Privacy Policy

Two roles

When you order from a business, the business decides what it needs to know to fulfil your order and is responsible for how it uses your details; Tagura processes that information for the business as its service provider. Tagura is directly responsible for information about account holders and business owners, and for how the Service itself works.

Information we collect

Information you give us: name, email, phone number, delivery address, order details, messages, files and photos you upload, and (for business owners) business and payout details provided to Stripe.

Messages: when a business connects Instagram, Facebook Messenger, WhatsApp or an email inbox to Tagura, the messages you exchange with that business there (with your name, username, phone number or email address as the platform provides them) are stored so the business can read and answer them in one place.

Sign-in with another account: if you choose to sign in with Apple, Google, Microsoft or Yahoo, we receive your account identifier, name and email address (or Apple’s private relay address) from that provider.

Payment information: card details are entered on Stripe’s pages and handled by Stripe. We receive limited details such as the card brand, last four digits and payment status.

Automatic information: device and browser type, pages viewed on ordering pages (counted with a random per-browser identifier, not an advertising cookie), approximate location from IP address, and security logs. We store a one-way hash of IP addresses for abuse prevention rather than the raw address where possible.

Cookies: we use strictly necessary cookies for sign-in, security and language. We do not use third-party advertising cookies.

How we use information

To provide the Service: place and manage orders, process payments through Stripe, send confirmations, quotes, receipts and reminders, and provide support.

To keep the Service safe: prevent fraud, abuse and security incidents, and enforce our terms.

To improve the Service: understand how features are used, in aggregate.

AI features: if a business uses the AI order inbox or catalog import, the message, image or file it submits is sent to our AI provider to produce a draft. Providers we use do not train their models on this data under our agreements. Drafts are reviewed by the business before anything is created. If someone at a business uses the in-app assistant, their question and the business records the assistant looks up to answer it (which can include customer names and order details) are sent to the AI provider in the same way, and nothing is changed until that person confirms it.

We do not sell personal information and we do not share it for cross-context behavioral advertising.

Who we share it with

The business you order from receives your order details and contact information.

Service providers who process data on our behalf under contract, including hosting and database providers, Stripe (payments), email delivery, SMS delivery, file storage, error monitoring, AI processing for the features above and, for businesses that use it, DoorDash (delivery).

Accounts a business connects: when a business links its calendar, Google Business Profile, Instagram, Facebook Page, WhatsApp number, email inbox or other tools, Tagura exchanges the information needed for that connection with the provider (for example, an appointment’s time and the customer’s name go to the business’s own calendar, and replies go to the customer through the platform they wrote on). The business can disconnect at any time.

Tagura’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Information from Microsoft, Meta and other connected platforms is used only to provide the features the business turned on.

Our support staff: if a business buys our setup service and allows it, our staff can open that business’s account, including its orders and customer details, for up to 14 days or until the business removes that access. Every change they make is logged.

Legal and safety: when required by law, to protect rights and safety, or in connection with a merger or acquisition (with notice where required).

Retention

Order records are kept while the business keeps its Tagura account, so it can meet its own legal and tax obligations. Personal details on checkouts that were started but never completed are removed after 30 days. The content of emails and texts we send is removed after 30 days; delivery records are kept for up to 13 months. Ordering-page analytics are kept for up to 13 months, and security and audit logs for up to 24 months. Assistant conversations are deleted 90 days after their last message. Conversations from connected messaging and email accounts are deleted after 24 months without new messages, and immediately when the business erases that customer. Access to a connected account, and data read from it such as calendar busy times, is deleted when the business disconnects it. When a business closes its account, its ordering page goes offline at once and its data is deleted 30 days later, after an export window, except where we must keep records by law.

Your choices and rights

You can update your profile and delete your account from your account page. Text messages stop when you reply STOP. Marketing emails include an unsubscribe link.

Depending on where you live (for example California under the CCPA/CPRA), you may have rights to know, access, correct, delete or obtain a copy of your personal information, and to not be discriminated against for using these rights. For information a business holds about your orders, contact the business; we will help them respond. To make a request to Tagura, email [legal@yourdomain]. We will verify your request before acting on it. You can use an authorized agent where the law allows.

Security

We use encryption in transit, encryption of sensitive fields at rest, access controls, rate limits and monitoring. No system is perfectly secure; if a breach affects you, we will notify you as the law requires.

Children

The Service is not directed to children under 13 and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.

Changes and contact

We will post changes here and update the effective date. Questions: [legal@yourdomain], [Company legal name], [Company mailing address].