Effective Date: August 5, 2026 | Last Updated: August 5, 2026
This Privacy Policy describes how ActionTiles ("ActionTiles," "we," "us," or "our") collects, uses, discloses, and protects information when you use our website (actiontiles.net), applications, dashboard tiles, and related services (collectively, the "Service"), including features that connect to Amazon services such as Login with Amazon (LWA) and Alexa.
This policy is designed to address obligations under United States federal and state privacy laws, the EU and UK General Data Protection Regulation (GDPR), and other applicable global data protection laws described in Section 12. By using the Service, you agree to the collection and use of information as described in this policy.
For transparency consistent with US state privacy laws, the table below summarizes categories of personal information we collect, using the framework commonly required by these laws:
| Category | Examples | Collected? | Source |
|---|---|---|---|
| Identifiers | Name, email, username, IP address, device ID | Yes | You; automatically |
| Account credentials | Hashed password, authentication tokens | Yes | You; linked platforms (e.g., Amazon) |
| Commercial information | Subscription/billing history (not full card numbers) | If applicable | You; payment processor |
| Internet/network activity | Usage data, browsing/interaction data on the Service | Yes | Automatically |
| Geolocation data | Approximate location from IP address (not precise GPS) | Yes (approximate only) | Automatically |
| Smart home / device data | Connected device names, states, status history | Yes, if you connect devices | You; connected platforms |
| Sensitive personal information | Precise geolocation, biometric data | No | N/A |
| Inferences | Usage patterns for product improvement | Limited | Derived from usage data |
We do not collect Social Security numbers, government IDs, precise real-time geolocation, biometric identifiers, or health information.
ActionTiles offers account connection via Login with Amazon (LWA). When you connect your Amazon account:
To provide dashboard functionality, we may access and process device names, types, and states, device status history for tiles/charts, and authentication tokens issued by your smart home platform. This data is accessed only through permissions you grant, used solely to display/control devices on your own dashboard, and is not used to build advertising profiles.
We do not use your personal information for automated decision-making that produces legal or similarly significant effects concerning you, and we do not use smart home data to serve targeted advertising.
For users in the EEA, UK, and Switzerland, we rely on the following legal bases under Article 6 GDPR:
| Processing Activity | Legal Basis |
|---|---|
| Creating and maintaining your account | Performance of a contract (Art. 6(1)(b)) |
| Amazon/Alexa integration and device control | Performance of a contract; consent (Art. 6(1)(a)/(b)) |
| Analytics and service improvement | Legitimate interests (Art. 6(1)(f)) |
| Security monitoring and fraud prevention | Legitimate interests; legal obligation (Art. 6(1)(f)/(c)) |
| Marketing communications (if opted in) | Consent (Art. 6(1)(a)) |
| Responding to legal requests | Legal obligation (Art. 6(1)(c)) |
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
We do not sell your personal information for money. We do not "share" personal information for cross-context behavioral advertising as defined under California and other state laws. We may disclose information in these limited circumstances:
We use cookies, local storage, and similar technologies to keep you signed in, remember preferences, and understand usage through analytics. Where required by law (e.g., EEA/UK), we request consent for non-essential cookies via a cookie banner before they are set. You can manage cookies through your browser settings, and where applicable, through our cookie preference tool. We honor recognized opt-out signals, including the Global Privacy Control (GPC), as an exercise of your opt-out rights where legally required.
We retain personal information for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Smart home tokens and cached device states are deleted when you disconnect an integration or delete your account. Backup copies may persist for a limited period consistent with standard backup cycles before permanent deletion.
We implement reasonable administrative, technical, and physical safeguards, including encryption of credentials and tokens in transit and at rest, access controls, and monitoring. No method of transmission or storage is 100% secure. In the event of a data breach affecting your personal information, we will notify affected individuals and applicable regulators as required by law (including, where applicable, US state breach notification laws and GDPR Articles 33–34).
If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Oregon, Texas, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, or another US state with a comprehensive consumer privacy law in effect, you generally have the right to:
In the preceding 12 months, we have collected the categories of personal information listed in Section 1.3, for the business purposes described in Section 4, from the sources listed in Section 1.3, and disclosed such categories to the types of recipients described in Section 6. We have not sold or shared personal information as those terms are defined under the CCPA/CPRA. California residents may designate an authorized agent to submit requests on their behalf, subject to verification.
Nevada residents may submit a request directing us not to sell covered information; as noted above, we do not sell personal information.
If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the right, subject to certain conditions and exceptions, to:
We aim to respond to verified requests without undue delay and in any event within one month, extendable by two further months for complex requests as permitted by Article 12 GDPR.
We aim to honor privacy rights consistent with applicable law wherever you are located, including but not limited to:
If your jurisdiction's law grants rights not explicitly listed above, contact us and we will address your request consistent with applicable law.
ActionTiles is based in the United States, and personal information is generally processed and stored in the United States. If you access the Service from outside the US, your information will be transferred to the US and other countries where our service providers operate, which may have data protection laws different from those of your country. Where required (e.g., for transfers from the EEA/UK), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, or another valid transfer mechanism, to protect personal data transferred internationally.
To exercise any of the rights described above, email us at help@actiontiles.net with the subject line "Privacy Request," specifying the right you wish to exercise and information sufficient to verify your identity and locate your account. We will respond within the timeframe required by applicable law (e.g., generally 45 days under CCPA, extendable once by 45 days; one month under GDPR, extendable by two months for complex requests). We will not charge a fee for a reasonable request but may charge a reasonable fee or decline manifestly unfounded or excessive requests as permitted by law.
The Service is not directed to children under 13 (or the equivalent minimum age in your jurisdiction, including under GDPR's age-of-consent provisions, which range up to 16 depending on the EU member state), and we do not knowingly collect personal information from children below the applicable age. If we learn we have collected such information without appropriate consent, we will delete it promptly. Parents or guardians who believe a child has provided us personal information should contact us at help@actiontiles.net.
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last Updated" date above and, where appropriate, additional notice (such as an in-app or email notification). Continued use of the Service after changes take effect constitutes acceptance of the revised policy, to the extent permitted by applicable law.
General privacy inquiries and rights requests:
Email: help@actiontiles.net
Website: actiontiles.net
EU/UK representative: [Insert name/contact of your appointed EU/UK Article 27 representative, if you offer the Service to EEA/UK individuals at scale and are not otherwise exempt]
Data Protection Officer (if appointed): [Insert DPO contact, if applicable under Article 37 GDPR]