Privacy Policy
Last updated: 19 July 2026
This policy explains what personal data Tagaroo (“we”, “us”, operated from Spain) processes when you use tagaroo.ai, why, and what rights you have. We are the data controller for the data described here. Contact: support@tagaroo.ai.
1. Data we process
- Account data — email address, display name, and a salted hash of your password (never the password itself). Legal basis: contract.
- Billing data — plan, subscription status, and credit balance. Card and payment details are collected and stored by our merchant of record, Lemon Squeezy — we never see your card number. Legal basis: contract and legal obligations.
- Content you upload — transcripts, images, annotation schemes, and the annotations produced. We process this content solely to provide the Service. Our terms require you to de-identify content before uploading; do not upload directly identifiable patient data. Legal basis: contract.
- Technical logs — IP address, request identifiers, and error diagnostics, kept for 30 days for security and reliability. Legal basis: legitimate interest.
2. AI processing
When you run AI-assisted annotation, the relevant content is sent to a model provider to generate results: Anthropic Claude models via AWS Bedrock (EU inference) and/or Google Gemini models, depending on the task. These providers process the content as our processors and are configured so customer content is not used to train their models. We do not train models on your content either.
3. Sub-processors
| Provider | Purpose | Region |
|---|---|---|
| Amazon Web Services (AWS) | Application hosting, storage, email delivery | EU (Ireland, eu-west-1) |
| Supabase | Managed PostgreSQL database | EU (Ireland, eu-west-1) |
| Anthropic (via AWS Bedrock) | AI text annotation models | EU inference profiles |
| AI vision/text models (Gemini) | EU/US (Google Cloud) | |
| Lemon Squeezy, LLC | Payments, tax, invoicing (merchant of record) | US |
Application data lives in the EU. Where a sub-processor involves a transfer outside the EEA (e.g. payments), it is covered by the EU Standard Contractual Clauses and/or an adequacy framework.
4. Retention
Account and content data are kept while your account is active and deleted from production systems within 30 days of account deletion (backups expire on their normal cycle). Technical logs are kept for 30 days. Billing records are retained as required by tax law.
5. Your rights
Under the GDPR you can request access to, rectification or erasure of, or a portable copy of your personal data, and you can object to or ask us to restrict processing based on legitimate interest. Write to support@tagaroo.ai. You can also lodge a complaint with your supervisory authority — in Spain, the AEPD (aepd.es).
6. Cookies and tracking
The application stores an authentication token in your browser so you stay signed in — strictly necessary for the Service. We use no advertising trackers.
With your consent, we use Google Analytics 4 to understand which pages and content are useful. Analytics is off by default: no data is sent to Google unless you choose “Accept” in the cookie banner, and rejecting it does not change how the site works. Your choice is stored in a first-party cookie (cc_cookie) for 12 months, and you can change or withdraw it at any time via the “Cookies” link in the footer. When enabled, Google Analytics sets_ga cookies; GA4 does not log or store IP addresses and reports are aggregated.
7. Security
All traffic is encrypted in transit (TLS), data is encrypted at rest, passwords are stored as salted hashes, and infrastructure access follows least-privilege principles inside an EU AWS region. No method is 100% secure; we will notify affected users and the authorities of any breach as the GDPR requires.
8. Changes
We will post updates to this policy here and, for material changes, notify account holders by email or in-app notice.