Privacy policy
Last updated 6 November 2026
This policy explains what personal data Bowyer Digital ("we"), the business behind TunnelPad, collects and why. We're the controller of this data under the UK GDPR.
What we collect
| Data | Why | Legal basis |
|---|---|---|
| Your name, email address and password (stored hashed) | To run your account and contact you about it | Contract |
| Tokens (stored hashed), reserved names, custom domains and team membership | To provide the service | Contract |
| Billing details: your Stripe customer ID, plan and invoices (card details are held by Stripe, never by us) | To charge for paid plans and keep accounting records | Contract, legal obligation |
| How much traffic each account's tunnels carry per day | Fair use limits, abuse prevention and billing | Legitimate interests |
| IP addresses and technical logs from the website and tunnel servers | Security, preventing abuse and fixing problems | Legitimate interests |
| Email addresses that visitors enter on tunnels protected with email sign-in | Passed to the tunnel's owner's computer; they aren't stored on our servers | — |
We don't store the contents of traffic passing through tunnels. Requests and responses go straight through our servers to your computer; the request inspector runs on your own machine.
Who we share it with
We use these processors, who handle data on our behalf under contract:
- DigitalOcean (hosting, in London, UK);
- Stripe (payments);
- our email delivery provider, for account and billing emails.
We may disclose data when the law requires it, or to investigate abuse such as phishing or malware hosted through a tunnel. We never sell personal data.
Some of these providers may process data outside the UK, under safeguards approved for international transfers, such as the UK's International Data Transfer Agreement.
How long we keep it
Account data is kept while your account is open and deleted within 30 days of closing it. Invoices are kept for 6 years, as UK tax law requires. Traffic totals are kept for 12 months, and server logs for up to 30 days.
Cookies
The website uses only the cookies it needs to work: your session and a security token. We don't use advertising or tracking cookies.
Your rights
You can ask for a copy of your data, or ask us to correct or delete it, restrict or object to its use, or move it to another service. Email privacy@tunnelpad.com. You can also complain to the UK Information Commissioner's Office at ico.org.uk.
Changes
If we change this policy in a way that matters, we'll tell you by email or on the website.