Privacy Policy
Last updated: 19.10.2026
1. Who we are
Tayanita Oy (“Tayanita”, “we”, “us”) builds custom AI sales systems that help small and medium-sized businesses define their ideal customers and find, enrich and prioritise leads.
- Business ID: 3422098-4
- Registered address: Kansakoulukuja 3, 00100 Helsinki, Finland
- Contact for privacy matters: tayanita@tayanita.ai
- Data protection contact: our CEO, reachable at the address above
This policy covers two things:
- Our website at tayanita.ai and email contact with us.
- The lead intelligence service we operate for our clients.
2. Our role: controller or processor
We act in two different roles depending on the data.
| Data | Our role | Explanation |
|---|---|---|
| Website visitors, people who email us, prospective clients | Controller | We decide why and how this data is used. |
| Client user accounts on the lead dashboard (names, emails, activity) | Controller | We run the service and manage access. |
| Company and contact data our service collects about prospect companies | Joint arrangement, documented per client | We collect the data with our own tooling; the client uses it for outreach. Roles and responsibilities are set in the client agreement and our Terms and Conditions. Where the client instructs us to process data it supplies (customer lists, ICP interviews), we act as processor under Article 28 GDPR. |
3. Data we collect and why
3.1 Website and contact
| Data | Source | Purpose | Lawful basis | Retention |
|---|---|---|---|---|
| Name, email, company, message content | You email us or fill in the contact form | Reply to you, discuss an engagement | Legitimate interest (responding to an enquiry); contract steps if you become a client | Until the enquiry is closed, then up to 24 months for follow-up unless you object |
| Technical logs (IP address, browser, pages visited) | Our hosting provider | Security, keeping the site running | Legitimate interest | [Per hosting provider defaults, typically 30 days or less] |
The website does not currently set analytics or marketing cookies. If that changes, a consent banner will be added and this section updated.
3.2 Client users of the lead dashboard
When your employer becomes a Tayanita client, you may be given access to a lead dashboard. Sign-in uses your company Google Workspace account.
| Data | Source | Purpose | Lawful basis | Retention |
|---|---|---|---|---|
| Email address, display name, Google account identifier | Google sign-in (OpenID scopes: openid, email, profile) | Create your account, restrict access to your company's domain, admin approval | Contract with your employer; our legitimate interest in securing the service | Life of the account plus 12 months, or until your employer asks us to remove you |
| Session cookie | Set by the dashboard on sign-in | Keep you signed in | Strictly necessary; no consent needed | 30 days or until you sign out |
| Activity log (sign-ins, admin actions, contact edits, feedback you submit) | Your use of the dashboard | Security audit trail, tracing who changed lead data | Legitimate interest | Life of the account plus 12 months |
| Discovery preferences and crawl schedule | You set them in Settings | Run lead discovery the way you asked | Contract | Life of the account |
| Google Sheets and Drive access tokens (optional) | Only if you connect your own Google account in Settings (scopes: spreadsheets, drive) | Export leads to a spreadsheet and folder you own, only when you request it or when a discovery run you started finishes | Consent, withdrawable by disconnecting in Settings or revoking in your Google account | Until you disconnect |
Google Sheets and Drive tokens are stored encrypted at rest on our server and are never shown back through the application interface. Exported lead data lives in your own Google account, under your employer's Google Workspace policies, not ours. We sync to Google Sheets only when you ask us to or when a discovery run finishes. Nothing is synced in the background.
3.3 Prospect companies and people at those companies
This is the core of the service and the part that most needs explaining.
What we collect about companies.Company name, Business ID, registration date, industry code, municipality, website address, registered notices, financial figures from public filings, press releases, open job listings, and a short AI-written brief describing what the company does and why it may fit the client's target profile.
Where it comes from. Only sources we have the right to use:
- Finnish Patent and Registration Office (PRH / YTJ) open data, licensed CC BY 4.0.
- Finnish Tax Administration public corporate tax data, licensed CC BY 4.0.
- PRH digital financial statements.
- The company's own public website, fetched by our own crawler.
- Public press-release wires (STT Info, ePressi) and web search (Brave Search, Exa) used only to locate the company's website and press coverage.
We do not buy data from commercial contact databases, we do not scrape LinkedIn, and we do not use data brokers.
What we collect about people.We do not search for individuals. We only record the contact details a company publishes itself, such as the phone number or email address on its own website. Where a company's own website names a person as a contact (for example the CEO), we may record that person's name, job title, work email address and work phone number as published there, and nothing else. We record where each contact was found and when. We do not collect home addresses, personal phone numbers, photos, or anything about a person's private life. We never process special categories of data (health, political opinions, and so on).
Why we collect it.So that our client's sales team can identify a relevant business contact and prepare for a first conversation. The data is business-to-business contact information that the person's employer has published for exactly this kind of contact.
Lawful basis. Legitimate interest (Article 6(1)(f) GDPR) of Tayanita and its client in business-to-business marketing. We rely on this because:
- the data is limited to a professional role and published work contact details;
- the source is the company's own public website;
- the person can reasonably expect business enquiries at a published work address;
- we keep a Legitimate Interest Assessment on file for each client engagement and re-run it when the processing changes.
What the AI does. An AI language model, accessed through OpenRouter, reads the collected evidence and writes a short brief plus a fit category (HOT, WARM, COLD or UNSCORED). This is a research aid for a human caller. No decision with legal or similarly significant effect on any person is made automatically, and no contact is made automatically by the system. Every claim in the brief is tagged with its source so a human can verify it.
Retention.
| Data | Rule |
|---|---|
| Company facts and evidence | Re-verified when older than 30 days. Kept while the client engagement is active. Deleted or anonymised within 90 days of engagement end unless the client has exported it under their own controllership. |
| Person-level contact routes | Automatically retired when a re-crawl of the source page no longer shows them. Deleted on request. Never shared with other Tayanita clients. |
| Database backups | Rolling 14 nightly copies, plus off-site copies with a defined expiry. Deleted data disappears from backups within that cycle. |
Shared company-facts cache.To save costs and avoid re-crawling the same company for every client, every company-level finding is stored in a shared cache (name, age, website, public financials, evidence excerpts with source URLs). It contains no user data, no person-level contact data and no client-specific judgements. Each client's briefs and fit categories stay in that client's own database.
4. Who receives the data
We use the following processors. Each is bound by a data processing agreement or equivalent terms.
| Recipient | What they receive | Where | Why |
|---|---|---|---|
| DigitalOcean (hosting) | Everything stored by the service | EU, Frankfurt (Germany) | Servers, database volumes, backups |
| Google (Google LLC / Google Ireland) | Your sign-in identity; and, if you connect it, the leads you export to Sheets and Drive | EU/US, covered by Google's Data Processing Terms and the EU-US Data Privacy Framework | Sign-in and optional export |
| Resend, Inc. (email delivery) | What you enter in the website contact form: name, company, work email and message | EU sending region (Ireland); Resend is a US company, transfers under Standard Contractual Clauses | Delivering your contact-form message to our inbox |
| OpenRouter, Inc. and the model provider it routes to | Collected company evidence, which may include names, roles and work contact details found on the company's website | United States, under Standard Contractual Clauses | Writing the lead brief |
| Brave Software, Inc. (Brave Search API) | Company name and Business ID as a search query | United States | Finding the company's website |
| Exa Labs, Inc. (Exa API) | Company name as a search query | United States | Finding the website and press coverage |
| PRH, Tax Administration, STT Info, ePressi | Company identifiers as lookups | Finland | Public-record retrieval |
Our own crawler runs on our own server and sends nothing to third parties. We do not sell personal data and do not share it with advertisers.
For transfers outside the EU/EEA we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the recipient is certified, and otherwise on Standard Contractual Clauses with supplementary measures. Copies are available on request.
5. Security
- All traffic is encrypted in transit (HTTPS). Session cookies are HTTP-only, SameSite and Secure.
- Access to the dashboard is limited to accounts on the client's own email domain, plus explicitly listed Tayanita support accounts. New accounts must be approved by a client administrator.
- API keys and OAuth tokens are stored outside the code and never returned by the application interface.
- The database and the crawler are not reachable from the public internet. Only the web entry point is exposed, behind a firewall.
- Nightly consistent backups, stored on a separate volume and copied off-site.
- Company-owned admin accounts control hosting, domains and repositories.
6. Your rights
Under the GDPR you can ask us to:
- Access the personal data we hold about you.
- Rectify inaccurate data. In the dashboard, callers can also mark a contact route as wrong directly, which removes it from use.
- Eraseyour data. For prospect contacts, we will remove you from our database and from the client's pipeline and add your Business ID and email to a suppression list so you are not re-collected.
- Object to processing based on legitimate interest, including business-to-business marketing. If you object to marketing we will stop without asking for a reason.
- Restrict processing while a dispute is resolved.
- Port data you gave us in a machine-readable format.
- Withdraw consent at any time where consent is the basis (Google Sheets/Drive connection).
Send requests to tayanita@tayanita.ai. We respond within one month. You will need to confirm your identity. If you are a prospect contact and we hold your data on behalf of a client, we will handle the request and inform the client.
You can also lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi) or the supervisory authority in your EU country of residence.
7. Transparency to prospect contacts
Because we collect professional contact data without the person's direct involvement, Article 14 GDPR applies. Our client, when making first contact, tells the person where their details came from and points to this policy. Where a client engagement makes it feasible, we also notify the contact directly within one month of collection or at first communication, whichever is earlier.
8. Children
Our services are for businesses. We do not knowingly collect data about anyone under 18.
9. Changes
We will post changes on this page and update the date at the top. Material changes affecting client users will be announced in the dashboard or by email. See also our Terms and Conditions.