Tatoma B.V. Privacy Policy
Last updated: October 2026
Tatoma B.V. ("Tatoma", "we", "us", or "our") is committed to protecting your personal data and respecting your privacy. This privacy policy explains how we collect, use, store, and protect the personal data you provide when using our platform and services.
Contents
- Who We Are
- What Data We Collect
- How We Collect Your Data
- How We Use Your Data
- Legal Basis for Processing
- How We Store Your Data
- Emails and notifications
- Artificial Intelligence and Automated Processing
- Data Sharing and Third Parties
- International Data Transfers
- Your Data Protection Rights
- Cookies
- Third-Party Links
- Changes to This Policy
- Contact Us
- Supervisory Authority
Who We Are
Tatoma B.V. is the data controller responsible for your personal data. We provide a multi-tenant SaaS platform that includes client portals, educational resources, AI-powered tools, and team collaboration features.
What Data We Collect
We collect the following categories of personal data:
Account and Identity Data
- Full name
- Email address
- Profile information
- Organization/company name
Authentication Data
- Single Sign-On (SSO) identifiers (when an integration exists)
- Session tokens from our Identity Provider
Usage Data
- Pages and features accessed
- Actions performed within the platform
- Timestamps of activity
- Device and browser information
- IP address
Content Data
- Files you upload to the platform
- Documents and pages you create
- Team member information you add
- Prompts and inputs submitted to AI features
- Weekly check-in scores and optional comments submitted through our mobile applications
- AI-generated outputs and responses
Technical Data
- Browser type and version
- Operating system
- Referral source
- Length of visit and page views
How We Collect Your Data
We collect data through the following methods:
Directly from you when you:
- Register for an account or are invited to an organization
- Use our platform features
- Upload files or create content
- Submit prompts to our AI-powered features
- Complete forms or surveys
- Contact our support team
- Subscribe to communications
Automatically when you:
- Visit and navigate our platform
- Use features that require authentication
- Interact with AI-powered tools
From third parties:
- Your organization administrator (when inviting you to their workspace)
- Authentication providers (WorkOS) for SSO/SAML login
- Connected integrations (Notion, Google Drive) when you authorize access
How We Use Your Data
We use your personal data to:
Provide our services
- Create and manage your account
- Authenticate your access to the platform
- Enable organization-based access control
- Deliver features across our applications
Process AI features
- Analyze and structure prompts you submit
- Generate AI-powered responses and suggestions
- Improve AI model outputs and accuracy based on usage patterns but not on your data
Improve our services
- Analyze usage patterns to enhance user experience
- Debug technical issues
- Develop new features
Communicate with you
- Send notifications about activity on your work
- Send onboarding emails and product updates
- Send marketing emails, if you've agreed to them
- Respond to support requests
- Provide updates about your account or our services
See Emails and notifications for what we send and how to stop it.
AI readiness quick scan
When you take our AI readiness quick scan, we use your answers and the details you give us (name, email, role, company and any comment) to email you your result, to follow up with you about our services and, if you tick the box, to send you our newsletter. We keep them for 2 years after our last contact with you.
Legal and security purposes
- Comply with legal obligations
- Protect against fraud and unauthorized access
- Enforce our terms of service
Legal Basis for Processing
Under GDPR, we process your personal data based on:
| Purpose | Legal Basis |
|---|---|
| Account management and authentication | Contract performance |
| Providing platform features | Contract performance |
| AI feature processing | Contract performance / Legitimate interest |
| Usage analytics | Legitimate interest |
| Security and fraud prevention | Legitimate interest |
| Legal compliance | Legal obligation |
| Emails about activity on your work | Contract performance |
| Onboarding emails and product updates | Legitimate interest: helping you get value from the service your organisation uses, and telling you about changes to it |
| Recording link clicks in onboarding emails and product updates | Legitimate interest: knowing which of our suggestions help |
| Sending your quick scan result and following up about our services | Legitimate interest: offering our services to people who have shown an interest in them |
| Marketing communications | Consent |
| Recording delivery, opens and link clicks in marketing emails | Consent: you agree to it when you switch on news and events |
Where we rely on legitimate interest, you can object at any time. For onboarding emails and product updates, the quickest way is to switch them off in your notification settings. You can also write to us at gdpr@tatoma.eu. For the quick scan, you can also reply to the email with your result, and we stop following up.
How We Store Your Data
Storage locations
We use separate systems to store different types of data:
| Data Type | Storage Provider | Location | Purpose |
|---|---|---|---|
| User identity data | WorkOS | EU/US (with SCCs) | Account credentials, profile information, organization membership, SSO identifiers |
| Application data | Supabase | European Union | Files, documents, content, team information, platform settings |
Security measures
- Encryption in transit (TLS/HTTPS)
- Encryption at rest for all stored data
- Role-based access control
- Regular security assessments
- Secure authentication via WorkOS (SAML/SSO ready)
- Row-level security policies on application data
Retention period
- Active accounts: Data is retained for the duration of your account and your organization's subscription
- Deleted accounts: Personal data is deleted within 30 days of account closure or deletion request
- Backup data: May be retained in encrypted backups for up to 90 days for disaster recovery purposes
- Legal requirements: Some data may be retained longer if required by law or for legitimate business purposes (e.g., billing records)
Emails and notifications
Onboarding emails
When you join the platform through your organisation, we send you a short series of emails suggesting useful next steps, based on how you use the platform.
How often. Up to eight emails over your first four weeks or so, never more than one a day. Then the series ends.
How to stop them. Use the link at the bottom of any of these emails, or switch off "Suggested next steps" in your notification settings. You'll still see the suggestions in the notification centre on the platform.
We send these based on our legitimate interest in helping you get started. You can object at any time by switching them off.
Other notifications
Everything we notify you about appears in the notification centre on the platform. Some notifications are also sent by email:
| Kind | Sent by email? | Can you switch off the email? |
|---|---|---|
| Activity on your work (comments, mentions, replies, assignments and shares involving you) | Yes | Yes |
| Suggested next steps (the onboarding emails above) | Yes | Yes |
| Product updates (what's new on the platform) | Yes | Yes |
| Updates shared with your organisation | No | Not applicable |
Apart from activity on your work, we email you no more than once a week outside the onboarding series. You can switch off each kind of email separately in your notification settings, or with the link at the bottom of any email. Your choice applies in every organisation you belong to.
What we measure in our emails
We record whether our emails are delivered. In onboarding emails and product updates, we also record which links you click, so we know which suggestions help. Our email providers see your IP address and device details when you open or click, and we don't store them. We don't track whether you open our platform emails. Marketing emails are different: MailerLite records whether you open them as well as which links you click, as described under News and events from TATOMA.
News and events from TATOMA
Marketing emails about our events, articles and offers are separate from the platform and from our Terms of Service. We only send them if you agree when you first join the platform, or later under "News from TATOMA" in your notification settings. It's off until you do, only you can switch it on, and leaving it off doesn't affect your use of the platform. If you already get our newsletter, for example after signing up on our website, the switch shows it as on. You can switch it off at any time, there or with the unsubscribe link in any marketing email. We keep a record of your choice and the wording you agreed to.
If your organisation asks us to, we take its people off the list they joined through the platform.
How we handle notification data
We keep a record of the notifications we send you and whether they were delivered, along with your notification settings, your marketing choice and, while you're subscribed, the link to your MailerLite subscription. We keep these while your account exists and delete them within 30 days after it's deleted. We delete the link to your MailerLite subscription as soon as your account is deleted.
Our email provider, Resend, delivers our platform emails. It stores email addresses, email content, and delivery and click records in the United States, under Standard Contractual Clauses and the EU-US Data Privacy Framework, and deletes them after 30 days. If an email to you bounces or is marked as spam, Resend keeps your address on a list so it isn't emailed again. When your account is deleted, we remove your address from that list too.
Our marketing email provider, MailerLite, sends our news and events emails. It stores your email address, your marketing choice and the groups you belong to in the European Union, and records whether each email was delivered and opened and which links you click. It keeps these records for as long as your address is in our account. MailerLite may also process this data from the United States, under Standard Contractual Clauses and the EU-US Data Privacy Framework. When you switch marketing off, or unsubscribe in one of these emails, MailerLite marks your address as unsubscribed so it isn't emailed again. When your account is deleted, we take your address off the list you joined through the platform, and delete it from MailerLite unless you're also on another of our mailing lists, which you can leave with the unsubscribe link in any of our emails.
Artificial Intelligence and Automated Processing
Our platform includes AI-powered features that process your data. We are committed to transparency about how these features work.
AI features we offer
| Feature | Purpose | Data Processed |
|---|---|---|
| Prompt Structuring | Analyze and structure prompts into components (role, context, task, format, tone) | Text prompts you submit |
| AI Cards | Execute customizable AI workflows | Card inputs, queries, and parameters |
| Content Generation | Generate suggestions and responses | Your instructions and context provided |
How AI processing works
- Input: When you use an AI feature, your input (prompts, queries, instructions) is sent to our AI service providers
- Processing: The AI model processes your input to generate a response
- Output: The generated response is returned to you through our platform
- No persistent storage by AI providers: Our AI providers process data in real-time and do not retain your inputs or outputs after processing (see the full list of providers below)
Data usage and model training
- Your data is NEVER used for AI model training: Tatoma does not use your prompts, inputs, generated outputs, or any other customer data to train or fine-tune AI models — neither our own models nor those of any third-party provider. This is a firm commitment, not a default that can be changed. We have contractual agreements with all our AI providers ensuring that your data is not used for model training.
- No cross-user data sharing: Your AI interactions are completely isolated and are never shared with other users or organizations
- No data retention by AI providers: Our AI providers process your data in real-time only and do not retain your inputs or outputs after processing is complete
Aggregated and anonymised data
We may collect and use aggregated, anonymised data to improve our platform and services. This includes:
- Feature usage analytics (e.g., which features are most popular, how often they are used)
- Performance metrics (e.g., response times, error rates)
- General usage patterns (e.g., peak usage times, common workflows)
This data is fully anonymised and cannot be used to identify any individual user or organisation. It is never linked back to your personal data or content. We use this information solely to improve the reliability, performance, and usability of our Services.
AI service providers
| Provider | Services | Data Processing Location | Retention |
|---|---|---|---|
| OpenAI | Language model inference | United States | No retention (real-time processing only) |
| Anthropic | Language model inference | United States | No retention (real-time processing only) |
| Groq | Language model inference | United States | No retention (real-time processing only) |
| Mistral | Language model inference and embeddings | European Union | No retention (real-time processing only) |
| Google (Gemini) | Language model inference | United States | No retention (real-time processing only) |
| Perplexity | AI-powered research and search | United States | No retention (real-time processing only) |
| Tavily | AI-powered web search | United States | No retention (real-time processing only) |
Your rights regarding AI processing
You have the right to:
- Opt out: You can choose not to use AI-powered features
- Human review: Request human review of any AI-assisted decisions that significantly affect you
- Explanation: Request an explanation of how AI features process your data
- Object: Object to automated processing under GDPR Article 22
Limitations and accuracy
AI-generated content:
- May contain errors or inaccuracies
- Should be reviewed before use in critical applications
- Does not constitute professional advice (legal, medical, financial, etc.)
- Is provided "as is" without warranties of accuracy or completeness
Data Sharing and Third Parties
We share your data with the following categories of third parties. For a complete list of our current sub-processors, please see our Sub-processors page.
Service providers
| Provider | Purpose | Data Shared |
|---|---|---|
| WorkOS | Identity management, authentication, and SSO | Email, name, profile data, organization membership |
| Supabase | Application database hosting | Application data: files, documents, content, settings (encrypted) |
| Vercel | Application hosting | Technical/usage data, server logs |
| Sentry | Error tracking and log search | Error reports, server logs, IP addresses, user agents |
| Resend | Platform email delivery | Email address, email content, link clicks |
| MailerLite | Marketing email delivery (with your consent) | Email address, marketing choice, group membership, delivery, open and click records |
| Notion | Keeping quick scan results for our follow-up | Name, email, role, company, comment and score from the quick scan |
| Google (Sheets) | Keeping quick scan results for our follow-up | Quick scan answers and score, name, email, role, company and comment |
| Slack | Telling our team about a new quick scan result | Name, email, role, company, comment, score, result profile and newsletter choice from the quick scan |
| Expo | Push notification delivery | Device push tokens, notification content |
| OpenAI | AI language processing | Prompts and inputs (real-time, no retention) |
| Anthropic | AI language processing | Prompts and inputs (real-time, no retention) |
| Groq | AI language processing | Prompts and inputs (real-time, no retention) |
| Mistral | AI language processing | Prompts and inputs (real-time, no retention) |
| Google (Gemini) | AI language processing | Prompts and inputs (real-time, no retention) |
| Perplexity | AI-powered research | Queries and context (real-time, no retention) |
| Tavily | AI-powered web search | Search queries (real-time, no retention) |
| LangSmith (LangChain) | AI tracing and quality analysis | Prompts and inputs, retained as traces |
Connected integrations (when authorized by you)
| Integration | Purpose | Data Shared |
|---|---|---|
| Notion | Content import and display | Page content, access tokens |
| Google Drive | File management | File metadata, access tokens |
Mobile applications
Our mobile apps (including The Number) communicate exclusively with Tatoma platform servers. No data is shared with third-party services through our mobile applications. For details, see our Mobile Apps Privacy Policy.
Other disclosures
We may also disclose your data:
- To comply with legal obligations or court orders
- To protect our rights, privacy, safety, or property
- In connection with a merger, acquisition, or sale of assets (with notice to you)
We do not sell your personal data to third parties.
International Data Transfers
Your data may be transferred to and processed in countries outside of the European Economic Area (EEA). When this occurs, we ensure appropriate safeguards are in place:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- EU-US Data Privacy Framework certification where applicable
- Data processing agreements with all service providers
- Verification that recipients maintain adequate data protection standards
Your Data Protection Rights
Under GDPR, you have the following rights:
Right to access
You can request a copy of the personal data we hold about you.
Right to rectification
You can request correction of inaccurate or incomplete data.
Right to erasure ("Right to be forgotten")
You can request deletion of your personal data, subject to legal retention requirements. We offer a self-service "Delete My Account" feature accessible from your Manage Data page. Account deletion includes a 14-day grace period during which you can cancel the request.
Right to restrict processing
You can request that we limit how we use your data in certain circumstances.
Right to object
You can object to processing based on legitimate interests, including profiling.
Right to data portability
You can request your data in a structured, machine-readable format. We offer a self-service "Export My Data" feature accessible from your Manage Data page. This allows you to download all your personal data as a structured ZIP file containing JSON exports organised by category.
Right to withdraw consent
Where processing is based on consent, you can withdraw it at any time.
How to exercise your rights
Self-service options: You can exercise your right to erasure and right to data portability directly from your Manage Data page without needing to contact us.
For all other requests: Contact us using the details below. We will respond within one month of receiving your request.
Cookies
What are cookies?
Cookies are small text files placed on your device to collect standard internet log information and visitor behavior data.
How we use cookies
We use cookies to:
- Keep you signed in to your account
- Remember your preferences and settings
- Understand how you use our platform
- Ensure security of your session
Types of cookies we use
| Type | Purpose |
|---|---|
| Essential | Required for authentication and core platform functionality |
| Functional | Remember your preferences (language, organization selection) |
| Analytics | Help us understand usage patterns and improve our services |
Managing cookies
You can configure your browser to refuse cookies or alert you when cookies are being sent. Note that some platform features may not function properly without essential cookies.
For more information about cookies, visit allaboutcookies.org.
Third-Party Links
Our platform may contain links to external websites or services (e.g., Notion pages, Google Drive files). This privacy policy applies only to our platform. We encourage you to review the privacy policies of any third-party services you access.
Changes to This Policy
We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by:
- Posting the updated policy on our platform
- Updating the "Last updated" date
- Sending an email notification for material changes (where appropriate)
Contact Us
If you have questions about this privacy policy or wish to exercise your data protection rights, please contact us:
Email: gdpr@tatoma.eu
Postal Address: Tatoma B.V. Achtseweg Zuid 221 5651 GW, Eindhoven The Netherlands
Data Protection Officer (if applicable): Israel Roldán (gdpr@tatoma.eu)
Supervisory Authority
If you are not satisfied with how we handle your personal data or respond to your requests, you have the right to lodge a complaint with a supervisory authority.
For the Netherlands: Autoriteit Persoonsgegevens (Dutch Data Protection Authority) Website: https://autoriteitpersoonsgegevens.nl
For other EU/EEA countries, you may contact your local data protection authority.
This privacy policy is effective as of the "Last updated" date above.