Privacy Policy
This privacy policy explains how personal data is collected, used, and protected by Clint Bailo, trading as Tayeno ("we", "our", or "us"), operator of tayeno.com, with registered trading and correspondence address at Tayeno, The Bristol Office, 2nd Floor, 5 High Street, Westbury-on-Trym, Bristol, BS9 3BY, England. For questions regarding your personal data, contact us at [email protected]. We are registered with the UK Information Commissioner's Office under data protection registration reference ZC228768.
1. Data Controller vs. Data Processor Roles
Under the UK General Data Protection Regulation (UK GDPR):
- Data Controller: Tayeno acts as the Data Controller for direct customer account information, billing details, waitlist subscriptions, and website visitor analytics.
- Data Processor: When you subscribe and connect your email, calendar, or workflows to your agent instance, you (the customer) act as the Data Controller, and Tayeno acts as the Data Processor. We process such data exclusively on your behalf in accordance with our Data Processing Addendum (DPA).
2. Explicit Sub-Processors
We maintain full transparency regarding third-party service providers and sub-processors:
| Sub-Processor | Purpose | Location / Safeguards |
|---|---|---|
| OVHcloud | Dedicated, isolated server environment hosting each tenant's agent runtime and encrypted local storage. Every user is provisioned their own dedicated server environment, accessible 24/7 from anywhere. | European Union (UK IDTA & Standard Contractual Clauses) |
| Cloudflare, Inc. | Edge CDN, Pages hosting, Serverless Functions, and R2 Object Storage (encrypted vault artifacts) | USA / Global (UK IDTA & Standard Contractual Clauses) |
| OpenRouter, Inc. | LLM routing and model inference gateway for synthesis & triage | USA (UK IDTA & Standard Contractual Clauses) |
| DeepSeek (Hangzhou DeepSeek AI Co., Ltd.) | LLM Inference for drafting & synthesis (Direct API endpoint) | China (International Data Transfer under UK GDPR Art 49(1)(a)) |
| Stripe Payments UK, Ltd. | Subscription billing and card processing | United Kingdom / PCI-DSS Level 1 |
| Replicate, Inc. | Third-party model hosting for AI image generation (only when you use the image generation capability) | USA (UK IDTA & Standard Contractual Clauses) |
| Resend (Plus Five Five, Inc.) | Transactional email delivery (sign-in links, activation and service notices) | USA (UK IDTA & Standard Contractual Clauses) |
| Telegram FZ-LLC | Messaging gateway and user interface | Global / End-user interface |
International Data Transfer Notice: Model inference requests (inbox triage, draft generation, and dossiers) are routed securely via OpenRouter, Inc. or transmitted directly to DeepSeek API infrastructure. Image generation requests are dispatched to Replicate, Inc. only when you ask your agent to generate an image. Transfers outside the UK/EEA are governed by UK International Data Transfer Addendums (IDTA) and Standard Contractual Clauses, or explicit consent under UK GDPR Article 49(1)(a).
2A. Underlying AI Models
We do not train or own the foundational models we use. For transparency, the model families that process your content are:
- Frontier multilingual reasoning and vision models served by Hangzhou DeepSeek AI Co., Ltd. (directly or via OpenRouter, Inc.) — used for inbox triage, drafting, summarisation, research dossiers, and multimodal document/receipt reading. The vision path is used for receipt and document scanning.
- Third-party image synthesis models hosted by Replicate, Inc. — used only to render an image you have asked for.
Image generation fair usage. Image generation is capped at 80 images per billing period, shared account-wide across the agents on your account and resetting on your subscription renewal date. Document and receipt reading is metered separately and does not consume that image allowance. See the Terms of Service for the full fair-usage policy.
3. Security Architecture & Vaults
We enforce strict technical boundaries to safeguard your data:
- Zero Password Storage: We do not ask for or store main account passwords. Connections use app-specific passwords or scoped OAuth tokens.
- Secret Isolation: Credentials reside in an encrypted vault (AES-256-GCM) per tenant. Secrets are never passed into model context prompts.
- OS Isolation: Each customer agent executes under an isolated Linux user account with restricted filesystem permissions (0700).
- Draft-Only Outbound: Agents draft responses and require your explicit confirmation on Telegram before sending.
4. Data Retention & 30-Day Deletion
Upon subscription cancellation, all stored memory profiles, logs, and tenant vaults are permanently and securely purged within 30 days.
5. Your Rights and the ICO
You have statutory rights under UK GDPR to access, rectify, restrict, or erase your personal data. To exercise any of these rights, email [email protected].
Under Article 77 of the UK GDPR, you also have the right to lodge a complaint with the UK supervisory authority: the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF (ico.org.uk).
6. Data Controller & Contact Details
Data Controller: Clint Bailo (sole proprietor trading as Tayeno)
Trading & Correspondence Address: Tayeno, The Bristol Office, 2nd Floor, 5 High Street, Westbury-on-Trym, Bristol, BS9 3BY, England
Email: [email protected]
Note: This address is a registered commercial correspondence office for postal and legal service. It is not a retail premises open to the general public.