Privacy policy
This policy explains how TATUTRAD, S.L. processes the personal data of people who visit tessialang.com, apply for the Tessia beta or use the platform. Tessia is a trade name of TATUTRAD, S.L., not a separate entity.
1. Data controller
- Controller: TATUTRAD, S.L., tax ID (NIF) B91619882
- Address: Paseo de las Delicias, 3, planta 5 izquierda, módulo 5, 41001 Sevilla, España
- Email: information@tatutrad.net
- Phone: +34 664 723 461
We have not appointed a data protection officer. For any privacy matter, write to the email address above.
2. What data we process, why and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Handle your application to join the beta, select the participating companies and tell you the outcome | Name, corporate email, company, job title, country, company website, language pairs, size, tools, volume and interests | Steps taken at your request before entering into a contract (art. 6(1)(b) GDPR) | If your company is not selected, 12 months from the end of the beta. If it is, for as long as the relationship lasts |
| Send you promotions and commercial news about Tessia by email | Name, email and your answer to the consent question, with its wording and date | Your consent, given expressly: the option is never pre-selected (art. 6(1)(a) GDPR). If you are already a Tatutrad client, our legitimate interest in telling you about similar services (art. 6(1)(f) GDPR and art. 21.2 LSSI), with an opt-out in every email | Until you unsubscribe or withdraw your consent. After that we only keep your email, blocked, on a suppression list so that we do not write to you again |
| Create and maintain your platform account and provide the service to your company | Name, email, photo (optional), language, time zone, role, organisation and two-step verification factors | Performance of the contract with your company and our legitimate interest in providing the service to the people it authorises (art. 6(1)(b) and 6(1)(f) GDPR) | While the account is active. These data are deleted when the account is deleted |
| Send you service notices (security, balance, changes to the terms) and news about the platform your company uses | Name, email and language | Performance of the contract with your company for the notices, and our legitimate interest in informing you about the contracted service for the news (art. 6(1)(b) and 6(1)(f) GDPR). You can unsubscribe from the news in every email | While the account is active |
| Prove acceptance of the terms of service | Organisation, name and email of the person accepting, version accepted, date and time, language and an encrypted fingerprint of the IP address, never the IP in clear | Performance of the contract and our legitimate interest in being able to prove what was accepted (art. 6(1)(b) and 6(1)(f) GDPR) | During the relationship and, afterwards, 6 years |
| Record platform usage to calculate consumption and invoice | Who ran each analysis, tool, file name, word count, consumption and date | Performance of the contract and compliance with accounting and tax obligations (art. 6(1)(b) and 6(1)(c) GDPR) | During the relationship and, afterwards, 6 years for accounting and tax obligations. After that, only usage figures without personal data are kept. If an account is deleted, the record is no longer linked to the person |
| Protect the platform: log of sensitive actions and request limits against abuse and password-guessing attempts | Security actions (invitations, role changes, two-step verification, removals) with the name and email of who performs them. For the limits, an encrypted fingerprint of the IP address or user, never the IP in clear | Our legitimate interest in the security of the service (art. 6(1)(f) GDPR) | Security log: 2 years. Limit fingerprint: 1 hour |
| Handle the bug reports and suggestions you send from the platform | Name, page, browser, language, description and, if you attach one, a screenshot | Our legitimate interest in fixing errors and improving the service (art. 6(1)(f) GDPR) | Name and screenshot, 2 years. The technical description of the error is kept without personal data |
| Read the style guides your company selects in Google Drive, Microsoft OneDrive or SharePoint, or Notion | The access permission your company grants, stored encrypted | Performance of the contract with your company (art. 6(1)(b) GDPR) | Until your company disconnects the service |
| Know how many visits the public pages receive and how many people start the beta form | Aggregated data: page views, country, device type, referring page and number of forms started per day. No cookies and no stored IP address | Our legitimate interest in understanding how the website is used (art. 6(1)(f) GDPR) | Only aggregated figures that do not identify anyone are stored |
The fields marked as required in the beta form are needed to assess your application: without them we cannot process it. Accepting marketing communications is optional and does not affect the selection.
Once these periods end, data are deleted or anonymised, unless we must keep them blocked to deal with possible legal liabilities for the period set by law.
3. Content uploaded by client companies
Translation files, reference materials (translation memories, glossaries, style guides) and the reports generated from them belong to the client company, which decides what to upload and why. This content may include personal data of third parties.
For this content, TATUTRAD, S.L. acts as a data processor on behalf of the client company, which is the controller. We process it only to provide the service and according to its instructions, as set out in the data processing agreement. In particular:
- Analysed files are not stored: they are processed at the time of the analysis.
- Report content is deleted automatically after 30, 90 or 180 days, as chosen by the company.
- Reference materials are kept until the company deletes them.
- If the company leaves the service, we delete its content and its users' accounts 30 days after it leaves, or earlier if it asks us to.
- The text is sent to the artificial intelligence model provider for analysis, which does not use it to train its models.
If your data appear in this content and you wish to exercise your rights, contact the client company. If you write to us, we will forward your request to them.
4. Who we share data with
We do not sell or disclose your data to third parties, unless required by law. To provide the service we rely on these providers, which process data on our behalf under a data processing agreement:
| Provider | Service | Data location |
|---|---|---|
| Supabase | Database, authentication and file storage | Ireland (EU); Singapore company |
| Vercel | Hosting and running the application; visit statistics | Ireland (EU); US company |
| Anthropic | Artificial intelligence model that analyses the texts | United States |
| Resend and Amazon Web Services | Sending platform emails | Ireland (EU); US companies |
| Notion | Internal management of beta applications and bug reports | United States |
If your company connects Google Drive, Microsoft OneDrive or SharePoint, or Notion, those services take part under your company's own account and terms with them.
Use of Google data. If your company connects Google Drive, Tessia requests only the drive.file permission, which gives access solely to the files that a person at your company picks with the Google file picker. We read their content at the time of each analysis, to use it as a style guide, and we do not store it. We keep the connection (encrypted) and the list of selected files until your company disconnects from Settings > Connections or revokes access in its Google account. We do not use this data for advertising, we do not sell it, and it is not used to train artificial intelligence models. Tessia's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
5. International transfers
Some providers are companies based outside the European Economic Area or process data outside it; in particular, Anthropic analyses the texts in the United States. These transfers rely on the standard contractual clauses approved by the European Commission, included in each provider's data processing agreement and, where the provider is certified, on the EU-US Data Privacy Framework (art. 45 and 46 GDPR). You can ask us for more information about these safeguards at information@tatutrad.net.
6. Your rights
You may exercise these rights over your data at any time:
- Access: find out what data about you we process.
- Rectification: correct any inaccurate data.
- Erasure: ask us to delete them.
- Objection and restriction: ask us to stop processing them or only keep them.
- Portability: receive them in a structured format.
- Withdraw any consent you have given, without affecting prior processing.
Write to information@tatutrad.net or by post to Paseo de las Delicias, 3, planta 5 izquierda, módulo 5, 41001 Sevilla, España, stating which right you wish to exercise. If we cannot identify you with certainty, we will ask for further details. We will reply within one month. To unsubscribe from marketing communications, simply reply to any of them.
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of your country of residence in the EU.
7. Automated decisions
Tessia uses artificial intelligence to analyse texts, not to assess people. We do not make automated decisions that produce legal effects on you or significantly affect you. Beta participants are selected by people on the Tessia team.
8. Security
We apply technical and organisational measures to protect data: each organisation's data are isolated from the rest, two-step verification is available and each organisation can require it, credentials for external services are stored encrypted, there are request limits against abuse and a log of sensitive actions, and report content is deleted within the period chosen by each company.
9. Minors
Tessia is a service for businesses and professionals. It is not intended for anyone under 18 and we do not knowingly process their data.
10. Cookies
The public website sets no cookies and the platform only uses strictly necessary technical cookies. Details are in the cookie policy.
11. Changes to this policy
We may update this policy when the service or the law changes. The date of the latest version appears at the top. If the change is significant, we will let you know by email or on the platform itself.