Version: v0.5 • Effective: 1 September 2026
Who we are: Taca is an AI-powered assistant and CRM operated by Tacatech Ltd, a company registered in England & Wales under company number 17355560, with its registered office at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.
Contact: privacy@tacatech.net
ICO registration: Tacatech Ltd is registered with the UK Information Commissioner's Office (ICO) under registration reference ZC205697.
"UK GDPR", "controller", "processor", "personal data", "processing", "data subject"
and "personal data breach" have the meanings in UK GDPR / the Data Protection Act
2018. "Sub-processor" means a third party engaged by Taca to process Controller
Personal Data.
Taca processes Controller Personal Data only to provide the Service. See
Annex I for the subject matter, duration, nature and purpose, categories of data,
and categories of data subjects.
Taca shall:
(a) process Controller Personal Data only on the Controller's documented
instructions (the Terms and use of the Service being such instructions), unless
required by law (in which case it will inform the Controller unless prohibited);
(b) ensure persons authorised to process are bound by confidentiality;
(c) implement appropriate technical and organisational security measures (Annex II);
(d) respect the conditions in Sections 4–5 for engaging sub-processors;
(e) assist the Controller, so far as possible, to respond to data-subject rights
requests;
(f) assist the Controller with security, breach notification, and DPIAs
(Articles 32–36);
(g) notify the Controller without undue delay after becoming aware of a personal
data breach;
(h) at the Controller's choice, delete or return Controller Personal Data at the end
of the Service and delete existing copies unless law requires retention.
Where the Controller enables automation, actions Taca performs via the Fanvue
API (including sending approved or automated messages) are taken **on the
Controller's instruction and attributed to the Controller**. The Controller is
responsible for configuring automation lawfully. Taca's
product behaviour is to disclose that it is an AI when a fan asks, and never to claim to be
human. The parties will determine whether any proactive disclosure of
automated/AI interaction to fans is required by applicable law and, if so, how it is given.
Controller Personal Data (fan-authored messages and details) is processed only to
provide the Service to the Controller's own account, and is never used for any
cross-creator or secondary product-improvement purpose - regardless of any setting the
Controller enables. Where the Controller opts in to "Help improve Taca" (see the Privacy
Policy), only material the Controller personally authored as the creator side of a
conversation is in scope for that separate, narrower use. Cross-creator review of that
creator-authored material is active (see Privacy Policy §1/§9A for the assessment
status this was enabled ahead of); fan-authored material remains excluded from it
regardless.
The Controller authorises Taca to engage the sub-processors in Annex III
(e.g. AI drafting provider, hosting provider). Taca will impose data-protection
terms on each sub-processor no less protective than this DPA and remains liable for
their performance. Taca will give notice of intended changes and allow the
Controller to object on reasonable data-protection grounds.
The Controller warrants that it has a lawful basis and any required notices/consents
for the data it directs Taca to process, and that its instructions comply with
data-protection law.
Where Controller Personal Data is transferred outside the UK/EEA (e.g. to a
sub-processor), the parties will put in place a valid transfer mechanism (such as the
UK IDTA or standard contractual clauses) together with any appropriate supplementary safeguards.
Taca will make available information necessary to demonstrate compliance and
allow for audits on reasonable prior notice and subject to confidentiality and reasonable frequency limits.
Liability under this DPA is subject to the limitations set out in the Terms. This DPA continues while Taca processes Controller Personal Data.
On termination, Taca will delete or return Controller Personal Data per
Section 3(h) and confirm deletion on request.
optional automated sending, safety screening.
prospective fans) on Fanvue.
interaction and spend/earnings data, and any personal data fans include in
messages. Given the nature of the platform, this may include special-category data and data concerning a person's sex life or sexual orientation.
Accurate to the current system. Each sub-processor is engaged under its own data-processing terms; transfers outside the UK are covered by the mechanism in section 7.
| Sub-processor | Purpose | Location |
|---|---|---|
| OpenRouter | AI drafting of replies. Configured to route to an uncensored open-weight model (currently Hermes); not configured to route to OpenAI/Anthropic/Google. | US |
| Venice AI (failover only) | Chat drafting only when OpenRouter is unavailable; also captioning a vault image on request | US |
| Supabase | Secondary database: account mirror (incl. creator email) + rebuildable fan/conversation/message metadata cache. No message bodies, media or tokens. | See section 7 |
| App/DB host - Fly.io | Application + main database hosting | London (LHR) |
Not used (kept here so nobody re-adds them): OpenAI/Anthropic/Google direct (keys
hard-disabled), xAI Grok, and Stripe. Payments are taken by Fanvue, not by us - there is no
payment processor in this product.
Studio / GPU host - not engaged while disabled. Image generation (the Studio) is
switched off in production. While off, no GPU/training provider processes any data and **no
face or biometric data is collected**. When the Studio is enabled it WOULD engage a GPU host
that processes special-category facial data (character/face images); that host's transfer
mechanism and security posture must be assessed and a DPIA completed **before
it is enabled**. It is not a current sub-processor.
*Note: Fanvue is the source platform and the creator's own platform, not a Taca
sub-processor. It is, however, the payment processor for subscriptions to this app.*