Tarseek Legal Center

Privacy Policy

This Privacy Policy describes how Tarseek intends to collect, use, share, and retain personal data when you use the Service. It is a draft of the eventual notice, not an effective statement that every listed processing activity already occurs.

Related documents: Data Practices & Retention, Cookie Policy, Privacy Choices & Requests, Data Processing Addendum, and Regional Privacy Addenda.

Controller identity: Mahmoud Chaer, operating Tarseek from Beirut, Lebanon. DPO: None appointed. EU representative: None appointed.

1. Data we may collect

1.1 Account information

Name, email, account ID, organization, role, and authentication data. If you sign in with Google, GitHub, or Microsoft, this includes the provider, its stable account identifier, the email address supplied for sign-in, and sign-in timestamps. Passwords are stored only as hashes. Tarseek does not retain social-login access, refresh, or ID tokens after authentication completes.

1.2 API usage metadata

Model, provider, primary Deployment, timestamp, token counts, request status, estimated cost, latency, error information, request ID, and API-key identifier.

1.3 API content

Prompts, system messages, supported images and files, and Outputs are processed to fulfill requests and transmitted to Model Providers. Tarseek does not retain API prompt or output content by default. When an authorized project owner opts in, future API inputs and outputs are copied to a separate model-improvement dataset.

Optional analytics labels, saved views, team invitations and access-audit records support project administration. Application and agent labels are stored as supplied; user/session attribution is hashed per project. Project email and webhook preferences determine external alert delivery, while separate account communication preferences control optional product news, education, research, events and offers. Essential account and security messages are not controlled by marketing preferences. Managers may enable metadata trace exports. Alert payloads expire after seven days, with 30 days of delivery history. See Data Practices for these controls and retention boundaries.

1.4 Chat data

Conversation messages, Model selections, titles, attachments, and conversation metadata may be stored because persistence is an explicit hosted Chat feature.

1.5 Memory

Tarseek may store persistent information you choose to keep across Conversations to improve continuity. Memories are personal to the user and are not shared with other project members. Memory is treated as potentially stale background context and is separated from mandatory product instructions.

1.6 Files

Uploads may be transmitted to Model Providers for processing. Reusable API files expire after 30 days by default; Chat attachments and generated files remain with the Conversation until deleted. Deleting a file, Conversation, or account disables access and schedules removal from active systems. Residual copies may remain in backups for up to 30 days where a backup exists. Uploaded files may be subject to validation and automated security checks that depend on the production configuration.

1.7 Technical data

IP address, browser, device, user agent, cookies, security logs, approximate location derived from IP, and keyed hashes of optional pseudonymous safety identifiers used to correlate abusive API activity. Customers should never place names, email addresses, or other personal data in a safety identifier.

1.8 Customer support

Email, attachments, support tickets, and correspondence. [TBD: support provider.]

1.9 Analytics

Product analytics and telemetry to understand feature use and reliability. [TBD: analytics provider.] If no analytics vendor is used, this category may be limited to first-party logs.

2. Why we use data

• providing Tarseek and processing AI requests;
• selecting and operating the explicit Model's primary Deployment;
• usage measurement and estimated cost reporting;
• preventing fraud, securing systems, and preventing abuse;
• troubleshooting and reliability;
• product analytics;
• customer support;
• sending essential account messages and optional communications according to saved preferences;
• legal compliance;
• optional product improvement where a lawful basis and, if required, opt-in exist.

Chat model-improvement sharing is enabled by default for non-temporary consumer Chat and can be disabled in Settings. Temporary Chats are excluded. API model-improvement sharing is disabled by default and can be enabled only by the project owner after confirming authorization. These settings affect future content and can be changed at any time. They control Tarseek’s use, not independent Model Provider practices.

3. Legal bases

Where GDPR or similar laws apply, intended bases include contract (providing the Service), legitimate interests (security, fraud, product analytics that are not overridden by user rights), consent (certain cookies or optional programs), and legal obligation. Details will appear in the Regional Privacy Addenda. [TBD: data transfer mechanism.]

4. Data sharing

Tarseek may share data with:

• Model Providers (Inputs and necessary metadata to fulfill requests);
• cloud infrastructure providers;
• authentication services;
• analytics vendors if used;
• support tools;
• professional advisers;
• legal authorities where required;
• parties to a corporate transaction, subject to appropriate safeguards.

See the Subprocessor List.

5. International transfers

Tarseek and Model Providers may process data in multiple countries. Intended safeguards include [TBD: data transfer mechanism], Standard Contractual Clauses, and UK equivalents as applicable.

6. Retention

See Data Practices & Retention for the operational view. High-level targets:

• account data: for the life of the account and a limited period after deletion;
• commercial records, if Tarseek charges a separate service fee: as required by tax and accounting law;
• API content: not long-term by default;
• usage metadata: retained for history, cost reporting, and security;
• Chat: until deleted by the user or account closure, subject to backups;
• security logs: as reasonably necessary.

7. Security

See Security & Trust. Tarseek does not claim SOC 2, ISO 27001, HIPAA, or PCI certification unless those are actually achieved.

8. Children

The Service is intended for users 18+. Tarseek does not knowingly collect personal data from children. If Tarseek learns it has collected such data, it should delete it except where retention is legally required.

9. Your rights

Depending on law, you may have rights to access, deletion, correction, export, objection, restriction, withdrawal of consent, and complaints to a supervisory authority. Requests: see Privacy Choices & Requests.

10. Automated decisions

Deployment selection, fraud, and abuse systems may use automated processing. Tarseek does not intend to make solely automated legal-effect decisions about natural persons as a consumer credit or employment agency. Customers remain responsible for automated decisions in their own applications.