Privacy Policy
Last Updated: August 18, 2026
Tairo AS — the company behind tairopartners.com
Org. nr. 936 910 572 · Registered in Narvik, Norway
Tairo AS ("Tairo", "we", "us", or "our") provides AI automation and customer-engagement services for businesses. Protecting the privacy and security of data — whether it belongs to our business clients or is processed on their behalf — is central to how we operate.
We act in two distinct roles:
- Data Controller for the business contact information of our direct clients (for example, the names, roles, and email addresses of company representatives).
- Data Processor for personal data belonging to our clients' customers, leads, or prospects, which we process strictly under client instructions and a Data Processing Agreement (DPA).
1. Information We Collect
From business clients (controller role)
- Company and representative contact details (name, email, phone, job title)
- Contract, billing, and communication records
From clients' customers, leads, and prospects (processor role)
- Contact details (name, email, phone)
- Service interaction data (bookings, forms, CRM records)
- Lead and prospect data, including qualification, scoring, and enrichment data
- Communication logs (AI chat, voice/call recordings and transcripts, and messaging)
- Usage and performance data generated during AI interactions
System and operational data
- Analytics and usage logs used to operate and maintain our services
- Aggregated and fully anonymized data used for benchmarking and service improvement (this data does not identify any individual)
2. How We Use Information
As controller (business client data)
- To deliver and maintain contracted services
- To provide support and respond to inquiries
- To manage billing and meet compliance obligations
- To send important service updates and notifications
As processor (clients' customer, lead, and prospect data)
- To process inquiries, bookings, and communications on behalf of clients
- To operate AI chat, call, and automation services as instructed by clients
- To qualify, score, enrich, and follow up with the client's leads and prospects as instructed by the client
- To operate and improve the AI agents we deliver on a client's behalf, including automated review of interaction logs for quality and accuracy, subject to the client's instructions and our DPA
- To support quality assurance, compliance, and analytics for the client's own systems
We do not use personal data belonging to our clients' customers, leads, or prospects for any independent purpose. Where we carry out cross-client service improvement or benchmarking, we use only aggregated and anonymized data that no longer identifies any individual.
3. Legal Basis for Processing
- Contractual necessity — providing services to business clients under signed agreements
- Legitimate interests — maintaining service integrity, fraud prevention, and internal analytics (controller data only)
- Legal obligations — compliance with the GDPR and the Norwegian Personal Data Act (personopplysningsloven)
- Consent — only where required (for example, call recording or outbound marketing where mandated by the client's jurisdiction). Obtaining and documenting these consents is the responsibility of the client.
4. Security and Compliance
We take the security of personal data seriously and apply technical and organizational measures appropriate to the risk:
- Our AI services run on enterprise platform infrastructure that is independently audited against SOC 2 standards
- Encryption of data in transit (TLS) and at rest
- Access controls that limit who can access personal data
- Guardrails, intelligent escalation, and human-takeover safeguards built into our AI agents, keeping responses grounded in the client's own knowledge base
- Data-processing procedures designed to meet GDPR requirements, supported by Data Processing Agreements with our business clients
- Regular review of our security practices
5. Data Processing Agreements (DPAs)
For business clients, we provide a Data Processing Agreement that:
- Defines the processor and controller roles clearly
- Covers data subject rights and the deletion or return of data on termination
- Lists authorized sub-processors
- Grants audit and inspection rights
- Sets out breach notification timelines
6. Data Sharing and Sub-Processors
We share data only in limited circumstances:
- With sub-processors engaged to deliver our services, under binding contracts that require equivalent security and privacy standards
- With legal or regulatory authorities where required by law
We never sell or rent personal data.
We use sub-processors in the following categories:
- Cloud infrastructure and hosting providers (located within the EEA)
- Conversational AI and customer-engagement platform providers
- Large language model (LLM) providers
- Voice and telephony providers (for call-based services)
- Lead enrichment and data-validation providers (for lead-nurturing services)
- CRM, communication, and integration tools, where directed by the client
A specific, named list of our current sub-processors is available to contracted clients on request, under our Data Processing Agreement and applicable confidentiality terms.
Google user data and Gmail
This section applies specifically to our TairoX product when a workspace owner connects a business Gmail account. TairoX is an AI customer-support agent and shared inbox operated by Tairo AS. Gmail is connected only after an authorized workspace owner gives explicit consent through Google's OAuth flow, and access can be revoked at any time.
Google user data we access
- The connected account email address and basic identity used to authorize the connection
- Message and thread metadata (message and thread identifiers, timestamps, labels)
- Sender, recipient, subject, and message body of inbound support messages and their thread context
- Gmail history cursor and watch metadata used to keep the inbox in incremental sync
- TairoX labels applied to conversations (processed, ignored, escalated)
- OAuth access and refresh tokens needed to maintain the authorized connection
TairoX currently does not ingest email attachments.
How we use Google user data
- Sync and display business support conversations in the tenant-isolated TairoX inbox
- Generate and send user-configured or human-approved replies from the connected account
- Apply workflow labels for processed, ignored, and escalated conversations
- Maintain incremental synchronization of new inbound messages
- Security, audit, and troubleshooting of the connection you have authorized
Google user data is used only to provide the customer-directed support workflow you request. We do not sell it, use it for advertising, or use it for general or independent AI/model training.
AI subprocessors
To generate a requested support response, relevant message content may be sent to contracted model providers, including OpenRouter and the model providers it routes to. This processing is limited to the content needed to produce the reply. TairoX enables provider-side zero-data-retention (ZDR)/no-collection controls and restricts routing to endpoints declared to support those controls. Under the selected settings, providers must not retain this content, use it for their own purposes, or train models on it.
Protection, retention, and deletion
- Encryption in transit (TLS) and at rest
- Tenant isolation so each workspace's data is separated from every other workspace
- Least-privilege, role-based access; staff access is limited to what is required for support and operations
- Disconnecting Gmail stops the watch, revokes the Google grant, and deletes the stored OAuth credential. Previously synced customer-service conversation history remains subject to the workspace retention policy and is removed when the workspace/data deletion process applies
- You can disconnect and revoke access at any time through TairoX or through your Google Account permissions
- You can request deletion through TairoX workspace and data-deletion controls. Where an upstream provider cannot immediately purge a copy, we complete deletion on a best-effort basis and remove remaining copies as they expire under the provider's controls
Limited Use compliance
TairoX's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
7. Data Retention
- Business client data (controller role): retained for the duration of the contract plus 3 years.
- Clients' customer, lead, and prospect data (processor role): retained only as long as necessary to provide the services and in accordance with the client's instructions; returned or deleted on termination. We apply data minimization and do not retain personal data longer than required.
- Financial and accounting records: retained in line with the Norwegian Bookkeeping Act (bokføringsloven), typically 5 years.
Automated deletion is applied where possible.
8. International Data Transfers
- Our core infrastructure is hosted within the European Economic Area (EEA).
- Some sub-processors — in particular certain AI/LLM providers — are located in the United States. Where personal data is transferred outside the EEA, we rely on Standard Contractual Clauses (SCCs) and assess the transfer to apply appropriate supplementary safeguards.
9. Rights of Data Subjects and Clients
Business clients (controller role)
You have the right to access, correct, delete, port, restrict, and object to the processing of your personal data.
Clients' customers, leads, and prospects (processor role)
Rights are exercised through the relevant client. We support our clients in fulfilling these requests.
We acknowledge requests promptly and respond within 30 days, as required by law. For complex requests, we may extend this period by up to two further months and will inform you if we do.
10. Children's Privacy
Our services are intended for businesses and are not directed at children. We do not knowingly collect personal data from children under 13 (the age of digital consent in Norway). If we become aware that such data has been provided, we will delete it.
11. Contact
Tairo AS — tairopartners.com
Org. nr. 936 910 572
Kongens Gate 49, 8517 Narvik, Norway