Who we are
In short: Tanah is responsible for the personal data described in this policy.
- This Privacy Policy explains how Tanah Financial, LLC, a Delaware limited liability company (“Tanah”, “we”, “us” or “our”), collects and uses personal data through tanah.ai (the “site”).
- Tanah is the controller of that personal data, which means we decide how and why it is used.
- For any privacy question or request, email us at hello@tanah.ai.
What this policy covers
In short: this policy covers the site and its contact form.
- This policy covers personal data we collect when you visit the site, use its contact form, or email us at an address listed on the site. The site is intended for business and professional users, so most of the personal data we receive belongs to people contacting us in a work capacity.
- It does not cover software or services Tanah provides to customers under a separate agreement. Where we process personal data on behalf of a customer, that processing is governed by that customer's agreement or documented instructions, and by the customer's own privacy notice.
- It does not cover third-party websites that the site links to.
What we collect
In short: what you enter in the contact form, the standard technical data needed to deliver and protect the site, a report when something breaks, and analytics while it is on.
- Information you give us. When you use the contact form, we collect the topic you choose, your name, your email address, your phone number if you provide it, your message, and the date and time you sent it. If you email us directly, we receive your name, your email address and anything in your email and its attachments.
- Information collected automatically. When you visit the site, our hosting provider processes the technical data needed to deliver and protect it, such as your IP address, browser and device information, the page requested and the date and time of the request. It also works out the country your connection comes from, which we use only to decide whether to ask before analytics starts; we do not store it. When you submit the contact form, we hold your IP address briefly in our server's memory to limit repeated submissions; it is not stored with your message.
- Error reports. If something on the site breaks, your browser or our server sends a short report to Sentry, our error-monitoring provider. A report holds the error message and where in our code it happened, the page address with anything after a “?” or “#” removed, your browser and operating system and their versions, and the time. Before a report is sent, we remove email addresses and long numbers from it, and it carries no cookies and nothing you type into the form. Sentry receives your IP address as part of the connection, as any website does; we do not use it to identify you. Error reports are sent without asking first, because we need them to keep the site working, and they are sent whatever you choose about analytics.
- Server logs. Our servers send operational logs to Better Stack, our logging provider, so that we can see the site is running properly. We keep names, email addresses, message content, IP addresses and browser details out of these logs.
- Analytics, while it is on. We use PostHog to understand how the site is used. While analytics is on, PostHog collects the pages you view and when you leave them; the links, buttons and other parts of a page you click; and a random identifier so that it can recognise repeat visits, together with the technical data above. Whether analytics is on depends on where you are and what you choose (see “Cookies and similar technologies”).
- Your analytics choice, once you make one. It is kept in your browser and is not sent to us.
- Information from third parties. We do not obtain personal data about you from third parties through the site.
- We do not ask for sensitive or special-category personal data, and we ask you not to send it.
How we use it
In short: to reply to you, to run, protect and improve the site, and to meet our legal obligations. We do not sell your data, and we do not send you marketing without your consent.
- To respond to you: reading and replying to your message, routing it to the right person based on the topic you choose, and following up on the conversation you started.
- To operate and secure the site: delivering pages, keeping the site available, finding and fixing errors, preventing spam and abuse of the contact form, and investigating security incidents.
- To improve the site, while analytics is on: seeing which pages people read and where they get stuck.
- To keep records and comply with law: keeping appropriate records of business correspondence, meeting legal and regulatory obligations, responding to lawful requests from authorities, and establishing, exercising or defending legal claims.
- We do not add you to a marketing list because you contacted us. We send marketing communications only if you ask for them or consent to them, and you can opt out at any time.
- We do not sell personal data, we do not use it to train AI models, and we do not use it for automated decision-making that has legal or similarly significant effects on you.
Legal bases (EEA and UK visitors)
In short: where the EU or UK GDPR applies, we mainly rely on our legitimate interest in responding to business enquiries and running the site, and on your consent for analytics.
- Legitimate interests (Article 6(1)(f)): to respond to and follow up on enquiries from business contacts, to operate and secure the site, to find and fix errors using error reports and server logs, to keep business records, and to establish, exercise or defend legal claims. We have balanced these interests against your rights, and you can object at any time (see “Your rights”).
- Steps taken at your request before entering into a contract (Article 6(1)(b)): where you contact us about working with us or entering into an agreement with us.
- Legal obligation (Article 6(1)(c)): where the law requires us to keep or disclose information.
- Consent (Article 6(1)(a)): for analytics, and for any marketing communications you ask to receive. In the EEA and the UK, analytics stays off until you allow it. You can withdraw consent at any time (see “Cookies and similar technologies”); this does not affect processing carried out before you withdraw it.
International transfers
In short: your data is processed in the United States, with safeguards where the law requires them.
- Tanah is a US company, and our service providers process personal data mainly in the United States. Our hosting provider may also process request data at locations near you in order to serve the site.
- If you are in the EEA, the UK or Switzerland, we rely on appropriate safeguards for these transfers where the law requires them, such as the standard contractual clauses approved by the European Commission, with the UK addendum where relevant, in our providers' data-processing terms.
- For more information about these safeguards, email us at hello@tanah.ai.
How long we keep it
In short: only as long as we need it for the purposes in this policy, and then we delete it.
- Contact-form messages and related correspondence: for as long as we need them to deal with your enquiry, follow up on it and keep appropriate business records. If the conversation leads to a business relationship, we keep them for the length of that relationship and for any period the law requires after it ends.
- Rate-limiting data: IP addresses used to limit repeated submissions are held only in our server's memory, for as long as that check needs them.
- Hosting and email-delivery logs: kept by our providers for a limited period under their standard retention settings, and then deleted.
- Error reports and server logs: kept by Sentry and Better Stack for the retention period of our accounts, and then deleted automatically.
- Analytics data: kept only as long as we need it to understand how the site is used.
- Your analytics choice: kept only in your browser, until it expires.
- Records the law requires us to keep: for the period the law requires.
- When we no longer need personal data, we delete or anonymise it.
Security
In short: we protect your data with reasonable safeguards, although no system is perfectly secure.
- The site is served only over encrypted connections (HTTPS), so what you send through the contact form is encrypted in transit.
- Access to contact-form messages is limited to Tanah personnel who need it to respond.
- The contact form uses a hidden spam-trap field and a limit on repeated submissions to prevent abuse.
- We use established service providers and bind them by contract to protect personal data.
- No method of transmission or storage is completely secure. If you have reason to believe your interaction with us is no longer secure, please contact us straight away.
Your rights
In short: you can ask to see, correct or delete your data, and you may have other rights depending on where you live. Email us to make a request.
- EEA and UK: you have the right to access your personal data, to correct it, to have it erased, to restrict or object to our use of it (including where we rely on legitimate interests), to receive it in a portable format, and to withdraw consent where we rely on consent. You also have the right to complain to a data-protection supervisory authority, such as the one where you live or work (in the UK, the Information Commissioner's Office), although we would welcome the chance to address your concern first.
- California: you have the right to know what personal information we collect, use and disclose; to access, correct and delete it; and not to be discriminated against for exercising these rights. We do not sell or share personal information, so there is no sale or sharing to opt out of. We collect identifiers (such as your name, email address, phone number, IP address and, while analytics is on, an analytics identifier), internet or network activity information (including, while analytics is on, how you use the site's pages), and the content of your messages, from you and your device, for the purposes in “How we use it”, and we disclose them only as described in “Who we share it with”.
- Elsewhere: you may have similar rights under the law where you live, and we will honour them as that law requires.
- To make a request, email hello@tanah.ai. We verify requests by confirming them with the email address associated with your data, and we may ask for more information where needed. An authorised agent may make a request on your behalf with proof of your authorisation.
- We respond within any period required by the data-protection law that applies to your request. We will not treat you differently for exercising your rights.
Children's privacy
In short: the site is for business users and is not directed at children.
- The site is not directed at children, and we do not knowingly collect personal data from anyone under 18.
- You must be 18 or over to use the contact form.
- If you believe a child has given us personal data, email hello@tanah.ai and we will delete it.
Changes to this policy
In short: we will post any updates here and change the date at the top of this page.
- We may update this policy from time to time, for example when our practices or the law change. We will post the updated policy on this page and change the “Last updated” date at the top.
- If a change materially affects how we use personal data we already hold, we will take reasonable steps to tell you before it takes effect, for example by email where we have your address.
Contact us
For questions about this policy, or to exercise your rights, contact Tanah Financial, LLC at hello@tanah.ai. We aim to reply promptly, and always within any period the law requires.