Privacy Policy

Data controller

Taiga AI Oy Business ID: 3607851-2 Lapinlahdenkatu 16 00180 Helsinki, Finland Email: hello@tai.ga

What we collect

The information we process depends on how you use the site:

• Analytics, with your consent: page paths, the campaign tags of the link you arrived through (utm_source, utm_medium, utm_campaign, utm_content and utm_term), a fixed referral-source category and landing-page group, selected interaction types, device and browser information, performance measurements and technical error diagnostics. PostHog's automatic click capture and session recording are disabled, and captured URLs exclude query strings and fragments. Ad click identifiers such as gclid, fbclid and li_fat_id are not stored, and email addresses in campaign tags are masked. Analytics events exclude assessment answers, scores, and inquiry names, email addresses, organizations and messages. Inquiry events include the selected conversation type and whether submission succeeded or failed. PostHog uses a pseudonymous browser identifier. With the same consent, selected calls to action, self-assessment actions and form submission attempts generate internal notifications. These contain only an action type, fixed page category, position on the page, random request reference and timestamp. They exclude browser identifiers, URLs, assessment answers, scores and form contents. Network services receive connection information needed to handle requests.
• Marketing, with your separate consent: LinkedIn's Insight Tag sends LinkedIn the pages you visit on tai.ga with your IP address, browser and device details and a timestamp. LinkedIn uses it to report on our ads, to count inquiries sent through the contact page after an ad, and to show Taiga ads on LinkedIn to people who have visited the site. We receive only aggregated reports, never who you are. Happierleads identifies the organization behind your network address and records which pages that organization visited. Only organization-level identification is on in our Happierleads account: identifying individuals, collecting email addresses and recording sessions are off.
• Product updates: your email address, the signup surface and any optional company, role, industry or contact-frequency information you submit. This subscription is separate from an inquiry.
• Job applications: If you write to us about working at Taiga, we process what you choose to send — your name, contact details, any links or materials you include, and what you tell us about your work. An application for an advertised role is made on the application page linked from its posting. That page is hosted by the recruitment agency running the search, which shares your application with us. An open application arrives by email at hello@tai.ga. Applications are read by Taiga’s founders. We only process what is relevant to assessing your suitability for the work. Please do not send health information; we will not ask for it, and if an application contains special categories of data (health, religion, political opinions, trade union membership) we remove it rather than keep it on file.
• Business contacts: if we contact you about Taiga in your professional role, your name, title, organization and work contact details. See “Business contacts and outreach” below.

Website inquiries and bookings

The inquiry form collects your name, email address, optional organization, selected conversation type and message, plus the product count, plan and Scale units if you attach a pricing configuration. The stored record also includes the resulting estimate and rate-card version. We add a request reference and timestamps to acknowledge receipt and handle retries. We use these details to answer you; sending an inquiry does not subscribe you to product updates. Please do not include credentials, confidential code or personal customer data. The event-codes form on tai.ga/analyze collects your name, email address, the event, which codes were on offer and where you came from (the QR on the flyer or T-shirt, or the web); the codes are sent to you by a person, and the request is also recorded in our CRM (see recipients). If you email us, we receive the details you include in that email. If you use the Google Calendar scheduler, Google processes the booking details you enter there; clicking the link alone does not book a meeting.

Booking a call collects your name, email address, optional organization and note, your timezone and the time you choose. We create the meeting in the assigned team member’s Google Calendar with you as the guest, so the invitation shows your name and email address, and its description carries your organization, your note and a link to manage the booking. We store that link and a status reference as one-way digests for checking, plus one encrypted copy so a retried request returns the same link; the copy is kept as long as the booking record. To limit abuse, we keep counters keyed by a digest of your network address and email address for about a day. You can reschedule or cancel from the link in the invitation.

Business contacts and outreach

We contact people at organizations that Taiga could help, by email and on LinkedIn, about matters within their role. Our marketing agency Ostracon runs part of this outreach for us, under our instructions.

For this we process your name, job title, organization, work email address, work phone number where published and LinkedIn profile, plus the messages we exchange and notes from any meeting that follows.

We get these details from public professional sources, such as LinkedIn and your organization's website, and from business contact databases. Our first message to you says where we got your details and how to opt out.

To stop, reply to any message or email hello@tai.ga. We then delete your details and keep only your email address on a do-not-contact list, so that you are not contacted again.

Legal basis for processing

Under GDPR Article 6, we process data on the following bases:

• Consent (Article 6(1)(a)). Analytics and marketing are separate choices in the consent banner, and neither collects anything until you accept it. You can withdraw consent at any time using the “Cookie Settings” link in the footer.
• Steps before a contract (Article 6(1)(b)), where you ask us to take those steps for a contract with you personally. Business inquiries made on behalf of an organization are handled under our legitimate interest in answering that organization's request.
• Legitimate interest (Article 6(1)(f)): responding to business inquiries and protecting the website from abuse. We consider your rights when doing so. This basis does not authorize analytics without consent or subscribe an inquirer to marketing.
• Consent (Article 6(1)(a)): product updates you choose to subscribe to. You can withdraw by emailing hello@tai.ga. Withdrawing does not affect the processing that occurred before withdrawal.
• Steps prior to a contract (Article 6(1)(b)) and legitimate interest (Article 6(1)(f)). We read and assess an application you send us in order to decide whether to talk to you about working here.
• Legitimate interest (Article 6(1)(f)). We keep an application on file so we can return to it when a role opens. You can object to this at any time under Article 21, and we will delete it.
• Legitimate interest (Article 6(1)(f)): contacting people at organizations about matters within their role, a form of direct marketing that GDPR Recital 47 recognizes. You can object at any time and we stop (Article 21).

Purpose of processing

We process personal data for these specific purposes:

• Site improvement: understanding which pages visitors use, where they come from, which campaigns bring them, and how the site performs technically.
• Marketing, with your consent: measuring which LinkedIn ads bring visitors and inquiries, showing Taiga ads on LinkedIn to people who have visited the site, and seeing which organizations visit.
• Early-access communication: sending you updates about Taiga at the frequency you chose.
• Inquiries and bookings: responding to the conversation you choose, arranging a meeting if requested, and preventing duplicate inquiry records after a network retry.
• Recruitment: assessing whether to talk to you about working at Taiga, and returning to your application when a role opens.
• Business outreach: offering a conversation to people whose work Taiga is relevant to, and continuing it if they reply.

With your marketing consent, LinkedIn uses your visit to show you Taiga ads and to measure them. Otherwise we do not use website data for advertising. We do not build behavioral profiles of individual visitors, and we do not sell data to third parties.

Third-party recipients

The following services are involved in website processing:

• PostHog (analytics processor): EU instance hosted in Frankfurt, Germany. PostHog processes pseudonymized usage data on our behalf. PostHog’s DPA and sub-processors: posthog.com/dpa.
• Amazon Web Services: the website infrastructure and signup, inquiry, booking and action-notification records use AWS. These databases are in eu-central-1 (Frankfurt). Notifications use AWS SNS and Amazon Q Developer in chat applications.
• Slack: accepted inquiry, event-code, signup and subscription-preference requests generate notifications in an internal team channel so the team can reply; these do not require analytics consent. An inquiry notification contains your name, email address, organization, the conversation type, the first 300 characters of your message and a request reference. A signup notification contains your email address, any company, role, industry or frequency you gave, the page and a request reference. A booking notification contains your name, email address, any organization, the first 300 characters of your note, the assigned team member, the meeting time and length, and whether you booked through the general page or a team member’s link. If you cancel or move the call, or the team member changes it in their calendar, a short update with the change and the new time follows in the same thread. With analytics consent, selected website actions are also recorded for 30 days; those records do not generate notifications and contain no contact details.
• Attio (CRM processor, EU data hosting): when you ask for an event's promotion codes on tai.ga/analyze, your name, email address, the event, which codes were on offer and where you came from (the flyer or T-shirt QR, or the web) are recorded as a person and a list entry in our CRM so the team can send the codes and follow up about the snapshot. Nothing else from the website is sent to Attio.
• Google Workspace (Google Calendar and Google Meet): bookings are created as events in the assigned team member’s calendar, Google sends you the invitation and any later change or cancellation, and Google Meet hosts online calls. Google processes this as part of Taiga’s Workspace service. Your email provider also processes messages you send us.
• Ostracon (marketing agency, Helsinki): runs part of our outreach and LinkedIn activity as our processor, under a data processing agreement, and receives the business contact details that work needs. Its search work uses Google Search Console and Bing Webmaster Tools, which report search traffic in aggregate and receive no personal data from this site.
• Recruitment agency: for an advertised role, the agency running the search hosts the application page and receives the applications made there, under the privacy notice that page links to.
• LinkedIn: when we contact you or you reply on LinkedIn, LinkedIn processes those messages under its own privacy policy.
• LinkedIn Ireland Unlimited Company (marketing, with consent): receives the Insight Tag data described above. LinkedIn and Taiga are joint controllers for collecting and sending it (GDPR Article 26); LinkedIn alone decides how it uses the data afterwards, under its own privacy policy. You can also control ad use of your data in your LinkedIn settings.
• Happierleads Ltd (London, United Kingdom; marketing, with consent): identifies visiting organizations as our processor, under a data processing agreement, and stores the data in Ireland. Happierleads also adds what it learns to its own company database as an independent controller, as its privacy policy explains.

We do not sell website data to advertisers or data brokers.

International data transfers

The website's AWS databases and PostHog EU service are hosted in Frankfurt. This is not a claim that every website-related service processes data only in the EEA: Slack, Google and LinkedIn describe international processing in their privacy notices. Happierleads is based in the United Kingdom, which the EU recognizes as providing adequate protection, and stores website data in Ireland. Their applicable terms describe transfer safeguards. Contact hello@tai.ga for the processor and transfer information relevant to your interaction.

SlackGoogleLinkedInHappierleads

Cookies and local storage

Your consent choices are stored in local storage. With analytics consent, PostHog stores a pseudonymous browser identifier. With marketing consent, LinkedIn's Insight Tag sets the li_fat_id (30 days) and li_giant (7 days) cookies on tai.ga and its own cookies on linkedin.com, and Happierleads stores identifiers in your browser under names starting with hl_. Cookie Settings resets your choices and removes the PostHog identifier and the tai.ga cookies and storage of LinkedIn and Happierleads. It cannot remove the cookies LinkedIn sets on linkedin.com, and it does not erase data a service has already received. The self-assessment stores its answers locally when that feature is used and provides its own reset control. Inquiry text stays in the form until submission and is not saved to browser storage by the website.

Data retention

We retain personal data only as long as necessary for its purpose:

• PostHog analytics data: retained for 12 months, then automatically deleted. AWS records for website action and signup notifications expire after 30 days; deletion can take a few additional days, and recovery backups can retain deleted records for up to 35 days. Copies in Slack follow the workspace's retention settings.
• Marketing data: LinkedIn removes direct identifiers from Insight Tag data within 7 days and deletes the rest within 180 days. Happierleads keeps cookie data for 24 months and deletes network addresses that match no organization.
• Signup email addresses: retained for 24 months from the date of signup. After this period, we delete your email unless you have become an active customer or explicitly asked us to keep it.
• Inquiry form records expire after 730 days; DynamoDB deletion can take a few additional days. Recovery backups can retain a deleted record for up to 35 days. Technical notification-failure records contain request references and expire after 30 days. Ask hello@tai.ga to delete an inquiry sooner. A subsequent customer relationship has separate recordkeeping requirements.
• Booking records: kept until 90 days after the meeting ends or is cancelled, then deleted automatically; DynamoDB deletion can take a few additional days and recovery backups can retain a record for up to 35 days. The calendar event stays in the team member’s calendar and in yours under your calendar settings. Booking notifications in Slack follow the workspace’s retention settings. Ask hello@tai.ga to export, correct or delete a booking: deletion also cancels the calendar event, which sends you a cancellation, and stops any notification not yet sent.
• Job applications: retained for 12 months from the date we receive them, then deleted. Ask us to delete yours sooner and we will. If we hire you, your application becomes part of your employment records, which are kept under separate retention rules.
• Business contact details: deleted 24 months after our last contact with you, unless a customer relationship follows. If you opt out, we delete them at once and keep only your email address on a do-not-contact list.
• Request and firewall logs: kept for 24 months in Frankfurt, as our security policy requires, then deleted.
• Consent records: stored locally in your browser. Cleared when you reset consent or clear browser data.

Data security

The website uses encrypted connections and encrypted AWS storage. Inquiry records are accessible to authorized roles; there is no public inquiry lookup endpoint. Public form requests go through server-side validation and API Gateway throttling. Technical logs omit inquiry payloads, and team notifications use references rather than inquiry text. CloudFront applies HSTS, Content Security Policy, X-Frame-Options, X-Content-Type-Options and Referrer-Policy headers. Our hosting records each request to the website and its form endpoints (IP address, time, page or endpoint, browser details) for security and troubleshooting. The firewall additionally logs requests it blocks or flags as automated, with authorization and cookie headers removed.

Your rights under GDPR

You have the following rights regarding your personal data:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: ask us to correct inaccurate data. We correct the records we hold and send the correction to the internal team channel that received the original notification.
• Right to erasure: ask us to delete your personal data.
• Right to restriction: ask us to limit how we process your data.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interest. You can object to outreach at any time without giving a reason, and we stop.
• Right to withdraw consent: withdraw analytics or marketing consent at any time via the “Cookie Settings” link. This does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, email us at hello@tai.ga. We will respond within 30 days.

Right to lodge a complaint

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman:

Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) Visiting address: Lintulahdenkuja 4, 00530 Helsinki Postal address: PO Box 800, 00531 Helsinki Email: tietosuoja@om.fi Website: tietosuoja.fi

Personal data breaches

A personal data breach affecting website data is handled under our incident response policy. Where required, we notify the Office of the Data Protection Ombudsman within 72 hours of becoming aware of it (GDPR Article 33). Where a breach is likely to result in a high risk to your rights and freedoms, we notify you without undue delay (GDPR Article 34): by email if you are an early-access signup contact, or by a notice on tai.ga if a broader group of visitors is affected.

Automated decision-making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you.

Changes to this policy

If we materially change how we process personal data, we will update this page, change the “last updated” date, and reset your consent choice so you can review and decide again.

Contact

For any questions about this privacy policy or how we handle your data, contact us at hello@tai.ga