Privacy Statement

Your privacy is important to us. We would never sell your data. Our service collects only basic login information, the content you upload, ordinary error monitoring, and product analytics. To enable us to build a better experience for you, we also collect data on how you best read, understand, and learn content.

Introduction

This policy applies to all Tailo users, including:

• Direct sign-ups (including DSA students) – Estendio Ltd is the Data Controller of your personal data.
• Institutional access – Your educational institution is the Data Controller, and Estendio Ltd acts as their Data Processor, processing personal data only on their instructions.

By using Tailo, you agree to the terms of this Privacy Policy.

Data we collect

When you are using Tailo and our other services, we may collect information about you in a variety of ways. The information we collect depends on the content and materials you use, and includes:

Personal data

We collect and store all personal information related to your Tailo profile, which you voluntarily give us either upon sign-up or through continued use of Tailo:

• Name
• Email address
• Occupation (e.g., student, employed)
• Feedback you provide in Tailo
• Reading profile data

To enable us to build a better reading experience for you, we collect and store data on how you best read, understand, and learn content. This data is voluntarily provided either upon sign-up or through continued use of Tailo, and includes:

• Your chosen visual settings and preferences
• Uploaded documents
• The files that you upload to our product are processed and saved on our servers. This includes the content, titles, and metadata.
• Performance data

We may use information collected about you via Tailo to:

• Generate a personal profile about you to make future visits to Tailo more personalised
• Monitor and analyse usage and trends to improve your experience with Tailo
• Notify you of updates to Tailo
• Request feedback and contact you about your use of Tailo

When we share your information

We will not sell, distribute, or lease your personal information to unrelated third parties unless we have your permission or are required by law to do so.

We may share your information with:

• Your institution (only if you are an institutional user, and only for purposes related to the pilot)
• Service providers that process personal data on our behalf and have appropriate security controls in place
• Authorities, where required by law
• Safeguards and security
• Security practices

We use appropriate security measures to protect the security of your personal data both online and offline. These measures vary based on the sensitivity of the personal data we collect, process, and store, and the current state of technology. We also take measures to ensure service providers that process personal data on our behalf also have appropriate security controls in place.

While we strive to protect your personal data, we cannot guarantee that unauthorised access, hacking, data loss, or a data breach will never occur. To protect the confidentiality of your account and prevent unauthorised use, you must keep your account access code confidential and not disclose it publicly or to unauthorised individuals.

Data transfers and residency

US pilot users – Personal data is hosted in the US (including authentication and storage) for compliance with institutional data residency requirements.

UK/EU users – Personal data is hosted in the EU (AWS Ireland availability zone).

Authentication – Our authentication provider, Descope, stores user data in either the United States or the EU, depending on where your project is set up.

Data exported from the UK to Descope is protected using Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner’s Office or via the UK–US Data Privacy Framework.

Hosting – Our hosting provider, AWS, is certified under the UK–US Data Bridge, ensuring transfers are safeguarded under UK-compliant mechanisms.

Limited transfers – In the normal course of operations, data remains within its primary region. Transfers between the UK/EU and US occur only when required to provide support, investigate technical issues, or fulfil deletion requests.

Compliance frameworks

We comply with:

• UK GDPR and the Data Protection Act 2018
• FERPA when processing education records for US institutions
• Relevant US state privacy laws (including CCPA and CPRA) to the extent they apply. Even where these laws do not strictly apply, we follow their principles as part of our commitment to privacy best practices.

Your rights and choices

Access, correction and deletion

You may send us an email at support@tailoapp.co.uk to request access to, correct, or delete any personal information that you have provided to us.

We may not be able to delete your personal information except by also deleting your user account. We may also decline a request to change information if we believe the change would violate any law or legal requirement, or cause the information to be incorrect.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, some information may be retained in our files to prevent fraud, troubleshoot problems, assist with investigations, enforce our Terms of Service, and/or comply with legal requirements.

If your account is managed by an institution, please contact them first as they may control certain aspects of your data.

Data retention

We retain your personal data for as long as your account is active or as required to provide the service. When your account is deleted (either by you or your institution), we delete or anonymise your data unless we need to retain it for legal or regulatory purposes.

Changes and contact

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. You are advised to review this page periodically for any changes. We will notify you of any changes by posting the new Privacy Policy on this page. These changes are effective immediately after posting.

Contact us

If you have questions or comments about this Privacy Policy, please contact us at:

Email: support@tailoapp.co.uk