Privacy Policy — Tadashi

This Privacy Policy explains how Tadashi ("we", "us", or "our") collects, uses, and protects your personal information when you use the Tadashi platform ("the Service"). We are committed to handling your data transparently and in accordance with applicable data protection law, including the UK GDPR.

1. Information We Collect

We collect the following categories of information:

Account information — your name, email address, and password when you register
Business information — business name, description, industry, brand guidelines, tone of voice, and other details you provide during setup or in settings
Content and media — images, videos, and written content you upload to the media library or enter into the platform
Calendar and event data — dates, events, and product/service information you add to support marketing plan generation
Social media connection data — access tokens and account identifiers for connected social media accounts (Instagram, Facebook, LinkedIn, etc.)
Analytics data — post performance metrics retrieved from connected social media platforms
Usage data — log data, device information, IP addresses, browser type, and actions taken within the Service
Billing information — payment details are handled by our payment processor (Stripe) and we do not store full card details

2. How We Use Your Information

We use the information we collect to:

Provide, operate, and improve the Service
Generate AI-powered marketing plans and content using your business profile
Publish approved content to your connected social media accounts
Retrieve analytics from connected social platforms to improve future content
Send you notifications about your plan, content, and account activity
Process payments and manage your subscription
Respond to support requests and communicate with you about the Service
Detect and prevent fraud, abuse, or security incidents
Comply with legal obligations

3. AI Processing

The Service uses Anthropic's Claude AI models to generate marketing plans and social media content. Your business profile, uploaded content descriptions, and event data are sent to Anthropic's API to produce this output. Anthropic processes this data in accordance with their own privacy and API usage policies. We do not share personally identifiable information about you as an individual with Anthropic beyond what is incidentally included in the prompts you configure.

4. Sharing Your Information

We do not sell your personal information. We share data only in the following circumstances:

Service providers — third parties who help us operate the Service, including cloud infrastructure (Vercel, Neon), AI providers (Anthropic), storage providers, payment processors (Stripe), and email delivery services. These providers process data on our behalf under appropriate data processing agreements.
Social media platforms — when you connect an account, we share content and receive analytics data from that platform's API as authorised by you.
Team members — other users within your business account can view content, plans, and media you create.
Legal compliance — where required by law, court order, or to protect the rights and safety of Tadashi, our users, or others.
Business transfers — in the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction with appropriate notice to you.

5. Data Retention

We retain your account and business data for as long as your account is active. If you cancel your account, we will retain your data for a period of 90 days before deletion, to allow for account recovery. Analytics data and audit logs may be retained for longer periods as required for legal or operational purposes. You may request earlier deletion of your data — see Section 8.

6. Security

We take reasonable technical and organisational measures to protect your data, including encryption in transit (TLS), encryption at rest for sensitive credentials (such as social media access tokens, which are encrypted using AES-256-GCM), and access controls limiting who within our organisation can access your data. No system is completely secure, and we cannot guarantee absolute security.

7. Cookies

We use essential cookies to maintain your session and keep you signed in. We do not use tracking or advertising cookies. If we introduce analytics or other non-essential cookies in future, we will update this policy and seek your consent where required.

8. Your Rights

If you are located in the UK or EEA, you have the following rights under applicable data protection law:

Access — request a copy of the personal data we hold about you
Rectification — ask us to correct inaccurate data
Erasure — request deletion of your personal data, subject to legal obligations
Portability — receive your data in a structured, machine-readable format
Restriction — ask us to restrict processing of your data in certain circumstances
Objection — object to processing based on legitimate interests

To exercise any of these rights, contact us at privacy@tadashi.xyz. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

9. International Transfers

Some of our service providers are based outside the UK or EEA. Where we transfer personal data internationally, we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions, in accordance with UK GDPR requirements.

10. Children

The Service is not directed at children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, please contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via the Service. Continued use of the Service after changes take effect constitutes your acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us at privacy@tadashi.xyz.