The contract behind the privacy policy.

TAO processes personal data on behalf of the customer organisation for the term of the agreement covering the customer’s use of the TAO platform. Processing ends when the agreement ends, subject to the deletion timelines documented in the privacy policy.

TAO processes personal data to operate the unified operating layer, including: connecting to authorised providers, surfacing operational records, generating drafts via Andy, routing approvals, and maintaining the audit trail. Processing is performed only for purposes explicitly disclosed in the privacy policy and the customer agreement.

Names, contact details, organisational roles, communication metadata, email and calendar content the customer connects, customer-relationship records the customer maintains in TAO, and provider artefacts (invoices, jobs, tasks) as needed for the connected workflow.

Customer employees and authorised users; the customer’s own customers, contractors, suppliers, and other contacts the customer chooses to bring into TAO via provider connections.

The customer organisation is the controller of personal data processed inside its TAO workspace. TAO is the processor. TAO commits to processing only on documented customer instructions, to confidentiality obligations for personnel, to assistance with data-subject requests, to security measures appropriate to the risk, and to deletion or return of data on instruction.

TAO uses a limited set of subprocessors for hosting, model inference, email delivery, observability, and security. The current list is maintained on the privacy page. TAO commits to advance notice of new subprocessors with a reasonable objection window.

Where personal data is transferred outside the EEA or UK, TAO relies on the European Commission Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, alongside any additional measures required by the data exporter’s impact assessment.

TAO commits to providing the customer with the information needed to demonstrate compliance with the data-processing obligations above, including audit reports or equivalent attestations where available, and to permitting reasonable audits with appropriate notice.

Enterprise customers and customers in regulated industries may request a counter-signed DPA via the contact route. We will share our latest template, accept reasonable redlines, and counter-sign before account access is granted for the engagement.