Privacy policy

Who we are and what this policy covers#

Tau AI is a subscription growth service for founders and small teams. It looks at your website and at public market material, and it produces a growth plan, recommendations, content and outreach suggestions. The service is operated by Oria One Inc.

Oria One Inc. decides why and how the personal information described here is handled, which under UK and EU law makes us the controller of it. Our registered address and the addresses to use for privacy questions are at the end of this policy.

This policy covers our website and the service itself. It does not cover other companies, websites, tools or platforms that we link to, that you connect to the service, or whose public content the service reads. Those are governed by their own policies.

Where you give us material about other people so that we can do something for you, you decide what to hand over and we handle it as described here and on your instructions.

What we collect#

We collect the following kinds of information.

• Account details, such as your name, your email address, the organisation you tell us you work for, your password credentials and the settings and preferences you choose.
• Billing details, such as the plan you are on, your billing contact and address, the country you are billing from, your billing history and a record of payments, refunds and cancellations. Payments are taken by a third party payment processor, so card numbers are entered with that processor and are not held by us.
• The website address you give us and the content we read from it, including pages, headings, text, links, structured data and other publicly available material published at that address.
• Market and competitor material, meaning the public web pages, search results and public social content of the businesses and accounts you ask us to look at, or that we identify as comparable to you.
• Usage and device data, such as the pages you view, the links and buttons you see and click, the page you arrived from, any campaign parameters in the link you followed, a short lived session identifier, your device type, your browser family and the country your request came from.
• Support correspondence, meaning the name, email address and message you send us through the support form or by email, and our replies.
• Content you create in the service, such as the briefs and instructions you give it, and the drafts and recommendations it produces for you.

We do not ask you for sensitive information such as government identifiers, precise location, financial account numbers, health information or anything revealing your beliefs, and the service does not need any of it. Please do not send it to us.

How we collect it#

Information reaches us in three ways.

• Directly from you, when you fill in a form, start a subscription, contact support, or tell the service what to work on.
• Automatically, when you use the website or the service. Our own measurement records page views and interactions with links and buttons so that we can see which parts of the site and the product are used. The country a request came from is worked out from network information at the moment the request arrives, and the address it came from is not kept.
• From public sources, including search results, public web pages and public social posts. We read this material to understand how you and comparable businesses appear in search results, in social conversation and in AI answer engines.

If your browser or an extension sends a recognised opt out signal such as Global Privacy Control, we treat it as a request not to be measured and our measurement does not run.

Information about people who are not our customers#

A large part of what this service does is read material that is already public. That material sometimes contains personal information about people who are not our customers, for example the author of a public post, a named contact on a company page, a person quoted in an article, or a creator you might want to work with. We may also hold contact details you give us for people you want to reach.

We try to keep this narrow. We collect this material because it is needed to provide a service a customer has asked for, we prefer material that is business rather than personal in nature, and we do not set out to build profiles of private individuals or to gather sensitive information about anyone.

Where UK or EU law applies to this, our lawful basis is our legitimate interests and those of our customers in understanding a public market. That basis depends on a balancing test against the interests and rights of the people the material is about.

If material we hold is about you and you are not a customer, you have the same rights as anyone else in this policy. Contact us using the details at the end and we will handle your request the same way.

Why we use it#

• To provide the service, including reading the website address you give us, tracking how you appear in search results and in AI answer engines, watching public social conversation, and producing plans, recommendations and drafts.
• To create and run your account, take subscription payments, issue receipts, and manage renewals, cancellations and refunds.
• To answer support requests and to send you messages about the service, including changes that affect you.
• To keep the service secure and working, including detecting misuse, investigating faults, and separating automated traffic from real visitors.
• To understand which parts of the website and the service are used, so we can decide what to improve.
• To send you occasional messages about the product where you have not told us to stop. You can opt out of these at any time, and doing so does not affect messages we have to send you about your account.
• To meet our legal, tax and accounting obligations, and to establish, exercise or defend legal claims.

We do not use your information to make decisions about you by automated means that produce a legal or similarly significant effect on you.

Content and outreach the service produces#

You should understand plainly what the service does with what you give it. It generates material. It writes growth plans and recommendations, drafts pages, posts, messages and outreach copy, and suggests accounts and creators to approach. To do that it uses what you tell it, what it reads from the website address you give us, and what it reads from public sources.

Some of that work runs through third party artificial intelligence and language model providers, which means your instructions and the material being analysed are sent to those providers to be processed. They fall into the categories listed in the next section. We do not describe how any particular provider trains its own models, because that is a matter between us and that provider and is part of the review still outstanding.

Anything the service drafts is yours to review before it goes anywhere. Where the service is able to publish or send on your behalf, it does that on your instruction. You are responsible for what you choose to publish or send, and outreach you send is subject to the marketing and electronic communications rules that apply where the recipient is, so please make sure you have a proper basis for contacting them.

Lawful bases for readers in the UK and the EU#

If you are in the United Kingdom or the European Economic Area, we need a lawful basis for each thing we do with your personal information. Ours are these.

• Performance of a contract, for creating and running your account, providing the service you subscribe to, taking payment and supporting you.
• Legitimate interests, for measuring how the website and the service are used, keeping them secure, analysing public market material, improving what we offer, and telling existing customers about the product. You can object to any of these.
• Consent, where we ask for it, for example for optional analytics or marketing where consent is required. You can withdraw consent at any time, and withdrawing it does not make what we did beforehand unlawful.
• Legal obligation, for tax and accounting records and for responding to lawful requests.

Where we rely on legitimate interests we weigh what we want to do against your rights and expectations. If you ask, we will explain the balance we struck for a particular use.

Who we share information with#

We share personal information with providers who do work for us. We describe them by category rather than by name, because a named list is a binding statement and a partial one would be worse than none. The categories are these.

• Payment processing, to take subscription payments, issue refunds and reduce fraud.
• Hosting and infrastructure, including cloud hosting, content delivery and the managed databases where our records sit.
• Email delivery, for account messages, support replies and service notices.
• Analytics and product measurement, to understand how the website and the service are used.
• Artificial intelligence and language model providers, for the analysis and the drafting the service performs.
• Data sources for search results, ranking data and social listening.
• Business tools such as customer support, error reporting, accounting and internal collaboration.

These providers act on our instructions, are bound by contract to protect what we give them, and get only what they need to do their job. We would rather give you an accurate list than publish an incomplete one, so a current list of the providers we use is available on request at [TODO(legal): where to request the current list of providers]

We also disclose information in these situations.

• To our professional advisers, such as lawyers, accountants and insurers, where they need it to advise us.
• Where a law, a court or a regulator requires it, or where we need to protect our rights, our users or the public.
• To a buyer or successor, if the business or part of it is sold, transferred or reorganised. We would tell you if that happened.

We do not sell your personal information for money. Some US state privacy laws use the words sale and sharing more broadly than that, and how those definitions apply to us is covered in the section on US state privacy rights below.

International transfers#

Oria One Inc. is incorporated in the United States and the providers we use operate in more than one country, so personal information may be stored or processed outside the country you are in, including outside the United Kingdom and the European Economic Area.

Where information leaves the UK or the EEA we use a transfer mechanism that the law recognises, and we require our providers to protect it to a comparable standard. The regions our information is hosted in are [TODO(legal): hosting regions] and the transfer mechanism we rely on is [TODO(legal): transfer mechanism relied on]

How long we keep it#

We keep personal information for as long as we need it for the purpose we collected it, and then delete it or reduce it to a form that no longer identifies anyone. In practice that means the following.

• Account and subscription records, for as long as your account is open and for a period afterwards, so we can deal with billing questions, disputes and legal claims.
• Billing and tax records, for as long as tax and accounting law requires us to keep them.
• Support correspondence, for as long as it is useful for supporting you and for showing what was agreed.
• Measurement data about how the website and the service are used, for as long as it is useful for the trends we look at, and in a reduced or aggregated form after that.
• Material read from public sources, for as long as it is relevant to the analysis a customer has asked for.
• Content the service generates for you, for as long as your account holds it, unless you delete it sooner.

Security#

We take measures that are reasonable for the size of our business and the information we hold. Those include limiting who inside the company can reach production systems, using encrypted connections between your browser and our service, keeping our platforms and dependencies up to date, and relying on established hosting and payment providers that maintain their own security practices.

We do not hold, and do not claim to hold, any security certification, audit report or formal accreditation. We are not going to describe our security with a marketing phrase. No system can be guaranteed secure, and we cannot promise that information sent to us over the internet will never be intercepted or accessed without authority.

If a security incident happens that is likely to affect your rights, we will tell you and notify the relevant regulator where the law requires it.

Your rights#

Depending on where you live, you may have some or all of the following rights over the personal information we hold about you.

• Access, to be told whether we hold information about you and to receive a copy of it.
• Correction, to have information that is wrong or incomplete put right.
• Deletion, to have information removed where there is no good reason for us to keep it.
• Portability, to receive information you gave us in a commonly used format, or to have it sent to someone else where that is technically possible.
• Objection, to object to processing we base on legitimate interests, and to object to direct marketing at any time.
• Restriction, to ask us to pause processing while a question about it is being resolved.
• Withdrawal of consent, where consent is what we relied on.
• Complaint, to a data protection or privacy regulator in your country.

To use any of these, contact us using the details at the end of this policy. We will ask for enough information to be confident who you are, and we will answer within the time the law that applies to you allows. There is no charge, unless a request is repetitive or clearly excessive. We will not treat you worse for exercising a right.

If you are in the UK or the EEA you can complain to your local supervisory authority. The lead authority for us is [TODO(legal): lead supervisory authority] Our representative in the UK and the European Union, if one is required, is [TODO(legal): UK and EU representative] and our data protection officer, if one is required, is [TODO(legal): data protection officer]

Your US state privacy rights#

If you live in California, or in another US state with a comparable privacy law, you have rights to know what personal information we collect about you and why, to get a copy of it, to have it corrected or deleted, and not to be discriminated against for asking. The categories we collect, the sources they come from, why we use them and who we disclose them to are set out in the sections above.

Those laws use two words in a wider sense than everyday speech. A sale is a disclosure of personal information to a third party in exchange for money or for anything else of value. Sharing means disclosing personal information for cross context behavioural advertising. Ordinary uses of analytics and advertising technology can meet those definitions even where no money changes hands.

We do not sell your personal information for money, and we do not run advertising on this site. We are not going to go further than that and claim that nothing we do could ever meet the wider definitions, because that has not yet been checked properly. Checking it is part of the legal review named at the top of this page.

To opt out of anything that might count as a sale or a share, you can do either of the following.

• Set your browser or an extension to send a Global Privacy Control signal. We treat that signal as an opt out request, and when we receive it our measurement does not run.
• Contact us using the details at the end of this policy and ask us to opt you out.

An authorised agent can make a request on your behalf if they can show they are authorised to act for you. On sensitive personal information, we ask for none of it beyond the credentials you use to sign in, which those laws treat as sensitive, and we use those only to run and secure your account. That is not a purpose which gives you a separate right to limit how we use them.

Cookies and similar technologies#

We use a small number of technologies that store data in your browser or read data from it. Some of them are cookies. Most of what we use is not, and stores its data in your browser instead.

• Strictly necessary, so that pages load, the service stays secure and basic choices are remembered.
• Our own measurement, which keeps a short lived random session identifier in your browser's session storage, discarded by the browser when you close the tab, and a note in local storage of whether you have declined measurement. It does not follow you across other websites.
• Third party analytics, where we have it switched on. Those providers may set cookies of their own, and they belong to the analytics category in the sharing section above.

If your browser sends a Global Privacy Control signal, or you have told us you decline measurement, our measurement does not run. You can also block or delete cookies and clear site storage in your browser settings, although parts of the site may then behave differently.

Children#

The service is a business tool for adults. It is not directed at children, and we do not knowingly collect personal information from anyone under 16, or under a higher age where local law sets one. If you believe a child has given us personal information, contact us and we will delete it.

Changes to this policy#

We may update this policy as the service changes, as the providers behind it change, or as the law does. The date at the top of the page shows when we last changed it. If a change materially affects how we handle your information, we will give you notice by email or in the service before it takes effect, where the law requires that. The first substantial change to expect is the one that follows the legal review, which will remove the notice at the top of this page.

How to contact us about privacy#

For anything in this policy, including a request about your own information, contact us at the details below.

While those addresses are being confirmed, the support page is a working way to reach us, and a message sent there will get to the right person.