Privacy Policy

1. Controller and contact

The data controller for this website is TAIA GmbH, Seestrasse 353, 8038 Zurich, Switzerland, company number CHE-189.956.337.

For privacy requests, contact: info@taia.ch

2. Necessary cookie

This site currently uses one strictly necessary consent preference cookie named taia_cookie_consent.

This cookie stores your consent preference status and expires after 180 days.

The cookie banner lets you accept, decline or configure optional categories. On pages that use cookies, you can reopen the cookie settings from the footer at any time. The TAIA Confidential Screening and BlindScreen pages set no cookies and store nothing in your browser.

3. Analytics and marketing

No analytics or marketing tags currently load on this website.

If optional analytics is introduced later, it must remain off by default until you opt in, and this policy must be updated with vendor and processing details before activation.

4. Hosting and infrastructure logs

Hosting and content-delivery infrastructure may process technical data needed for secure delivery and operation.

This may include IP address, timestamp, requested URL, user-agent, and security/access logs.

TAIA also uses these logs to count, as totals, the requests to each page per hour and per day, and the referring website (domain only), the source label in the link (utm_source, utm_medium) and the page language per day, to understand how the site is used. No address or browser detail is kept for this, and the logs are not kept longer because of it.

5. External links and third-party contact points

This website includes links to LinkedIn, Google Maps and email clients.

These external services are only contacted when you actively click a link. Their own privacy policies apply.

• LinkedIn
• Google Maps
• Email

6. Forms on this site, and the Digital Advisor

The access request on taia.ch composes a message in your own mail client; the site itself sends and stores nothing from it.

The TAIA Digital Advisor at taia.ch/advisor/ is different: it is a signed-in conversation. When you send a question, its text is transmitted to TAIA's server and stored there, linked to your account, as part of that conversation's record (session, turns and receipt). The passages that answer it are selected from TAIA's own documents on TAIA's servers, which run on Google Cloud in Switzerland (europe-west6, Zurich); database backups are kept in Switzerland (Zurich) as well. When the answer shows a short summary, it was written from those passages, which are TAIA's public text, by Google Cloud's Vertex AI in the EU (europe-west3, Frankfurt, Germany); Google acts as TAIA's processor for this. What you type is not sent to Vertex AI or to any other model provider. The passages chosen for your question are sent, so its topic can be inferred from them.

Purpose: to answer your question and to keep the record the receipt describes. Legal basis: performance of the service you signed in for and TAIA's legitimate interest in an inspectable record. Your questions are not used to train any model and are not shared. Conversation records are kept while your account exists and for the operational cycle described in section 10; you can close the account in the Folio app (section 6a) or ask for deletion at info@taia.ch. Accounts are opened on request only.

6a. The TAIA Folio app for iPhone

The TAIA Folio app is used signed in, with an account in TAIA's own sign-in service (Keycloak), which holds the details you sign in with. Accounts are opened on request only.

What the app stores on TAIA's servers, linked to your account: the questions you ask, the answers prepared for them and their receipts; the committee briefs you prepare, including a decision question you write and a position you choose to keep; any link you publish to a receipt; and your conversations with the Digital Advisor. TAIA's servers run on Google Cloud in Switzerland (europe-west6, Zurich); database backups are kept in Switzerland (Zurich) as well.

When the app shows a short summary of an answer, or drafts a position for a brief, that text is written from passages of TAIA's own documents (for a brief, the passages behind the claims you selected) by Google Cloud's Vertex AI in the EU (europe-west3, Frankfurt, Germany); Google acts as TAIA's processor for this. Your questions, your decision question and anything else you type are not sent to Vertex AI or to any other model provider. The passages chosen for your question are sent, so its topic can be inferred from them. Only an answer to a question you declared public can be published by link. Anyone who has the link sees that question and the answer, never who you are, until the link ends after 30 days or you take it back.

On your iPhone the app keeps its sign-in token in the iOS Keychain, removed when you sign out or close the account, and a few display settings. The app contains no analytics, advertising or tracking code, and it does not ask for your location, contacts, camera or microphone.

You can close your account in the app, under “Close this account”. Closing deletes everything listed above at once: your questions with their answers and receipts, your briefs, your published links (they stop opening) and your Advisor conversations, and your sign-in itself, so the account cannot be opened again. TAIA's own documents are not yours and are not touched. A record that the account was closed, holding its identifier and two times and nothing else, is kept for about 70 minutes so that no new request can write under it; it is then deleted together with anything a request already under way wrote in the meantime. Closing cannot be undone. Copies in TAIA's database backups are kept for up to six weeks. You can also ask for deletion at info@taia.ch.

Purpose: to answer your questions, to prepare your briefs and to keep the record a receipt describes. Legal basis: performance of the service you signed in for and TAIA's legitimate interest in an inspectable record. Your data is not used to train any model, is not sold, and is not shared beyond the processors named on this page. It is kept while your account exists and deleted when you close it, with the closing record and backups as described above.

6b. TAIA Confidential Screening and card payments, including through Apple Pay

Controller. TAIA GmbH, Seestrasse 353, 8038 Zürich, Switzerland, is responsible for the processing described in this section. Contact: info@taia.ch.

The names you check. TAIA Confidential Screening at taia.ch/screening/check/ checks a name against three sanctions lists without a login. Your browser encrypts the name before it leaves your device. TAIA's service receives only the encrypted query, compares it in that form and holds no key to decrypt it; it does not learn the name or the answer, which only your browser can open. TAIA does not store or log the names you check. This holds for the page's code as TAIA publishes it; TAIA serves both the page and the service. If you check the name of another person, you decide why and you are responsible for having a lawful reason to do so. The service runs on Google Cloud in Switzerland (europe-west6, Zürich); Google acts as TAIA's processor.

The lists. To run the check, TAIA holds the three public sanctions lists (Swiss SECO list; OFAC SDN list; EU consolidated financial sanctions list) with the names and aliases of the listed persons and entities, in normalised form, built into the service. TAIA uses them for the check and for nothing else, and updates them when it releases a new version of the service. TAIA cannot inform the listed persons individually; their data come from the publishers' official lists, which are authoritative.

Network address and request data. Like any web request, a check passes through TAIA's web entry point, which logs, for every request, your network address and client port, the host and path requested, the method, the status, the duration, the size and the TLS version, without request headers (section 4), for up to 30 days, in Switzerland (Google Cloud europe-west6), to deliver the service and protect it against misuse, and then deletes them. To count the free checks, the check service itself keeps only a keyed hash of your network address, in memory only, replaces it with the first check after 00:00 UTC, and never writes it to disk or logs; it does not store or log the address. With an access key, the service counts the checks made with that key, under TAIA's identifier for the key; it stores only a hash of the key. These per-key counts stay in TAIA's logs for up to 30 days and in TAIA's plan records for up to 13 months (396 days). This keyed hash is a pseudonym, not anonymisation: whoever holds the day's key could recover the address from it; the key exists only in the running service, changes every day at 00:00 UTC and is never written anywhere. For up to 30 days, while the entry point's log exists, TAIA could link the checks made with an access key to the network address they came from by their time; TAIA does this only to investigate misuse.

Paid plans and Stripe. If you buy a paid plan, the payment is handled by Stripe Payments Europe, Limited, Dublin, Ireland ("Stripe"). You enter your card details on Stripe's payment page; TAIA does not receive or store them. If you pay through Apple Pay, Apple provides Stripe with a payment token; Apple processes your data under its own privacy policy. Stripe passes TAIA the details needed for the sale: your name, the business name, your e-mail address, the billing address if given, the plan, the amount and the date. TAIA assigns the access key to the buyer's name that Stripe collects at checkout. If you name a different person as the key's user when TAIA delivers the key, TAIA keeps that name only in its own order records, to assign the key to that one user, and you tell that person that TAIA holds their name for this purpose. TAIA uses them to send you your access key by e-mail, to answer your questions about the plan and to keep its accounting records. Stripe processes payment data partly as a processor for TAIA and partly as an independent controller for its own purposes, such as fraud prevention, verification and its legal and regulatory duties; for those purposes Stripe's privacy policy applies (stripe.com/privacy).

Disclosure abroad. Stripe's contracting entity is in Ireland, a country whose data protection the Swiss Federal Council recognises as adequate. Stripe also processes data in the United States, through Stripe, LLC, which states that it is certified under the Swiss-U.S. Data Privacy Framework; the Federal Council recognises certified U.S. companies as providing adequate protection. Where a transfer is not covered by that certification, Stripe uses standard contractual clauses recognised by the Federal Data Protection and Information Commissioner. TAIA sends your access key by e-mail from its Google Workspace account. Google stores TAIA's e-mail in Europe (Google Workspace data region: Europe) and may also process it in the United States; Google LLC is certified under the Swiss-U.S. Data Privacy Framework, and Google's terms include the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner.

Purposes and retention. TAIA processes these data to provide the check, limit the free checks, protect the service, sell and deliver paid plans and keep its accounting records. For readers in the EU or EEA, the legal bases are the performance of the contract, TAIA's legitimate interest in a working and protected service, and TAIA's legal duty to keep business records. Sale records are kept for ten years, as Swiss law requires for accounting records (Art. 958f CO). Other paid-plan data (your contact details, the plan, the name of the key's user and the e-mail thread in which TAIA delivered the key) TAIA deletes from its own records 12 months after the plan ends; the counting lines of a key (one per check: time, route and method, result status, plan and key identifier, duration; no name, no address) expire from TAIA's plan records at the latest 13 months (396 days) after the last check with that key. TAIA removes the data from its Stripe account as far as Stripe's deletion and redaction tools allow; Stripe keeps payment records as an independent controller for as long as its own legal duties require, under its privacy policy.

Your rights. You can ask TAIA for access to your data, and for correction or deletion, at info@taia.ch, as set out in section 11. You can also contact the Federal Data Protection and Information Commissioner (FDPIC).

6c. TAIA Confidential Ask

TAIA GmbH, Seestrasse 353, 8038 Zürich (info@taia.ch), is responsible for this processing. Your question and the answer are processed in memory for the time of the request and are not stored. For each question the service writes one log line (route and method, result status, an error code where a question fails, whether the question was free or asked with a key and, for a key, TAIA's identifier for it, and duration; no question text, no answer text and no network address), kept for up to 30 days in Switzerland (Google Cloud europe-west6). TAIA's web entry point passes the encrypted connection on without opening it and keeps no record of it or of your network address. With a paid plan, TAIA keeps a hash of your access key, the count of questions for each key on one day (until the first question of a later day replaces it) and one counting line per question asked with the key (the same fields, no question text, no answer text and no network address) for up to 13 months (396 days) after the last question with that key, for plan accounting; payments, your contact details and the retention of the sale follow section 6b. Your questions are not used to train or tune any model. Purpose: to answer your question, to protect the service and to count paid plans. The terms of TAIA Confidential Ask, A3 and A4, describe this in full.

7. Email communication purposes and legal basis

If you send us an email, we process your contact details and message content to respond, evaluate pre-contract requests, and maintain legitimate business correspondence.

Depending on the context, processing is based on consent, steps prior to contract, contract performance, legitimate interests, or legal obligations under applicable law.

8. No sale of personal data

TAIA does not sell personal data.

9. Cross-border disclosures

If personal data is disclosed across borders, it is done only where lawful safeguards exist, including adequacy decisions and/or appropriate contractual clauses, as applicable.

10. Retention

Personal data is retained according to purpose, operational necessity, and applicable statutory retention duties.

Data no longer required is deleted or anonymised within reasonable operational cycles.

11. Your rights

Where applicable under Swiss FADP and GDPR, you may request access, rectification, deletion, restriction, objection, portability, and information about processing.

If processing is based on consent, you may withdraw consent at any time with effect for the future.

12. Complaints

You may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC).

Where GDPR applies, you may also contact the competent EEA supervisory authority.

13. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration.

14. Children

This site is not directed to children, and we do not knowingly collect personal data from children through this website.

15. Policy changes

We may update this Privacy Policy to reflect legal, technical or business changes. The updated version is published on this page.