Privacy Policy

Data Controller: Tara Rodrigues AI, Mysore, Karnataka, India.

Data Protection Officer: Appointed DPO at privacy@tararodrigues.online — all enquiries acknowledged within 72 hours.

EU Representative (Article 27 GDPR): privacy@tararodrigues.online (forwarded to DPO within 24 hours).

We process your personal data only under these lawful bases as required by Article 6 GDPR:

• Consent (Article 6(1)(a)) — analytics cookies, marketing cookies, Facebook Pixel, optional model training. You may withdraw consent at any time via Cookie Preferences in your Profile without affecting service.

• Contract necessity (Article 6(1)(b)) — account creation, AI response generation, payment processing, service delivery.

• Legal obligation (Article 6(1)(c)) — transaction record retention (7 years under Indian financial regulations), fraud prevention.

• Legitimate interest (Article 6(1)(f)) — service improvement, security monitoring, abuse prevention. We balance your rights against our interests and you may object.

Each category of data is retained only as long as necessary:

• Account data (name, email, OAuth provider): retained until account deletion, purged within 30 days of deletion request.

• Conversations & AI memories: retained until account deletion, purged within 30 days. Used for model training unless you opt out by ceasing use.

• Transaction records (Razorpay): retained 7 years to comply with Indian tax and financial regulations.

• Analytics data (Firebase Analytics): retained 26 months per Google's data retention policy.

• Marketing cookies (Facebook Pixel): retained 180 days or until consent is withdrawn.

• Session auth tokens: retained for duration of session only (HTTP-only, secure cookies).

Your data may be processed outside your country of residence. We ensure adequate protection through:

• Standard Contractual Clauses (SCCs) — adopted per European Commission Implementing Decision 2021/914 for all EU→India data transfers, covering all processors.

• Data Processing Agreements (DPAs) — executed with every sub-processor (Google Cloud, Razorpay, Meta) binding them to GDPR-equivalent obligations.

• GCP regions: Primary processing in Mumbai (India) and Singapore — both regions with adequate data protection frameworks.

By using the service, you authorise these transfers under the safeguards described.

For a copy of applicable SCCs, email privacy@tararodrigues.online.

• Google Firebase/Firestore — Authentication, database, hosting, serverless functions (GCP Mumbai / Singapore regions).

• Google Cloud Platform Vertex AI — AI model inference, training, and improvement.

• Razorpay — Payment processing (PCI-DSS Level 1 compliant).

• Meta (Facebook) — Facebook Pixel for ad measurement (marketing consent required).

• Google Analytics (Firebase Analytics) — Anonymous usage analytics (analytics consent required).

All processors are bound by contractual DPAs and SCCs where applicable.

Your conversations and interactions may be used to train and improve our AI models via Vertex AI. This processing is based on your continued use of the service.

If you do not consent to your data being used for model improvement, you must stop using the service immediately. Continued use constitutes acceptance.

Model training data is de-identified before use. You may request deletion of training data by emailing privacy@tararodrigues.online.

We use three categories of cookies and tracking:

• Necessary (always active) — Session auth via HTTP-only secure cookies. No consent required.

• Analytics (opt-in) — Firebase Analytics for anonymous usage measurement. Enabled only after you accept via the cookie banner or Profile > Cookie Preferences.

• Marketing (opt-in) — Facebook Pixel for ad conversion measurement. Enabled only after you accept.

You can change your preferences at any time via the Cookie Preferences button in your Profile or by clearing cookies and reloading the site.

Consent is stored locally and tied to your browser/device. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

In the event of a personal data breach:

1. We will notify affected users within 72 hours of becoming aware of the breach, as required by Article 33 GDPR.

2. Notification will be sent via email to the registered email address on your account.

3. The notification will include: nature and categories of data involved, approximate number of affected users and records, likely consequences, and remediation steps taken or proposed.

4. We will also notify the relevant supervisory authority within 72 hours where required.

5. Users who discover a potential breach should report it immediately to: privacy@tararodrigues.online with subject line "DATA BREACH".

Our DPO will acknowledge receipt within 24 hours and provide regular updates during investigation.

If you are located in the EU/EEA, you have the following rights under the General Data Protection Regulation:

• Right of access (Art. 15) — Request confirmation and a copy of your personal data.

• Right to rectification (Art. 16) — Correct inaccurate or incomplete data.

• Right to erasure / "right to be forgotten" (Art. 17) — Request deletion of your data.

• Right to restrict processing (Art. 18) — Temporarily limit how we use your data.

• Right to data portability (Art. 20) — Receive your data in a structured, machine-readable format (JSON or CSV).

• Right to object (Art. 21) — Object to processing based on legitimate interest or for direct marketing.

• Right not to be subject to automated decision-making (Art. 22) — Opt out of decisions based solely on automated processing.

• Right to lodge a complaint — File a complaint with your local data protection supervisory authority.

Exercise any right by emailing privacy@tararodrigues.online. We will respond within 30 days. No fee for reasonable requests.

You have the right to receive a copy of your personal data in a structured, commonly used, machine-readable format (JSON or CSV).

This includes: your profile data, conversations, memories/archives, transaction history, and usage logs associated with your account.

To request your data:

1. Email privacy@tararodrigues.online with subject "DATA PORTABILITY REQUEST".

2. Include your registered email address for verification.

3. We will respond with a download link within 30 days.

4. You may transmit this data directly to another controller.

First copy is free. Reasonable subsequent requests may incur a small administrative fee.

California residents have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know — Request details of the personal information we collect, use, and share about you.

• Right to Delete — Request deletion of your personal information (subject to certain exceptions).

• Right to Opt Out — We do not sell your personal information. If this changes, you will be notified and may opt out.

• Right to Non-Discrimination — Exercising any CCPA right will not result in denied service, different pricing, or reduced quality. You will not be charged differently for exercising your rights.

• Authorized Agent — You may designate an authorized agent to make requests on your behalf. Agents must provide proof of written authorization and identity verification. Email privacy@tararodrigues.online.

To exercise your CCPA rights, email privacy@tararodrigues.online. We will verify your identity before processing. Response within 45 days (extendable by 45 with notice).

Under India's Digital Personal Data Protection Act 2023:

• Right to Access — Know what personal data we hold about you.

• Right to Correction — Correct inaccurate or incomplete data.

• Right to Erasure — Request deletion of your personal data.

• Right to Withdraw Consent — Withdraw consent previously given (this may require closing your account if consent was the basis for processing).

• Grievance Redressal — File a grievance with our designated Grievance Officer: grievance@tararodrigues.online. We will acknowledge within 24 hours and resolve within 30 days.

• Data Fiduciary — Tara Rodrigues AI operates as a data fiduciary under the DPDP Act.

If you are unsatisfied with our response, you may lodge a complaint with the Data Protection Board of India.

Tara Rodrigues AI is strictly for adults aged 18 and over.

• We require users to confirm they are 18+ during account creation.

• We do not knowingly collect, store, or process personal data from anyone under 18.

• If we discover a user is under 18, we will immediately delete their account and all associated data without notice.

• If you are a parent or guardian who believes your child has provided us with personal data, email privacy@tararodrigues.online with subject "MINOR DATA". We will investigate and delete within 72 hours.

We do not use age estimation or verification technology. We rely on self-certification at account creation.

We implement appropriate technical and organisational measures to protect your personal data:

• Encryption in transit: HTTPS/TLS 1.3 for all communications.

• Encryption at rest: AES-256 for data stored in Firestore and Cloud Storage.

• Access controls: Strict IAM policies on Google Cloud, principle of least privilege.

• Authentication: Firebase Authentication with OAuth providers (Google, email/password).

• Regular security reviews and dependency scanning.

No system is 100% secure, but we are committed to industry-standard practices.

You can manage your privacy preferences at any time through these tools:

• Cookie Preferences — Available in your Profile page. Granular controls for analytics and marketing cookies.

• Cookie Banner — Shown on first visit. Choose Accept All, Customize, or Reject All (non-essential).

• Account Deletion — Delete your account and all associated data via Profile > Delete Account (self-service, no email required).

• Data Requests — Email privacy@tararodrigues.online for access, portability, rectification, or erasure.

• Consent Withdrawal — Withdraw consent for analytics/marketing at any time without affecting core service functionality.

A detailed consent record (what was consented to, when, and how) is maintained server-side for audit purposes.

We may update this Privacy Policy from time to time.

• Material changes will be notified via email to the registered address on your account.

• The "Last updated" date at the top of this page will reflect the most recent revision.

• Continued use of the service after a change takes effect constitutes acceptance of the updated policy.

• You can review the full changelog below for a history of all revisions.

Support & refunds: support@tararodrigues.online

Data Protection Officer: privacy@tararodrigues.online

Legal matters: legal@tararodrigues.online

Grievance Officer (DPDP Act): grievance@tararodrigues.online

Data Subject Requests: privacy@tararodrigues.online

Tara Rodrigues AI

Mysore, Karnataka, India

You also have the right to lodge a complaint with:

• Your local EU/EEA data protection supervisory authority

• The Data Protection Board of India (for DPDP Act matters)