This Privacy Policy explains what personal data Tawa Guard Ltd ("Tawa Guard", "we") collects when you use the Tawa Guard platform, why we collect it, how long we keep it, and the rights you have over it.
This policy covers data for which we are the controller — chiefly your account and billing data. Content your applications submit to our APIs for scanning is processed on your behalf as described in our Data Processing Agreement, where you are the controller and we are your processor.
1. Who we are
Tawa Guard Ltd, registered in England and Wales (company number 17425810), registered office 66 Paul Street, London, England, EC2A 4NA. Privacy contact: gdpr@tawaguard.com.
2. What we collect
| Data | Source | Examples |
|---|---|---|
| Account profile | Your sign-up or sign-in provider (email and password, GitHub, or another supported provider) | Name, email address, avatar image |
| Authentication data | Generated by us | Session tokens, password (stored hashed) if you sign up with email, multi-factor authentication secrets and backup codes (encrypted), sign-in IP address and browser user agent |
| Workspace data | You | Workspace names, member roles, invitations you send (including the invitee's email address), API key names and metadata |
| Onboarding responses | You | Optional survey answers (your role, intended use, team size) |
| Billing data | You / Stripe | Subscription plan, billing status, Stripe customer and subscription identifiers. Card details are collected and held by Stripe, not us |
| Usage metadata | Generated by us | Per-request job records: timestamps, verdict classification, Tawa Unit usage, the API key and environment used. Not the content of scanned requests |
| Product analytics (optional) | PostHog, only if you opt in | Pages viewed, features used, onboarding step completion, which version of a page or flow you saw in an experiment, your user ID, name and email once you are signed in, and error reports. Never the content of what you submit for scanning |
| Audit log | Generated by us | Security-relevant events (sign-ins, role changes, key creation, billing changes) with the acting user, IP address, and user agent, protected by a tamper-evident hash chain |
| Support communications | You | Emails you send to our support address. They are received through our email provider and handled in our support system, which runs on our own servers |
We do not collect card numbers. Our primary /v1 scanning endpoints do not store scanned
content unless you turn on prompt retention for an app, in which case the text is kept for the
period you choose, up to your plan's limit, and deleted when that period ends.
3. Why we process it (lawful bases)
| Purpose | Lawful basis |
|---|---|
| Providing the Service: accounts, workspaces, scanning, dashboards | Performance of a contract |
| Billing and payment collection | Performance of a contract; legal obligation (tax and accounting) |
| Security: mandatory MFA, session management, audit logging, abuse and fraud prevention | Legitimate interests (protecting the Service and its customers) |
| Service emails: policy-change notices, billing and security notifications | Performance of a contract; legal obligation |
| Improving the Service using aggregated, de-identified usage metrics | Legitimate interests |
| Product analytics and A/B testing (PostHog), when you opt in | Consent |
We do not sell personal data and we do not use it for third-party advertising.
4. How long we keep it
| Data | Retention |
|---|---|
| Account profile, workspace data | Until you delete your account or workspace |
| Sessions | Until expiry or sign-out |
| Verification tokens and pending invitations | Until they expire |
| Multi-factor authentication secrets | Until removed or account deletion |
| Audit log | 400 days, then automatically purged. Audit entries are retained for the full window even if the related account is deleted. Surviving entries keep the deleted account's internal identifier, IP address and user agent until they are purged, but no longer link to a profile |
| Usage metadata (job records, no content) | Lifetime of the workspace |
| Billing records and invoices | 6 years (UK statutory retention), held in Stripe |
| Abuse-prevention records | A hashed identifier may be retained after deletion to prevent ban evasion, and keyed hashes used to stop repeat claims of free grants |
| Encrypted backups | Deleted data may persist in backups for up to 30 days before ageing out |
5. Account deletion
You may request deletion of your account and its personal data. Deletion removes your profile, sessions, authentication data, memberships, onboarding responses, and personal billing record, subject to the retention carve-outs above (audit log window, financial records, abuse prevention). Workspace owners must transfer or delete their workspaces first. A self-service deletion control is provided in account settings; you can also email gdpr@tawaguard.com.
6. Who we share it with (sub-processors and recipients)
We use a small number of service providers to run the platform:
| Provider | Purpose |
|---|---|
| Vercel | Application hosting and request logs |
| Neon (PostgreSQL, UK region) | Managed database and backups |
| Cloudflare | Object storage (R2) and bot protection (Turnstile) |
| Upstash | Redis queue and short-lived caches |
| Stripe | Payments, invoicing, and billing records |
| Identity providers (GitHub; Google, Microsoft, GitLab and Hugging Face where offered) | Sign-in |
| Resend (US-hosted) | Transactional email (verification, password reset, invitations, service notices) |
| OVH (UK region) | Scanning worker infrastructure and its Redis cache (content processed in flight and short-lived caches, not stored) |
| PostHog (EU-hosted) | Product analytics and A/B testing, only for visitors who opt in to analytics cookies |
| Google Workspace (EU-hosted) | Business email and support mailboxes (emails you send us and our replies) |
Our customer support system runs on our own servers. Email delivery and mailboxes for support and other business email are provided by Google Workspace.
We may also disclose data where required by law, or as part of a merger, acquisition, or sale of assets (with notice to you).
7. International transfers
Where personal data is transferred outside the UK/EEA (for example to US-based infrastructure providers), we rely on appropriate safeguards: the UK International Data Transfer Agreement or Addendum, EU Standard Contractual Clauses, and/or adequacy regulations, as applicable.
8. Security
Access to the platform requires mandatory multi-factor authentication. Data is encrypted in transit. Security-relevant actions are recorded in a tamper-evident audit log. API keys and invite-link tokens are stored hashed. Access to production data is restricted and staff actions are audited.
9. Your rights
Under UK and EU data-protection law you have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing based on legitimate interests. To exercise any right, email gdpr@tawaguard.com — we respond within one month. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
10. Enquiries and early access requests
If you leave your work email address through a form on our website, such as "Request early access", we collect that address, which form you used, and the time of your request. If you email us directly, we also receive the message you send.
We use it only to reply to your request. We do not add you to a newsletter or send you marketing email because you made an enquiry. The one exception is the subscribe form on our Research pages, where you give your address to get a note when a new research post goes up, as well as to hear back about your request. You can ask us to stop at any time.
Our lawful basis is legitimate interests in responding to business enquiries, or taking steps at your request before a contract.
The form sends your request as an email through Resend. It lands in our support mailbox, which is hosted on Google Workspace, and is handled in our support system on our own servers. Both providers are listed in Section 6. We do not keep the address anywhere else.
We keep an enquiry for as long as needed to handle the request and a short period afterwards. If it leads to an account, the account data in Section 4 applies from then on.
To have an enquiry deleted, email gdpr@tawaguard.com.
11. Changes to this policy
We will notify customers by email of any material change to this policy and update the "Last updated" date shown above. Continued use of the Service more than 30 days after notice constitutes acceptance of the updated policy. If you do not accept a change, see Section 12 of the Terms of Service — you may close your account, and in some cases we may need to terminate the Service in line with our terms and any applicable contract, which, depending on that contract, may be without refund or rebate.
12. Contact
gdpr@tawaguard.com — or write to us at 66 Paul Street, London, England, EC2A 4NA.