1. Who we are

Taoro is an early access business software service operated by KStudio SIA in Latvia, European Union. Taoro brings client relationships, bookings, work management, invoicing and related agency operations into one organisation workspace.

This policy applies to the Taoro marketing website, application, public booking pages and forms, and our related service communications. Privacy questions and requests can be sent to privacy@taoro.app.

2. When we are controller and when we are processor

KStudio SIA is the data controller for information needed to run Taoro as a business: website enquiries, user accounts, organisation administration, billing, service communications, security and aggregate website analytics.

For information an organisation enters into Taoro about its own clients, prospects, guests, suppliers and work, that organisation normally decides why and how the information is used. The organisation is the controller and KStudio SIA acts as its processor, handling the information on the organisation's instructions to provide the service. This includes information submitted through that organisation's public Taoro forms and booking pages.

Your organisation is responsible for giving its data subjects any required privacy information and having an appropriate legal basis for the data it puts into Taoro.

3. Information we process

The information depends on how you use Taoro and may include:

Account and identity information: name, email address, profile image, Google authentication identifiers, session information, organisation membership, role and access permissions.
Organisation and billing information: company and trading details, plan, member count, invoice details, VAT number, payment status and commercial correspondence. Founding and other early access subscriptions are invoiced directly. When a Stripe hosted payment link is used, Stripe receives payment details directly and Taoro receives the records and status needed to administer the transaction.
Customer Data: client and prospect records, contact details, CRM activity, tasks, boards, projects, comments, files, bookings, calendar availability, form submissions, invoices, receivables, accounting entries, imported time, automation configuration and run records.
Public form and booking information: details a visitor chooses to submit, such as a name, email address, answers, booking selection and message, plus limited request and security metadata needed to deliver and protect the public surface.
Integration information: configuration, identifiers and data exchanged with services an organisation chooses to connect, such as email, calendar, file storage, payments, time tracking, lead sources or AI providers.
Support and operational information: messages, feedback, diagnostic details, event records and security logs generated when you contact us or use the service.
Marketing site analytics: aggregate visit information collected through Plausible Analytics, including page path, referrer, browser, operating system, device type and approximate location. Plausible does not set analytics cookies or store raw IP addresses or persistent visitor identifiers. Its current method is described in the Plausible data policy.

Please do not place passwords, payment card details, government identifiers or special category personal data in ordinary Taoro fields unless a feature explicitly supports that information and your organisation has confirmed an appropriate legal basis and safeguards.

4. Where information comes from

We receive information directly from users and public form visitors, from the organisation that invited a user, from Google when a user authenticates with Google, and from integrations the organisation chooses to connect. We also generate limited operational records when the service is used.

5. Why we process information

Provide accounts, organisation workspaces, public forms, bookings, CRM, work management, invoicing, accounting and connected features.
Authenticate users, apply permissions, keep the service secure, investigate abuse and maintain operational records.
Administer early access plans, invoices, payments, tax records and customer support.
Send transactional and service related messages.
Understand aggregate website usage and improve the reliability and usability of Taoro.
Meet legal obligations and establish, exercise or defend legal claims.

Where KStudio SIA is controller, we rely on:

Contract and pre contract steps to create and administer accounts, provide the workspace, support users, send essential service messages, and manage the plan the Customer requested.
Legal obligations to keep required billing and tax records, respond to valid legal requests and meet applicable compliance duties.
Legitimate interests to secure Taoro, prevent misuse, diagnose faults, improve reliability, understand aggregate marketing site usage and establish or defend legal claims. Those interests are the safe and effective operation of a business software service.
Consent for optional communications or other processing where consent is required. Consent can be withdrawn at any time.

Where KStudio SIA is processor, we process Customer Data on the organisation's documented instructions and the organisation determines the applicable legal basis.

6. Service providers, integrations and disclosures

We disclose information only as needed to run Taoro, follow an organisation's instructions, comply with law or protect legal rights. The recipient categories may include:

cloud hosting, database, storage, security and authentication providers;
transactional email, support and operational monitoring providers;
Plausible for aggregate marketing site analytics;
Stripe and relevant financial providers for invoices and payment processing;
services an organisation deliberately connects, including Google and providers for calendars, file storage, email delivery, payments, time tracking, lead data or AI;
professional advisers, authorities or counterparties where legally necessary.

These providers act under their own terms or under contractual processing obligations, depending on the service and context. We do not sell personal data or use Customer Data for third party advertising.

7. International transfers

We prefer EEA processing where practical, but some providers or customer selected integrations may process information outside the EEA. Where GDPR transfer rules apply, we use a recognised safeguard as appropriate, such as an adequacy decision or the European Commission's Standard Contractual Clauses, and assess supplementary measures where required. Contact us for information relevant to a particular transfer.

8. Retention and deletion

We keep account and Customer Data while the organisation's account is active and for the limited period reasonably needed to close the account, respond to requests, resolve disputes and maintain service integrity. Deletion from backups follows the normal backup replacement cycle. We may retain billing, tax and transaction records for the period required by law, and keep limited security records for as long as needed to investigate and prevent misuse.

Early access export and deletion tooling is limited. A whole workspace self service export is not generally available; narrower exports exist, and other retrieval or deletion requests may require manual support.

An organisation administrator may ask us to close an organisation workspace or delete Customer Data by contacting privacy@taoro.app. Individual data subjects whose information was placed in Taoro by a customer should normally contact that customer first; we will assist the customer with a valid request as required.

9. Security

We use technical and organisational measures intended to protect information, including authenticated access, organisation level permissions, service monitoring and access restrictions for operational personnel. No online service can guarantee absolute security. Users should protect their accounts, connected provider credentials and devices, and tell us promptly about suspected unauthorised access.

10. Your data protection rights

Depending on the context and applicable law, you may have rights to access, rectify or erase personal data; restrict or object to processing; receive portable data; and withdraw consent without affecting earlier lawful processing. You may also complain to a supervisory authority. In Latvia, this is the Data State Inspectorate.

Send a request to privacy@taoro.app. We may need to verify your identity and authority before acting. We respond within the period required by applicable law.

11. Cookies and similar technologies

The Taoro marketing site uses Plausible's cookieless analytics. The application uses strictly necessary browser storage or session technologies for authentication, security and user preferences. Connected or linked third party services may use their own technologies under their privacy notices.

12. Business use and children

Taoro is intended for organisations and business users, not for children. We do not knowingly offer accounts to children. Public forms and booking pages are controlled by the organisation that publishes them.

13. Changes to this policy

We may update this policy as Taoro and its providers change. We will update the date above and, where a change is material, provide notice through the service, by email or by another reasonable method.

14. Contact

KStudio SIA
Latvia, European Union
privacy@taoro.app