This policy explains how Voitas Ventures s.r.o. handles personal data as a controller when you use Tandmade, visit tandmade.com or contact us, under the GDPR (Regulation (EU) 2016/679) and Czech Act No. 110/2019 Coll. For data on websites our customers build, the customer is the controller (Section 2).
Who is responsible
The controller is Voitas Ventures s.r.o., ID No. 14389100, Jabloňová 2881/98, Záběhlice, 106 00 Prague 10, Czech Republic (“we”). Write to hey@tandmade.com about anything in this policy. We have not appointed a data protection officer because the law does not require one.
Websites built in Tandmade
Sites built in Tandmade belong to our customers. When you visit such a site or send its form, the site owner decides how your data is used and is its controller; we process it only on their behalf, under our Data Processing Addendum. Ask the site owner to exercise your rights. If you write to us instead, we forward your request to them.
What we process and why
| Purpose | Personal data | Legal basis | How long we keep it |
|---|---|---|---|
| Your account and sign-in | name, email, photo and account ID from Google or GitHub if you sign in with them, active sessions and devices (browser and system), sign-in history with IP address | Art. 6(1)(b) contract; Art. 6(1)(f) security | while the account exists; sign-in records up to 12 months |
| Workspaces and collaboration | membership, role, invitations (including the invited person’s email), comments, mentions, activity history | Art. 6(1)(b); Art. 6(1)(f) for invited people | while the workspace exists; unaccepted invitations expire after 7 days |
| Running the Service for you | content you upload and create, prompts, AI output, settings | Art. 6(1)(b) | while it is in the Service, then deleted as our DPA describes |
| AI features | prompts, page content, screenshots, tool calls and output, sent to our AI provider; traces of AI runs | Art. 6(1)(b); Art. 6(1)(f) debugging and quality | traces up to 90 days |
| Billing and tax | name or company, billing address, country, VAT ID, billing email, purchases, invoices, card brand and last four digits (the full card stays with Stripe) | Art. 6(1)(b); Art. 6(1)(c) VAT Act No. 235/2004 Coll. and Accounting Act No. 563/1991 Coll. | 10 years after the end of the year of the invoice |
| Product analytics and speed | pages and features used, clicks, editor timings, device, browser, approximate location derived from IP, a pseudonymous ID | Art. 6(1)(f) improving the product; consent where Section 8 requires it | up to 12 months |
| Error monitoring | error details, browser and device, the page and action involved | Art. 6(1)(f) keeping the Service working | up to 90 days |
| Support | your messages, name, email, files you send | Art. 6(1)(b) or (f) | 3 years after our last contact |
| Emails | email, name | Art. 6(1)(b) for service emails; Art. 6(1)(f) and Section 7(3) of Act No. 480/2004 Coll. for product news to customers | until you unsubscribe or your account ends |
| tandmade.com | page visited, referring site, country, device type, browser language, without IP addresses or identifiers; messages you send through our forms | Art. 6(1)(f) | statistics in aggregate; form messages 3 years |
| Security, abuse and legal matters | logs, IP addresses, reports of illegal content (the reporter’s name and email), our decisions, correspondence | Art. 6(1)(f); Art. 6(1)(c) Digital Services Act | logs up to 12 months; records needed for legal claims for the limitation period plus one year |
We need your account and billing details to provide the Service; without them we cannot contract with you. We make no decisions about you based solely on automated processing that have legal or similarly significant effects. Where we rely on legitimate interests, you may object (Section 9).
Where the data comes from
From you; from a colleague or agency who invites you; from Google or GitHub when you sign in with them; from Stripe about the status of your payments; and from our systems as you use the Service.
Who receives it
We use the providers below to run Tandmade. They process data on our instructions under data processing agreements.
| Provider | What for | Where the data is |
|---|---|---|
| Cloudflare, Inc. | hosting, network, databases, file storage, email sending, speed metrics, bot protection | global network, USA |
| Anthropic | AI models behind the AI features | USA |
| Stripe Payments Europe, Ltd. | payments, invoices, tax calculation | Ireland, USA |
| PostHog, Inc. | product analytics in the app | USA |
| Functional Software, Inc. (Sentry) | error monitoring | EU (Germany) |
| Langfuse GmbH | traces of AI runs | EU |
| Help Scout PBC | support chat, email and help centre | USA |
Stripe also acts as an independent controller for fraud prevention and its own legal obligations. Google, GitHub and Figma are independent controllers when you choose to connect them. We also share data with professional advisers bound to confidentiality, with authorities when the law requires it, and with a buyer or successor in a merger or acquisition, who will be bound by this policy. We do not sell personal data.
Transfers outside the EU
Some providers process data in the USA. We transfer it on the basis of the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914) with additional safeguards where needed. Write to us for a copy of the relevant safeguards.
AI and your content
We do not use your content to train AI models, and our AI provider processes it under commercial terms that do not allow training on it. We keep traces of AI runs for up to 90 days to fix errors and measure quality.
Cookies and similar technologies
| What | Purpose | Type | Duration |
|---|---|---|---|
| Sign-in session (app.tandmade.com) | keeps you signed in | strictly necessary | until you sign out or it expires |
| Sign-in, invitation and connection helpers | complete a magic link, invitation or sign-in with Google or GitHub securely | strictly necessary | minutes to hours |
| Interface preferences (local storage) | remember theme and panel layout | strictly necessary | until you clear them |
| Payment pages (Stripe) | fraud prevention during checkout | strictly necessary | set by Stripe |
| Product analytics (PostHog) | understand which features are used | analytics | up to 12 months |
| Support chat (Help Scout) | keep your conversation with support | functional | until you clear it |
We use strictly necessary technologies without consent, as Section 89(3) of Act No. 127/2005 Coll. allows. We use the others only with your consent where the law requires it, and you can withdraw consent at any time in the app’s privacy settings. tandmade.com counts visits without cookies.
Your rights
You have the right to access your data, have it corrected or erased, restrict its processing, receive it in a portable format, and object to processing based on legitimate interests — including, at any time and without giving reasons, to direct marketing. Where we rely on consent, you can withdraw it at any time; this does not affect earlier processing. Write to hey@tandmade.com. We reply within one month, which we may extend by two months for complex requests, and may need to verify your identity. You can also complain to the Office for Personal Data Protection (Úrad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz, or to the authority in your EU country.
Security
We protect data with measures appropriate to the risk, including encryption in transit, passwordless sign-in, access limited to staff who need it, a separate database for each Site, rate limits and logging. Annex II of our DPA describes them in more detail. No system is completely secure; we notify you and the authorities of a breach as the law requires.
Children
Tandmade is a professional service for adults. We do not knowingly process data of children under 16.
Changes
We may update this policy. We will tell you about material changes by email or in the app before they take effect. The date at the top shows the current version.