Privacy Policy
1. Who is responsible
The controller of your personal data is Tao soft EOOD (Тао Софт ЕООД), UIC/BULSTAT 205420526, [REGISTERED ADDRESS: fill in], Sofia, Bulgaria. VAT: [VAT NUMBER, if VAT-registered: fill in]. Contact for privacy matters: [CONTACT EMAIL: fill in].
2. What data we process, why, and on what legal basis (GDPR)
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, password (stored only as a salted hash), account creation time, acceptance of Terms and Privacy Policy | Create and secure your account; prove consent to our terms | Contract, Art. 6(1)(b); legitimate interest in security, Art. 6(1)(f) |
| Company profile text you write, and the matches, scores and AI analyses generated from it | Provide the matching service you subscribed to | Contract, Art. 6(1)(b) |
| Subscription status and billing period, and a billing-account link to Polar via your account number. Polar, as merchant of record, collects your name, billing address, tax details and payment data; we never see or store your card number | Handle payments and access to paid features; accounting | Contract, Art. 6(1)(b); legal obligation (accounting/tax), Art. 6(1)(c) |
| Daily match emails sent to you, alert settings, which matches you were already sent, unsubscribe status | Deliver the daily alerts you ordered and avoid repeats | Contract, Art. 6(1)(b) |
| Verification and service emails (confirm address, billing notices) | Confirm that the address is yours; service communication | Contract, Art. 6(1)(b); legitimate interest in preventing misuse, Art. 6(1)(f) |
| Technical data: IP address, request logs, browser type, error logs | Security, abuse prevention, debugging, rate limiting | Legitimate interest, Art. 6(1)(f) |
| Strictly necessary browser storage (login token, cookie notice) | Keep you signed in | Strictly necessary, see our Cookie Policy |
Please do not put personal data of other people, or special-category data (health, political opinion, etc.), into your company profile. Describe your business, not individuals.
3. Daily emails
If you have an active subscription and have confirmed your email, we send you a daily email listing new matches. This is part of the service you ordered. You can switch it off at any time in your account settings or with the unsubscribe link in each email. We do not send third-party marketing.
4. Who receives your data (processors and recipients)
- Anthropic, PBC (USA): your company profile text and the texts of public funding programmes are sent to Anthropic's API to generate your scores and analyses. Under Anthropic's commercial terms, API inputs are not used to train its models. Your email address and payment data are not sent to Anthropic.
- Polar Software Inc. (USA): our payment partner and merchant of record. It processes payments, calculates and remits VAT, issues invoices and manages subscriptions, and acts as an independent controller for its own legal, tax and fraud-prevention obligations (see Polar's privacy policy). Polar uses Stripe, Inc. for payment processing and payouts.
- Email delivery provider: [EMAIL PROVIDER: fill in] sends our transactional and daily emails.
- Hosting provider: [HOSTING PROVIDER AND REGION: fill in] stores the database and runs the service.
- Authorities and advisers, where required by law (for example tax authorities, accountants, legal advisers), under confidentiality duties.
We do not sell personal data.
5. Transfers outside the EU/EEA
Some providers above are based in, or may process data in, the United States. Where this happens we rely on the EU–US Data Privacy Framework (where the recipient is certified) or on the European Commission's Standard Contractual Clauses, together with supplementary measures where needed. You can request a copy of the safeguards using the contact above.
6. How long we keep data
- Account and profile: until you delete your account, then removed within 30 days (backups may persist up to 90 days).
- Billing and invoice records: as required by Bulgarian accounting and tax law (generally up to 10 years).
- Server and security logs: up to 90 days.
- Unsubscribe and consent records: kept for as long as needed to prove we honoured your choice.
7. Your rights
Under GDPR you may request access to your data, correction, erasure, restriction, portability, and you may object to processing based on legitimate interests. Where processing is based on consent you may withdraw it at any time without affecting earlier processing. Write to [CONTACT EMAIL: fill in]; we reply within one month. You also have the right to lodge a complaint with the supervisory authority: Commission for Personal Data Protection (КЗЛД), www.cpdp.bg, or with the authority in your own EU country.
8. Automated decisions
Scores and verdicts are produced by AI to help you prioritise. They are informational and do not produce legal or similarly significant effects on you. We do not use them to decide whether to provide you the service.
9. Security
Passwords are stored only as salted hashes, traffic is encrypted in transit (HTTPS), card data is handled exclusively by our payment partner Polar and its processor, and access to production data is restricted. No system is perfectly secure; we will notify you and the authority of a breach where the law requires.
10. Children
The service is for businesses and is not directed at anyone under 18.
11. Changes
We may update this policy. For material changes we will notify you by email or in the service before they take effect. The date above shows the latest version.