1. Who we are
tarsiflow is operated by TarsiFlow, Cavite Philippines. You can contact us about privacy at [email protected].
2. Controller and processor
We are the controller of personal data about our website visitors, people who contact us, newsletter subscribers and account holders.
We are a processor for the personal data our customers store in their workspaces, such as their clients' names and contact details. In that case our customer is the controller, and we only process that data on their instructions to provide the Service. If you are a client of one of our customers and have a question about your data, please contact that business first.
3. Data we collect
- Account data: your name, email address, password (stored as a secure hash), profile photo from Google if you sign in with Google, and two factor authentication settings.
- Workspace data: business name, logo, address, tax ID, currency, time zone and team membership.
- Contact form data: your name, email, company, the topic and your message, plus your IP address and browser details to prevent abuse.
- Newsletter data: your name, email, company, team size, the time you consented and your IP address.
- Usage and device data: log information such as IP address, browser type, pages requested and timestamps, used to keep the Service secure and working.
- Payment data: tarsiflow subscription payments are handled by PayPal. We never see or store full card numbers or PayPal login details.
- Proposal acceptance data: when someone accepts a proposal, we record their name, the time and their IP address on behalf of our customer.
4. How we use it and why
| Purpose | Legal basis |
|---|---|
| Creating and running your account and workspace | Performance of a contract |
| Keeping the Service secure, preventing fraud and abuse | Legitimate interests |
| Replying to messages you send us | Legitimate interests, or steps before a contract |
| Sending service emails such as verification, invitations and receipts | Performance of a contract |
| Sending our newsletter | Consent, which you can withdraw at any time |
| Optional analytics and marketing cookies | Consent |
| Keeping records for tax and accounting | Legal obligation |
We do not sell your personal data and we do not use it for automated decisions that have legal or similarly significant effects on you.
5. Who we share it with
We share personal data only with service providers who help us run tarsiflow, under contracts that require them to protect it:
- hosting and database providers that store the Service and its backups;
- an email delivery provider that sends account and notification emails;
- PayPal, which processes tarsiflow subscription payments;
- Google, if you choose to sign in with Google.
- Google Analytics, if you allow analytics cookies, to understand how the website is used.
We may also disclose data if the law requires it, or to protect the rights and safety of our users and the Service.
6. International transfers
Some of our providers may process data outside the UK or the European Economic Area. When that happens we rely on an adequacy decision or on Standard Contractual Clauses, with additional safeguards where needed.
7. How long we keep it
- Account and workspace data: for as long as your account is open, then deleted within 30 days of closure and from backups within a further 90 days.
- Contact form messages: up to 24 months after our last reply.
- Newsletter data: until you unsubscribe, then a minimal record to respect your choice.
- Security logs: up to 12 months.
- Billing records: as long as tax law requires, usually 6 to 10 years.
8. Your rights under GDPR
Depending on where you live, you have the right to:
- access the personal data we hold about you;
- rectify data that is inaccurate or incomplete;
- erase your data, also known as the right to be forgotten;
- restrict how we process your data;
- data portability, receiving your data in a common, machine readable format;
- object to processing based on legitimate interests, and to direct marketing at any time;
- withdraw consent at any time, without affecting processing that happened before;
- complain to your data protection supervisory authority.
To exercise a right, email [email protected] or choose "Privacy or data request" on our contact form. We will respond within one month, and may ask you to confirm your identity first. You can also update or delete your account at any time from your profile.
9. Security
We protect data with encryption in transit, hashed passwords, optional two factor authentication, strict separation between workspaces, access controls and regular backups. No system is perfectly secure, but we work to protect your data and will notify you and the relevant authority of a personal data breach where the law requires it.
10. Children
tarsiflow is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.
11. Cookies
We use strictly necessary cookies to run the Service, and optional cookies only with your consent. See our cookie policy for details and to change your choice.
12. Changes
We may update this policy. If the changes are significant, we will tell you by email or in the app before they take effect. The date at the top shows when it was last updated.
13. Contact and complaints
For any privacy question or complaint, email [email protected]. If you are not happy with our response, you can complain to your local supervisory authority, for example the Information Commissioner's Office in the UK or the data protection authority in your EU country.
