Tanqory Global Privacy Policy

Introduction

Tanqory (“we”, “our”, or “the Company”) is committed to protecting your personal data. This global Privacy Policy describes how we collect, use, share, and safeguard personal information when you use our platform and services. Tanqory Inc. (Delaware, USA) is the controller of the personal data described in this Policy, except where we process data on a merchant's behalf as its processor. We also strive to comply with relevant data protection laws in other jurisdictions (such as the EU GDPR, UK DPA, CCPA, etc.) that apply where we operate. By using Tanqory’s services, you agree to the practices described in this Policy.

Personal Data We Collect

We collect personal information necessary to provide our e-commerce platform and related services. This may include:

• Identification and Contact Data: Name, phone number, email address, and other contact details.

• Account and Business Information: Username/login credentials, store or business information you provide (such as store name, address, tax or registration details), and any content you upload to our platform.

• Technical and Device Data: IP address, browser type, device identifiers, and usage data collected automatically when you interact with our website or app (e.g. pages visited, time stamps).

• Payment Information: Billing and payment details (like credit card number or payment account info) required for transactions. Payment data is collected via secure third-party payment processors, not stored in full by Tanqory beyond what is necessary for record-keeping.

• Customer Communications: Information you provide in correspondence with us, including through support chats, emails, or phone calls (which may be logged for service quality and issue resolution).

We do not intentionally collect any sensitive personal data. This means we do not collect biometric identifiers, health or medical data, precise geolocation tracking, or other special-category personal information from you in the ordinary course of business. If we ever need to handle such data (for example, if you voluntarily provide it), we will obtain explicit consent or ensure compliance with applicable law.

How We Collect Information

We obtain personal data about you through multiple channels:

• Directly from You: When you use our website or mobile app, create an account, fill out forms, or communicate with us. For example, we collect data when you register on Tanqory, complete your profile, list a product, or contact customer support. Whenever you submit web forms on our sites – for instance, signing up, subscribing to newsletters, or engaging with our chatbot – we receive the personal information you choose to provide. This also covers the text you enter into a "describe / build your store" prompt before you create an account: if you submit such a prompt, we briefly carry the text you typed (together with the AI model and language you selected) across our *.tanqory.com sites to the sign-up / AI store-builder flow so it can pre-fill your request, after which it is discarded (see the tanqory_pending_prompt entry in our Cookie Policy). Because these prompts are free-text, please avoid entering sensitive personal information you do not want processed for this purpose.

• Through Our Platform Usage: We automatically collect certain technical data via cookies and similar technologies when you interact with our website/app. This includes IP address, device information, and browsing behavior (e.g. pages viewed, actions taken), as described above. These help us understand usage patterns and secure our services.

• Third-Party Integrations and SDKs: If you choose to connect Tanqory with third-party services or through social logins, we may receive information from those sources. For example, if you register or log in via a Third-Party Social Media Service (such as Google or Facebook), we may collect data associated with your social profile (like your name and email) as permitted by that service. Similarly, if our mobile app includes Software Development Kits (SDKs) from external providers (for analytics, push notifications, etc.), those SDKs may transmit certain data to us (per their disclosures and with your consent where required).

• Support and Chat Communications: Our platform may offer chatbot or live support features. If you engage with our chatbot or support agents, we collect the information you provide during the conversation (e.g. problem descriptions, contact info) to assist you. We may also record chat transcripts for training and quality assurance purposes as allowed.

• Payments and E-commerce Tools: When you make or receive payments via Tanqory, personal data is collected through our payment processing partners. For instance, our payment service providers will collect your payment card details and billing information on our behalf to process transactions securely. We receive confirmation of your payments and limited billing details to record the transaction, but full financial information (like your card number) is handled by the payment gateway. Additionally, if you integrate third-party apps or plugins (e.g. for email marketing, shipping, or analytics), those tools may send us data (or vice versa) as needed to function – always under the permissions you grant and in accordance with this Policy.

Cookies and Tracking: We use cookies and similar technologies on our site to provide core functionality, analyze usage, and facilitate advertising (see Advertising & Analytics below). Where required by law, we will obtain consent for non-essential cookies. You can adjust your browser settings to refuse cookies; however, some features of our services may not function properly without them.

How We Use Personal Data

We process the collected personal data to operate and improve Tanqory’s platform, in accordance with applicable legal bases. The primary purposes for which we use your information include:

• Providing and Improving Our Services: We use personal data to create and manage user accounts, enable store setup and listings, process orders and payments, facilitate shipping, and deliver the functionalities of our platform to you. This includes using data to personalize your experience (such as language preferences or recommended features) and to develop new features or enhance existing ones based on user feedback and usage patterns.

• Customer Support: Information (like your contact and inquiry details) is used to respond to your questions, requests, and to provide technical assistance or other support. For example, we may reference your account data to help troubleshoot an issue you reported, or use your email/phone to communicate updates on a support ticket.

• Analytics and User Behavior Insights: We analyze how users interact with our platform (pages visited, features used, etc.) to better understand user behavior and preferences. This helps us improve the user interface, optimize performance, and inform our business decisions. These analyses are typically conducted on an aggregated basis, and when we generate reports or trends, individual users are not identified.

• Marketing and Ads Personalization: We may use your information to provide you with marketing communications and personalized advertisements about Tanqory services or partner offers, but only as permitted by law. For instance, we might send account holders promotional emails about new features or use cookies to remarket our services to you on other platforms. In practice, this can involve sharing hashed or anonymized identifiers about your site visits with advertising partners like Google or Meta (Facebook) so that they can show you relevant ads on our behalf. You can opt-out of marketing emails at any time by using the unsubscribe link, and you can manage ad targeting preferences via your browser or the third-party platforms. (Note: We do not sell your personal information to third parties for their own marketing; see No Sale of Personal Data below.)

• Fraud Prevention and Security: Ensuring the security of our platform and users is paramount. We process personal data to prevent fraud, abuse, or security risks. For example, we may use IP address and device data to detect suspicious logins, use automated tools to flag fraudulent transactions, or review accounts to prevent misuse. We also may use your data as necessary to enforce our terms of service, to investigate potential violations, and to protect the rights and safety of our users and the public.

• Legal Compliance: We will use or disclose personal data where required to comply with legal obligations. This includes maintaining transaction records for accounting/tax purposes, responding to lawful requests by authorities, or using data to fulfill compliance obligations (e.g. screening against sanctions lists if required for payments). We also process data to comply with user data access or deletion requests as described in Your Rights below.

• Other Legitimate Interests: We may process data for other legitimate interests, after balancing them with your privacy rights. These interests include internal research and reporting (e.g. measuring performance, auditing our systems), facilitating business transactions (such as a merger or acquisition, in which case data may be transferred with appropriate protections), or ensuring our platform's functionality (like using crash reports or error logs via tools such as Sentry to fix bugs).

We always limit the data collected and used to what is relevant for these purposes. Where required by law, we rely on an appropriate legal basis for processing (e.g. your consent for marketing cookies, contractual necessity to provide services you requested, or our legitimate interests in improving security, etc.). If we ever need to process your personal data for a new purpose that is incompatible with the original purposes, we will notify you and obtain consent as required.

Sharing of Personal Data with Third Parties

Tanqory does not sell or rent your personal information to third-party companies for their independent marketing purposes. We only share your data in limited circumstances, described below, and always with safeguards in place. Key instances where data is shared include:

• Tanqory Inc. (Delaware, United States) operates the Tanqory platform and is the controller for the processing described in this Policy. It is also the sender of record for SMS/text messages sent to United States recipients through the platform's messaging features.

• Authorized Service Providers (Subprocessors): We utilize reputable third-party companies to support our operations. These subprocessors handle data on our behalf for specific functions – such as cloud hosting, payment processing, messaging, and analytics – and only process data under our instructions. We maintain a public list of our subprocessors, including their roles and locations, to keep you informed. Our current critical subprocessors include:

  • DigitalOcean, LLC (Singapore SGP1) – Primary cloud hosting (Kubernetes, Managed PostgreSQL, Managed Valkey/Redis, Spaces, Container Registry).

  • Cloudflare, Inc. (global edge network) – DNS, CDN, WAF, DDoS protection, R2 object storage, Workers, API Shield, and Turnstile (anti-bot challenge service).

  • MongoDB, Inc. (AWS ap-southeast-1, Singapore) – Vector search and document storage for the AI service.

  • Amazon Web Services, Inc. (ap-southeast-1) – S3 bucket for theme asset storage.

  • Sentry (Functional Software, Inc.) (USA, EU region available) – Error tracking with minimized/pseudonymized data.

  • Twilio SendGrid (Twilio Inc.) (USA) – Transactional email delivery (account, billing, magic links, password reset).

  • Resend, Inc. (USA) – Secondary transactional email transport.

  • Vonage Holdings Corp. (global) – SMS delivery: platform security messages (multi-factor authentication, login alerts), transactional and service SMS, and merchant messaging sent through the platform.

  • Twilio Inc. (global) – SMS, messaging delivery, and telecom compliance registration (including A2P sender registration with United States carriers for messages sent through the platform).

  • WhatsApp Business Platform (Meta) – delivery of messages sent over WhatsApp where a merchant or user chooses that channel; acts as our processor.

  • Domain registrar – Namecheap, Inc. (United States) – Registration, renewal, and transfer of domain names that merchants register through Tanqory. When you register or transfer a domain, the registrant details you provide (name, email address, postal address, and phone number) are sent to the registrar. Where required, the registrar provides registration data to the registry for the domain, ICANN, data escrow providers, and registration data services, and it processes that data under its own obligations to ICANN and the registry. See the Domain Services Addendum.

  • Google LLC – Firebase Cloud Messaging (USA/global) – Push notifications to Android.

  • Apple Inc. – Apple Push Notification service (USA/global) – Push notifications to iOS.

  • Liveblocks Inc. (USA) – Real-time collaboration in admin and store applications.

  • Canva Pty Ltd (Australia / global) – Embedded design tooling (admin integrations).

  • Payment processors – Stripe, Inc. (United States) as the primary processor for new billing relationships from 4 June 2026, with Stripe Payments Singapore Pte. Ltd. retained for legacy regional flows; PayPal Holdings, Inc.; and Braintree, a service of PayPal, Inc. These processors receive your payment data directly to complete transactions; Tanqory operates under PCI-DSS SAQ-A (no card data touches Tanqory infrastructure). Stripe payouts for new flows settle to a Tanqory Inc. operating account at Column N.A. (Member FDIC), serviced through Mercury Technologies, Inc. (see _compliance/sources-of-truth/11-banking.yaml).

  • AI / LLM providers (selectable, controller-instructed) – OpenAI, L.L.C. (USA, training opt-out, zero-data-retention enterprise tier requested); Anthropic, PBC (USA, training opt-out); Google LLC – Gemini (USA, Google Cloud DPA); Apple Inc. – Foundation Models (on-device only); CopilotKit, Inc. (USA, managed in-product AI copilot; downstream LLMs are the providers listed here); and DeepSeek (Hangzhou DeepSeek AI Co., Ltd.) (People's Republic of China), disabled by default and available only on explicit customer opt-in (no production data routed by default; EU/EEA/UK/Switzerland additionally require an Order Form amendment).

  • AI image processing (mobile app) – PhotoRoom SAS (France/EU) – AI background removal / product-image editing; images you submit for editing are transmitted to PhotoRoom's servers (not processed solely on-device).

  • Authentication / identity providers – if you choose to sign in using a third-party account, the relevant provider authenticates you and shares basic profile information (name, email) with us: Google LLC ("Sign in with Google"), Apple Inc. ("Sign in with Apple", which may relay a private email), and Meta Platforms, Inc. ("Continue with Facebook"). We also use Google Maps Platform (Places API) (Google LLC) for address autocomplete, which sends the partial address you type to Google.

  • Analytics & telemetry – PostHog, Inc. (USA / EU Cloud option) – product analytics (usage events, feature interactions); Google LLC – Google Analytics for Firebase – mobile app usage analytics; Grafana Labs (Raintank, Inc., USA) – observability/telemetry (metrics, traces, logs).

  • Advertising / conversion measurement (mobile app) – Google LLC – Google Ads on-device conversion measurement – measures advertising conversions in the Tanqory mobile app. On iOS this relies on the device advertising identifier (IDFA) and is only used after you grant permission through Apple's App Tracking Transparency prompt; on Android it may use the advertising ID (AAID). See our Mobile App Privacy Disclosures for details on tracking, advertising identifiers, and how to opt out.

  • Stock imagery (mobile app) – Unsplash Inc. (Canada) and Pexels GmbH (Germany) – stock-image search and insertion (primarily content-licensing relationships).

• We have agreements in place with all subprocessors to ensure your data is protected. Each service provider is obligated to implement security measures and use your data only for the purposes we specify, in line with this Policy. We will update the public subprocessor list on our website whenever we add or change providers, and you may contact us if you have questions about any specific provider. (If applicable laws grant you the right to object to a particular subprocessor, we will assess such requests – for example, GDPR allows objections in some cases. We note, however, that subprocessors are essential for our service, so using Tanqory generally implies consent to these engagements.)

• Business Transfers: If Tanqory undergoes a business transaction such as a merger, acquisition by another company, restructuring, or sale of all or part of its assets, personal data may be transferred to the successor or acquiring entity. In such an event, we will ensure your data remains subject to confidentiality commitments, and we will provide notice before your personal data becomes subject to a different privacy policy.

• Legal Compliance and Protection: We may disclose personal information to government authorities, regulators, or other third parties if required by law or legal process (such as in response to a subpoena or court order). We will only do so after verifying the request and when we believe in good faith that disclosure is legally necessary. Additionally, we may share information when needed to enforce our terms, investigate potential fraud or security issues, or protect the rights, property, and safety of Tanqory, our users, or others. For example, we might share data with law enforcement to investigate misuse of our platform or with external auditors to meet regulatory compliance.

• With Your Consent or Direction: We will share your personal data with other parties if you instruct us to or explicitly consent. For instance, if you use a feature to publish your storefront and you want to integrate a third-party tool that requires Tanqory to send some of your data to that tool, we will do so with your authorization. Or if you explicitly consent to share a testimonial including your information, we may publish it as you direct. In all such cases, we will make clear when the data will be shared externally so you can decide whether to proceed.

Aside from the above, any sharing of anonymized data (which contains no personal identifiers) is not restricted – for example, we may disclose aggregated platform usage statistics or market trends that do not identify any individual or business. In fact, we may create and use de-identified datasets derived from personal data for legitimate business purposes – such as improving our AI models, publishing insights, or collaborating with partners – provided that such information cannot be linked back to any individual. We will not share anonymized data in a way that could re-identify you.

No Sale of Personal Data: We want to reiterate that we do not sell your personal information to data brokers or third parties for monetary gain or for their independent use. “Selling” in this context refers to disclosing personal data to another company for valuable consideration (as defined under laws like the CCPA). Tanqory does not engage in such activities. Any sharing we do is strictly for the purposes outlined above (service provision, legal compliance, etc.), and often the term “sharing” under privacy laws would refer to things like targeted advertising use, which we’ve described under Ads Personalization and which you can opt out of. If this stance ever changes, we will update this Policy and provide any required opt-out mechanisms.

Google User Data

When a merchant connects Google services to their Tanqory store, Tanqory accesses Google user data only with the merchant's permission on Google's consent screen, and only for the features the merchant turns on:

• Google Merchant Center (content scope): we list the Merchant Center accounts the merchant can access, create a Merchant Center account for the store when the merchant asks us to, register the store's product feed as a data source, and read and set the account's shipping settings, so the store's products can be listed on Google.
• Google Ads (adwords scope): we read the conversion actions and the daily performance figures (cost, impressions, clicks, conversions) of the merchant's own Google Ads account to show the merchant's ad results in Tanqory, record refunds against conversions we reported, and create the customer lists the merchant chooses to sync.
• Google Ads customer data (datamanager scope): through the Google Data Manager API we send the store's purchases (order id, value, currency, time and, when the shopper consented, hashed contact details) to the merchant's own Google Ads account as conversions, and, when the merchant turns on audience sync, we add the hashed contact details of the store's consenting customers to the merchant's own Google Ads customer list.

How we handle this data:

• We store Google access tokens encrypted and use them only for the features above. We delete them when the merchant disconnects Google in Tanqory, and the merchant can also remove Tanqory's access at any time in their Google Account.
• We do not sell Google user data, use it for advertising, or transfer it to others, except as needed to provide these features, for security, to comply with the law, or as part of a merger or acquisition.
• Tanqory staff do not read Google user data, except with the merchant's permission, for security, or to comply with the law.
• We do not use Google user data to develop, improve or train generalized AI or machine-learning models.

Tanqory's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Mobile Information and SMS

This section applies to phone numbers and related mobile information processed in connection with SMS (text) messaging on the Tanqory platform.

Mobile information and phone numbers obtained through SMS opt-in will not be sold, rented, or shared with any third parties or affiliates for marketing or promotional purposes.

• What mobile information we collect: Your phone number, your opt-in status and the date/time you opted in, and message delivery metadata (such as delivery status, timestamps, and the message type sent).

• Who receives it: Phone numbers are shared with our communications subprocessors (currently Vonage Holdings Corp. and Twilio Inc., listed above) solely to deliver the messages you have asked to receive, and with no one else. These providers act under our instructions and may not use your mobile information for their own purposes.

• Merchant messaging: Where a merchant on the Tanqory platform sends SMS to its own customers through our messaging features, consent is collected by that merchant, and Tanqory processes the mobile information on the merchant's behalf as a data processor. The merchant is responsible for obtaining valid consent from its customers; Tanqory provides the delivery platform and enforces opt-out handling.

• Opting out and getting help: You can stop receiving SMS at any time by replying STOP to any message, and you can get assistance by replying HELP. For full details — including message categories, frequency, cost, and carrier disclosures — see our Messaging Terms.

International Data Transfers and Regional Hosting

Tanqory operates a multi-region, multi-cloud platform. Your data is hosted in the business region assigned to your merchant account at signup; we operate four business regions:

By default, your data is placed in the business region closest to your billing country. Enterprise merchants may select a specific business region via Order Form or DPA addendum. The current region map is published at https://trust.tanqory.com/regions.

In addition, Cloudflare provides our global edge layer (DNS, CDN, WAF, DDoS protection, R2 object storage). Cloudflare may cache or proxy non-personal request data on its global edge network; Cloudflare is not the primary store of personal data.

Some processing — for example, certain AI inference requests (OpenAI, Anthropic), email/SMS delivery (SendGrid, Resend, Vonage, Twilio), push notifications (FCM, APNs), error telemetry (Sentry), and global support handling — is performed by third-party subprocessors that may operate outside your assigned business region. Transfers to such subprocessors are governed by the safeguards described below.

• PDPA (Singapore) Compliance: Singapore’s PDPA has an overseas transfer requirement – organizations must ensure that any personal data transferred out of Singapore receives a standard of protection comparable to that under the PDPA. In practice, this means Tanqory will only transfer data to jurisdictions or entities that have robust data protection measures in place. All our subprocessors are contractually bound to protect your information to PDPA standards (and often, international standards like GDPR as well). We also leverage mechanisms like model contractual clauses or certifications (where applicable) to meet these requirements.

• EU and Other Regions: For personal data transfers from the European Economic Area (EEA), United Kingdom, or Switzerland to countries not recognized as providing “adequate” data protection by relevant authorities (such as transfers to the United States), we implement appropriate safeguards in accordance with applicable data protection laws. These safeguards include the use of Standard Contractual Clauses (SCCs) approved by the European Commission and UK International Data Transfer Agreements or Addendums, plus Transfer Impact Assessments and supplementary measures where needed. If we later certify under an approved framework (e.g., EU-U.S. Data Privacy Framework), we will publish our certification status; until then, we rely on SCCs/UK IDTA (or adequacy) for such transfers. We are committed to complying with Chapter V of the General Data Protection Regulation (GDPR), ensuring that your personal data continues to benefit from effective protection even when transferred outside the EU or other jurisdictions with similar standards. Our cross-border data handling practices are designed to maintain a consistent level of privacy, security, and legal compliance regardless of the destination country.

• Other Country Laws: We also adhere to cross-border rules in other jurisdictions, such as China's PIPL (CAC Standard Contract where applicable), India's DPDP, South Korea's PIPA, the UAE's Federal Decree-Law on Personal Data Protection, and similar regimes that restrict overseas transfers. In each case, we assess the legal requirements and ensure an appropriate transfer mechanism (legal adequacy, the merchant's consent, contractual obligation, or a region-pinning arrangement under the business-region model described above) is in place. Region-specific privacy annexes apply where relevant: Brazil LGPD — see annex/regions/brazil-lgpd.md; Switzerland FADP — see annex/regions/switzerland-fadp.md; Quebec Law 25 (sub-annex to Canada PIPEDA) — see annex/regions/canada-quebec-law-25.md. For minors in the United States, the Children's Online Privacy Protection Act (COPPA) applies — see data-protection/coppa-compliance-statement.md.

Regardless of where your data is processed, we apply the same level of security and privacy protections described in this Policy. Our contracts with service providers and internal policies are designed to maintain the confidentiality and integrity of personal data worldwide. If you have questions about international data transfers or want more information about the safeguards we use, please contact us (see Contact Us section below).

Data Retention and Deletion

We retain personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy or as required by law. In practice, the retention period for your data will depend on various factors:

• Active Account/Service Provision: For as long as you maintain an account with us or use our services, we will retain the personal data associated with your account. This is necessary to provide you with the service (e.g. to keep your storefront running, to show your transaction history, etc.). If you are a merchant, as long as you are active on Tanqory, we retain data like your store information and order records.

• Business Relationship and Transactions: We keep records of transactions and interactions for a reasonable period even after you stop using the service, in case you return or for reference to any inquiries. For example, if you close your account, we might still retain certain transaction records for a period needed for accounting and to handle any post-closure issues (refunds, chargebacks, disputes).

• Legal and Regulatory Obligations: Certain information will be retained to comply with laws. For instance, financial and payment records are often kept for tax, audit, and accounting purposes for a minimum period as required by law. Also, if we are required by law to keep data for a certain time (e.g., logs under cybersecurity regulations), we will retain according to those rules. We also consider statutes of limitations for potential legal claims – data might be kept to defend against or assert claims.

• Legitimate Business Needs: Sometimes we may retain data longer for legitimate interests such as fraud prevention, safety, and dispute resolution. For example, if we deactivate an account for fraud, we might keep certain information to prevent that user from re-registering. Or we may retain correspondence with customer support for some time to improve our services or to establish a record of how an issue was resolved. In all cases, if we retain data for such purposes, we ensure it remains protected and only used for those intended purposes. According to our guidelines (and those of our industry), we may retain personal data longer if necessary to comply with legal obligations, resolve disputes, or enforce our agreements.

Once personal data is no longer needed for the above purposes, we will take steps to remove or anonymize it. Specifically, our policy is to either delete the data or anonymize (de-identify) it, as appropriate, to ensure it no longer identifies you.

• Deletion: This involves securely erasing personal data from our active systems and backups. Once deleted, the data cannot be readily recovered. We follow industry-standard practices for secure deletion. For example, when you exercise your right to delete (or when our retention period expires), we will remove personal identifiers from our databases and overwrite or otherwise expunge the data.

• Anonymization: In some cases, rather than complete deletion, we may transform the data into an irreversible anonymous form. For instance, we might aggregate usage data or purchase statistics so they are no longer linked to any individual user. By doing so, the information is no longer “personal data” and can be kept for analytics or statistical purposes without impacting your privacy. Any residual information kept will not be identifiable to you. For example, we might retain overall sales volumes or site traffic metrics for business analysis, but these metrics will not contain personally identifying details once the data is anonymized.

In summary, we retain your personal data only as long as we have a valid reason to keep it. When that reason no longer exists, we remove the data from our systems or anonymize it. If you decide to close your Tanqory account, we will initiate deletion of personal data associated with your account (after confirming any regulatory requirements to retain certain data). Do note that deletion may not be immediate; our backup systems might retain data for a short period (e.g. encrypted backups rotated on a 30-day cycle), but we have processes to ensure that once the retention period is over, data is expunged from all systems.

Your Data Protection Rights

Tanqory respects your rights to control your personal data. Depending on the laws that apply to you (PDPA, GDPR, etc.), you may have some or all of the following data subject rights. We provide mechanisms for you to exercise these rights, typically through your account settings or by contacting us at our designated email. We will respond to valid requests within the timeframes required by law (for example, GDPR generally requires within 30 days). These rights include:

• Right of Access: You have the right to request confirmation of whether we are processing your personal data, and to obtain a copy of the personal data we hold about you. This includes information on the categories of data, the purposes of processing, and the parties with whom it’s shared. How to exercise: You can request your data report by contacting us (see Contact Us). We may ask you to verify your identity before providing the data. (For account holders, we may also offer self-service access to certain data – e.g., you can view your account profile, order history, etc., when logged in.)

• Right to Rectification (Correction): If you believe any personal data we have is inaccurate or incomplete, you have the right to have it corrected or updated. How to exercise: Many profile fields can be edited directly in your account (for example, you can update your contact information or store details). For any information you cannot change yourself, you can contact us to request correction. We’ll make the corrections as soon as possible, or add supplementary information if appropriate.

• Right to Erasure (“Right to be Forgotten”): You may request that we delete your personal data when it is no longer needed for the purposes for which it was collected, or if you withdraw consent (where applicable), or in other cases provided by law. This right is not absolute – for example, if retention is required by law or if the data is needed for legal claims, we may deny deletion of those specific pieces of data. How to exercise: If you wish to close your account and delete your data, you can typically do so in your account settings or by contacting support. Upon verification of your request, we will delete or anonymize your personal data within the timeframe required by law (and will confirm with you once completed), subject to any legal retention requirements.

• Right to Data Portability: For data you provided to us and which we process by automated means on the basis of consent or contract, you have the right to obtain that data in a commonly used, machine-readable format. You may also request that we transfer that data to another controller where technically feasible. How to exercise: We can provide your account data in a structured CSV or JSON file upon request. If you need it transferred to another service and we can technically do so securely, we will.

• Right to Object to Processing: You have the right to object to certain types of processing of your personal data, particularly when we process data based on legitimate interests. For example, you can object to the use of your data for direct marketing (which we will always honor). If you object to processing that we rely on legitimate interest for, we will evaluate your request and will stop or limit processing unless we have a compelling legitimate ground to continue or if needed for legal claims. How to exercise: In your account settings or through provided links, you can opt-out of marketing emails (which is an objection to marketing processing). For other objections, please contact us with specifics of your request.

• Right to Restriction of Processing: You have the right to request that we limit the processing of your personal data under certain circumstances. For instance, if you contest the accuracy of your data, you can ask us to restrict processing while we verify the data; or if you need data preserved for a legal claim, you can request that we store it but not otherwise process it. How to exercise: Contact us with your request and the reason. During a restriction period, your data will be flagged and only processed for specific reasons (e.g. to protect legal rights).

• Right Not to be Subject to Automated Decisions: If we ever employ automated decision-making, including profiling, that produces legal or similarly significant effects, you have the right not to be subject to such decisions without human intervention. In other words, you can request that a human reviews any high-stakes automated decision rather than being evaluated solely by an algorithm. Clarification: Currently, Tanqory does not make any legally significant decisions about individuals without human review – for example, we do not use algorithms to deny services or determine creditworthiness without a manual check. Any use of AI or machine learning is intended to assist our human staff or improve user experience (such as product recommendations, fraud flagging for review, or AI chat responses), and we ensure these do not override human judgment in ways that significantly affect your rights. If you believe you have been subject to an automated decision with significant impact, please inform us and we will investigate promptly.

• Right to Withdraw Consent: In cases where we process your personal data based on your consent, you have the right to withdraw that consent at any time. For example, if you consented to a newsletter, you can unsubscribe; if you consented to optional data collection, you can change your mind. Withdrawing consent will not affect the legality of processing done prior, but it will mean we stop the specific processing going forward. How to exercise: Adjust your preferences in account settings (where available) or contact us. (Note: If you withdraw consent for something like a necessary app permission, certain features may no longer work – we’ll advise you accordingly.)

• Right to Lodge a Complaint: If you have concerns about how we are handling your personal data, you have the right to complain to a data protection authority. This could be the supervisory authority in the country where you live or work, or where Tanqory is located. For instance, Singapore users can contact the Personal Data Protection Commission (PDPC), and EU/UK users can reach out to their local Data Protection Authority. We would, however, appreciate the chance to address your concerns directly before you do so – please feel free to contact us and we will do our best to resolve any issue. In any case, lodging a complaint will not affect any other rights or proceedings you may pursue.

We will not discriminate against you for exercising any of these rights. If you make a request, we may ask for verification information (to confirm identity) before proceeding, especially for sensitive requests like access or deletion. We aim to fulfill requests free of charge, except if they are manifestly unfounded or excessive (in which case we might charge a reasonable fee or decline).

For PDPA (Singapore): Your key rights are access and correction, which we fully uphold. For GDPR (EU): the above list covers your rights under Articles 15–22 GDPR. For California residents: please see any separate CCPA notice we provide for state-specific rights (though note, we do not sell personal data). Regardless of jurisdiction, we intend to honor the spirit of these rights globally as part of good privacy practice.

Data Security Measures

We employ robust security measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction. Tanqory’s security program is aligned with industry best practices to ensure confidentiality, integrity, and availability of your data:

• Encryption: All network communication between your browser/app and our servers is encrypted via HTTPS/TLS. Sensitive data (such as passwords and payment details) is stored in encrypted form. We also encrypt personal data at rest in our databases where feasible, adding an extra layer of protection.

• Access Controls: Internally, access to personal data is restricted to authorized personnel who need it to perform their job (e.g., support staff, engineers debugging an issue) and is controlled through role-based access and multi-factor authentication. Our staff are trained on data privacy and security practices.

• Network and System Security: We utilize firewalls, intrusion detection systems, and continuous monitoring of our infrastructure to guard against external threats. Our platform is hosted in secure data centers (e.g., AWS and DigitalOcean) that have their own stringent security certifications. Within these environments, we isolate our servers and use virtual private cloud networks to prevent unauthorized traffic. Regular backups are performed to ensure data resilience (and these backups are secured as well).

• Audits and Certifications: We are committed to high standards of security compliance. The Tanqory platform undergoes periodic external security audits and assessments by independent parties. These evaluations help verify that our controls are working effectively and identify any improvements. Tanqory is also working towards internationally recognized certifications; for example, we follow the ISO/IEC 27001 framework for information security management and aim to certify our organization under this standard. By aligning with ISO 27001 and related standards, we ensure a systematic approach to managing and protecting information. We also comply with PCI-DSS requirements via our payment providers to ensure payment data is handled safely.

• Penetration Testing: We regularly conduct penetration testing and vulnerability scans on our applications. If we (or ethical hackers) discover vulnerabilities, we address them promptly. We also maintain a bug bounty or responsible disclosure program to encourage security researchers to report issues.

• Organizational Policies: We have internal policies for data handling, incident response, and employee practices that uphold security. In the event of a data breach that affects personal data, we have procedures to notify users and authorities as required by law.

While we strive to protect your data, please note that no system can be 100% secure. You also play a role in security: keep your account credentials confidential and use a strong, unique password. If you suspect any unauthorized activity in your account, notify us immediately. We will continue to update and refine our security practices as new threats emerge, keeping your privacy and security as a top priority.

External Audits & Compliance

To maintain your trust, Tanqory is committed to transparency and accountability in its privacy and security practices. We subject our operations to regular external audits and comply with relevant standards and regulations. For example:

• We undergo independent third-party audits of our security controls (as mentioned above) to verify that we meet our security commitments and to obtain certifications (such as ISO 27001). These audits help ensure we consistently implement effective data protection measures.

• We are working towards or have achieved compliance with international standards like ISO/IEC 27701 (Privacy Information Management) and SOC 2 Type II. Such frameworks provide assurance that we manage personal data in a responsible manner.

• We keep apprised of and comply with regional laws. This includes GDPR in Europe, PDPA in Singapore, CCPA/CPRA in California, and additional US state privacy laws (including Virginia CDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, Texas TDPSA, Montana MCDPA, Oregon OCPA, Iowa ICDPA, Indiana INDPA, Tennessee TIPA, Delaware DPDPA, New Jersey NJDPL, New Hampshire NHDPA, Maryland MODPA, Minnesota MCDPA — applicability subject to statutory thresholds), and other evolving privacy laws in countries like Australia, Canada, India, etc. Wherever we operate or have users, we intend to meet the requirements of applicable data protection law. In cases where laws differ, we generally adopt the most stringent requirement as our baseline.

• Data Protection Officer (DPO): We have appointed a Data Protection Officer (DPO) to oversee our privacy strategy and compliance. Our DPO’s contact email is privacy@tanqory.com, which you can use for any privacy inquiries or concerns. We also register our DPO contact with regulators when needed (for example, PDPC in Singapore) and ensure they are easily reachable.

• We maintain a privacy management program internally that includes ongoing training for staff, periodic policy reviews, and vendor assessments (we vet the data protection practices of any third-party processors we use).

Additionally, Tanqory’s practices may be subject to external review by authorities. For example, if a regulatory body launches an investigation or requires annual filings/certifications, we will comply fully. We consider privacy compliance an ongoing commitment, not a one-time effort.

Right to Lodge a Complaint

If you believe your privacy rights have been violated or you have a complaint about our data practices, you have options to seek resolution:

1. Contact Tanqory First: We encourage you to reach out to us at privacy@tanqory.com with any complaints or questions. Our team will investigate and do our best to resolve the issue swiftly and fairly.

2. Regulatory Authorities: If you are not satisfied with our response, or you prefer to go directly to a regulator, you can lodge a complaint with the relevant data protection authority. For example, in Singapore you can contact the Personal Data Protection Commission (PDPC). In the EEA, you can reach out to your local Data Protection Authority (DPA) or the lead supervisory authority. In the UK, it’s the Information Commissioner’s Office (ICO). Generally, you can complain to the authority in the country where you reside or work, or where the issue occurred. We will cooperate fully with any official investigations and follow the guidance provided by regulators.

3. Other Jurisdictions: In some places (like the EU), you also have the right to an effective judicial remedy if you believe your rights under privacy law have been infringed due to our handling of your data. This means you could pursue legal action against us or our data processors. We hope it never comes to that, and are committed to working with you and regulators in good faith to address any problems.

Lodging a complaint will not prejudice any other rights or remedies you have. We take complaints seriously and see them as an opportunity to improve. We thank you for trusting Tanqory with your personal data and will always strive to live up to that trust.

Additional Transparency & Global Standards

• Legal Bases (GDPR/UK GDPR/PDPA): We rely on contract (to deliver the services you request), consent (for non-essential cookies/marketing or any sensitive data you voluntarily provide), legitimate interests (security, fraud prevention, service improvement—subject to your right to object), legal obligation (accounting/tax, lawful requests, sanctions/AML if applicable), and, rarely, vital interests (to protect life/safety).
• Purpose ↔ Legal Basis mapping (illustrative): Service delivery/onboarding/payments = contract; Support/bug-fixing/security logs/fraud checks = legitimate interests (and legal obligation where applicable); Marketing emails/remarketing cookies = consent (opt-out any time); Analytics (non-essential) = consent where required; Compliance/recordkeeping = legal obligation; Optional AI assistants = consent (with opt-out) or legitimate interests when purely assistive and low-risk.
• Subprocessors/Service Providers: We use vendors under written instructions only. The current list — including DigitalOcean, Cloudflare (including Turnstile), MongoDB Atlas, AWS (limited scope), Sentry, Twilio SendGrid, Resend, Vonage, Twilio (SMS/messaging delivery and telecom compliance registration), Google FCM, APNs, Liveblocks, Canva, Stripe, PayPal, Braintree; selectable AI/LLM providers (OpenAI, Anthropic, Google Gemini, Apple Foundation Models, CopilotKit, and DeepSeek on customer opt-in only) and PhotoRoom (mobile AI image editing); analytics and telemetry (PostHog, Google Analytics for Firebase, Grafana Cloud); advertising/conversion measurement (Google Ads on-device conversion — mobile, subject to App Tracking Transparency); authentication providers (Sign in with Google/Apple, Facebook Login) and Google Maps Platform (Places); and stock-image APIs (Unsplash, Pexels) — is published at https://legal.tanqory.com/legal/data-protection/subprocessor-list with roles, locations, and transfer mechanisms; we will notify you of material changes. All subprocessors are bound by confidentiality, security, and purpose-limitation obligations.
• International Transfers: Where data leaves the EEA/UK/CH or other restricted regions, we use SCCs/UK IDTA/Addendum, conduct Transfer Impact Assessments, and apply supplementary measures (encryption, data minimization, access controls) to meet Chapter V GDPR/PDPA and local laws. If we later certify under an approved framework (e.g., EU-U.S. DPF), we will publish the certification status.
• Cookies/Marketing/Opt-Out: Consent is obtained for non-essential cookies; we honor Global Privacy Control (GPC) where required; provide a cookie settings center/withdrawal link; marketing emails include instant unsubscribe. We do not sell personal data under CPRA; if we ever “share” for cross-context ads, you will have a clear opt-out.
• Retention: We retain data only as long as needed for the stated purposes (service delivery, legal/recordkeeping, security/fraud) and delete or de-identify thereafter. Examples: account data kept while your account is active; transaction/financial records kept for statutory tax/audit periods (typically 5–10 years depending on law); logs kept for shorter security windows unless needed for investigations. Backups follow rotating deletion schedules; if you request deletion, we remove or anonymize within legal timeframes subject to statutory retention. We can provide more detail on request.
• Children: Services are aimed at adults; not designed for children below applicable age (e.g., under 13 under COPPA). If we learn we collected a child’s data without parental consent, we will delete it promptly.
• Automated Decisions/AI: AI features assist users/support and do not make significant legal decisions without human review. You may request human review of any high-impact automated assessment and can object/disable consent-based AI features.
• Security & Breach Notice: We use layered technical/organizational measures (TLS/at rest encryption, least privilege, backups, IDS/vulnerability testing). If a breach with risk to individuals occurs, we will notify regulators/affected users within legally required timeframes (e.g., without undue delay and, where GDPR applies, within 72 hours of awareness).
• Data Rights & SLA: We aim to respond to data subject requests (access/erasure/objection/portability/restriction) within 30 days where GDPR/UK GDPR applies, or within timelines required by local law. For California, we will honor CPRA rights (including “Do Not Sell/Share” if applicable and limits on sensitive personal information). Notice at Collection and appeal channels are available via this Privacy Policy and our help center.
• Cookie/Ads Disclosures: We will publish a cookie/ads partner table (cookie name, provider, purpose, duration) and keep it updated in our Cookie Policy; non-essential cookies/ads tags load only after consent. GPC signals are honored in regions that require it.
• CCPA/CPRA Notices: A “Notice at Collection” and “Do Not Sell/Share My Personal Information” (if sharing ever occurs) will be available via our legal site/help center; we currently do not sell personal data and do not share for cross-context ads without an opt-out. Sensitive personal information (as defined by CPRA) is not used to infer characteristics beyond permissible purposes.
• EU/UK Representative: If required under GDPR/UK GDPR Article 27, we will designate and publish our EU/UK representative details on our legal site and in regional notices.
• DPF Participation: We are not currently certified under the EU-U.S./UK-U.S./Swiss-U.S. Data Privacy Framework; if and when we participate, we will state our certification status and dispute-resolution channel on our legal site.
• Subprocessor Change Notices: Material changes to subprocessors (additions/role changes) will be posted on the subprocessor page with advance notice where feasible; you may subscribe to updates via that page.
• Regional Contacts: DPO: privacy@tanqory.com. EU/UK representative (if appointed) and other regional contacts will be published on our legal site and linked in regional notices.

Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. If we make material changes (ones that significantly affect how your data is handled), we will notify you prominently – for example, by emailing you at your registered address or by placing a notice on our website/app. We will also update the “Last Updated” date at the top of the Privacy Policy. We encourage you to review this Policy periodically to stay informed about how we protect your information.

If you continue to use Tanqory’s services after an update takes effect, it constitutes your acknowledgment of the changes. If you do not agree to the revised terms, you should stop using the services and may request deletion of your data.

Contact Us (Data Protection Officer)

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, you can contact our Data Protection Officer:

• Email: privacy@tanqory.com

• Registered Agent: Data Protection Officer, Tanqory Inc., c/o Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, DE 19958, USA

Entity details:

• Tanqory Inc. — operator of the Tanqory platform, contracting and billing entity, and controller for this Policy; sender of record for SMS/text messages sent to United States recipients. Incorporated in Delaware, United States. Address: c/o Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, DE 19958, USA. Contact: legal@tanqory.com

• Tanqory OÜ — EU representative (GDPR Art. 27). Registered in Estonia. Contact: legal@tanqory.com