND's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • Access: we access only the YouTube channel data listed in 3.3, only after you grant permission on Google's consent screen, using read-only access.
  • Use: we use it solely to display your own channel figures, trends and target progress on your Device and in your App. We do not use it for advertising, retargeting, personalised ads, credit or lending decisions, or to train generalised AI or machine-learning models.
  • Storage: channel figures and snapshots are stored in our secured database, linked to your account; Google access and refresh tokens are encrypted and held in a restricted server-only store.
  • Sharing: we do not sell Google user data or transfer it to third parties, except to our hosting provider as needed to run the feature, where required by law, or as part of a merger or acquisition with your notice. Humans do not read it unless you give explicit consent (for example for support), it is needed for security, or the law requires.
  • Revoking: disconnect in Settings → Connections, or remove NUMBERSTAND at myaccount.google.com/permissions. YouTube data is also covered by the YouTube Terms of Service and Google Privacy Policy.

4. How we use data and our legal bases

  • Selling and delivering your Device, handling returns and warranty claims — performance of our contract with you.
  • Running your account and showing your figures on your Device and in the App — performance of contract.
  • Reading data from services you connect — your consent, given when you connect. You may withdraw it at any time by disconnecting.
  • Essential service emails (your invitation, password resets, order and shipping updates, important changes) — performance of contract.
  • Security, fraud prevention, fixing faults and improving reliability — our legitimate interest in running a safe, working service.
  • Keeping tax, accounting and consumer-law records — legal obligation.
  • Product news and offers — only with your opt-in consent; every email has an unsubscribe link. We do not currently send marketing email.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

5. Limited use of connected-account data

Data from your bank, YouTube, TikTok, Instagram or other connected platforms is used only to display your own figures, growth and target progress back to you on your Device and in your App. Specifically, we:

  • never post, upload, comment, like, follow, message or change anything on your social accounts;
  • never initiate payments or alter anything in your bank or payment accounts;
  • never access your messages, private content, or the identities of your followers or customers;
  • never sell, rent or share this data with advertisers, data brokers or any other third party;
  • never use it for advertising, profiling, credit decisions, or training artificial-intelligence models;
  • allow our staff to view it only where you ask for support, for security reasons, or where the law requires.

Our use of data from each platform also follows that platform's own developer terms and policies.

6. Who we share data with

We share personal data only with providers that help us run the Service, under written contracts requiring them to protect it and use it only on our instructions:

  • Cloud hosting and database — stores your account, content and figures and runs the App.
  • Stripe — takes payment for orders and processes refunds.
  • Approved banking data provider (for example Stripe Financial Connections, where available) — connects your bank, if you choose to.
  • Google (YouTube), TikTok and Meta (Instagram) — handle sign-in and authorisation when you connect those accounts; they receive the fact you have authorised NUMBERSTAND. We do not send your NUMBERSTAND data to them.
  • AI transcription provider — turns voice notes into text; recordings are not kept or used for training.
  • Email delivery provider — sends account and order emails.
  • Couriers and fulfilment partners — receive your name, address and phone number to deliver your Device.

We may also disclose data to professional advisers, to a buyer if our business is sold (who must honour this policy), or where required by law, court order or to protect the rights and safety of our users or others. We never sell personal data.

7. International transfers

Some of our providers process data outside the UK or EEA, including in the United States. Where they do, we rely on a UK adequacy decision, the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for details at info@numberstand.com.

8. How long we keep data

  • Account and App content: for as long as your account is open, then deleted within 30 days of closure.
  • Connected-account data and tokens: kept while the connection is active. When you disconnect, the stored access and refresh tokens and the linked account record are deleted straight away, and remaining figures and snapshots from that account are deleted within 30 days (or sooner on request). All connected-account data is deleted within 30 days of account closure.
  • Voice recordings: not stored — discarded once transcribed.
  • Order, payment and invoice records: 6 years after the end of the financial year of purchase, as required by UK tax law.
  • Support emails: up to 2 years after the conversation ends.
  • Server and security logs: up to 90 days.

9. Cookies and local storage

We use only strictly necessary storage: a sign-in session in your browser so you stay logged in, and a pairing secret saved on your Device so it can show your board. We do not use advertising or cross-site tracking cookies. If we ever add optional analytics, we will ask for your consent first.

10. Security

All data is encrypted in transit using HTTPS/TLS. Access tokens for connected services are encrypted at rest and held in a restricted store that only our servers can read; they are never sent to your browser or Device. Database access rules ensure each account can see only its own data, and administrative access is limited and checked on our servers. Passwords must meet strength rules and are checked against known breached passwords. No system is perfectly secure; if a breach affects your data and is likely to put you at risk, we will tell you and the relevant regulator without undue delay.

11. Your rights

You have the right to: access a copy of your data; correct inaccurate data; have your data deleted; restrict or object to our processing; receive your data in a portable format; and withdraw consent at any time (without affecting processing already carried out). To use any right, email info@numberstand.com from your account email. We may need to verify your identity. We will not charge you unless a request is clearly unfounded or excessive.

If you are unhappy with how we have handled your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113) or, in the EU, your local data protection authority.

12. Disconnecting and deleting

  • Disconnect a service: in the App, go to Settings → Connections and choose Disconnect. You can also revoke access from the service itself (for example Google/YouTube: myaccount.google.com/permissions; TikTok: Settings and privacy → Security → Manage app permissions; Instagram: Settings → Apps and websites; your bank or banking provider's consent settings).
  • Delete connected-account data: email info@numberstand.com to ask us to delete the figures and snapshots from any connected account, even if you keep your NUMBERSTAND account. We will do so within 30 days.
  • Unpair a Device: in the App under Settings, or by resetting the Device.
  • Delete your account: email info@numberstand.com from your account email. We will delete your account, content, connected-account data and snapshots within 30 days, keeping only the order records the law requires.

13. Children

The Service is not intended for anyone under 16, and you must be 18 or over to buy a Device. We do not knowingly collect data from children under 16. If you believe a child has given us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy when the Service or the law changes. The date at the top shows the latest version. If a change materially affects how we use your data, we will email you before it takes effect and, where required, ask for your consent again.

15. Contact

NUMBERSTAND is a trading name of The Startup System Ltd, a company registered in Northern Ireland (company number NI726700), registered office 12 Glenholm Drive, Belfast, Northern Ireland, BT8 6LW. Email: info@numberstand.com