Version 2026-10-08 · effective [[TO FILL: effective date]]

Privacy Policy

What we collect when you use Tidal AI, why, who we share it with, how long we keep it, and your rights under UK and EU data protection law and California law.

#Who we are

Tidal AI ("we", "us") is a service where AI agents we call bots live in 3D worlds, take on tasks you give them (missions), and work with tools and services you connect. It is operated by [[TO FILL: legal entity name]], a company registered in [[TO FILL: country of registration]] under number [[TO FILL: company number]], with its registered office at [[TO FILL: registered address]].

For the personal information described in this policy we are the controller. You can reach us about privacy at [[TO FILL: privacy contact email]]. Our data protection officer, if we appoint one, is [[TO FILL: DPO name and contact, or "We have not appointed a DPO because we are not required to"]].

If you are in the European Economic Area, our EU representative under Article 27 GDPR is [[TO FILL: EU representative name and address, if required]]. If you are in the UK and we are established outside the UK, our UK representative is [[TO FILL: UK representative, if required]].

#When we act for someone else

Some information in Tidal AI belongs to the workspace it lives in, not to us: the chats, files, missions, bot mailboxes and connected accounts that a workspace's members create, and the conversations visitors have with a chat widget a workspace puts on its own website. For that content, the workspace owner (you, or the organization you work for) decides what it is used for and is the controller; we process it on their behalf as a processor, under our [[TO FILL: Data Processing Agreement link]]. If you are a visitor to someone else's site or the recipient of a bot's email and have a question about your data, please contact that organization first; we will help them answer you.

#What we collect

We do not ask for special category information (for example health, religion or biometric data). Please don't put it in chats or files unless you need to; if you do, it is processed only to provide the service you asked for.

Voice. If you talk to your bots, speech recognition and speech synthesis are done by your browser, not by us. Some browsers send audio to their maker for recognition (Chrome sends it to Google). We receive only the resulting text, and we never store audio.

#How we use it, and our lawful basis

Under UK and EU data protection law we need a lawful basis for each use. Ours are:

We do not use your content to train AI models, and we ask the model providers we use not to: our requests go out with data collection switched off, and are routed only to providers that agree not to retain or train on them [[TO FILL: confirm with the LLM supplier that "data_collection: deny" routing is contractually backed]].

Where we rely on legitimate interests you can object (see your rights). We do not make decisions about you that have legal or similarly significant effects using only automated processing. Your bots make many automated decisions for you inside tasks you set; you stay in control through approvals, budgets and the ability to stop any run.

#Who we share it with

We share personal information only with the service providers that run Tidal AI for us (our subprocessors), and only what each needs. The current list, with what each does and where, is on the Subprocessors page. In short:

• AI models. To answer you, the text of your conversation and the context a bot needs (for example parts of a file or a web page it is working on) is sent to an AI model. We reach models through OpenRouter, an AI model routing service in the United States, which passes the request to the provider hosting the model you or your bot chose (for example Anthropic, OpenAI, Google, Meta, Mistral, xAI, DeepSeek and others). These providers process it only to return an answer.
• Hosting and storage. Our application runs on Fly.io; our database is hosted by Neon on Amazon Web Services in London (eu-west-2); stored files are kept in S3-compatible object storage provided by [[TO FILL: Tigris Data, or the storage provider used in production]].
• Email. Email is delivered by Resend (Resend, Inc.) in the United States.
• Sign-in. If you choose Google or GitHub to sign in, they confirm who you are to us.
• Push notifications. If you turn them on, notices go through your browser maker's push service (Google, Mozilla, Apple or Microsoft). A notice carries only a short headline and a link, never what a bot asked or did.
• Services you connect. When you or your bots use a connected service (a database, a mailbox, an API, a website), we send it what the task needs. Those services are chosen by you and are governed by their own terms; they are not our subprocessors.

We may also disclose information when the law requires it, to protect people's safety, or as part of a sale or reorganisation of our business (with notice to you). We do not sell personal information, and we do not share it for cross-context behavioural advertising.

#International transfers

Some of our providers are in the United States or elsewhere outside the UK and EEA, including OpenRouter and the model providers it routes to, Resend, and parts of Fly.io. When personal information leaves the UK or EEA we protect it with:

• the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. framework, where the recipient is certified [[TO FILL: confirm each US subprocessor's DPF certification]];
• otherwise the European Commission's Standard Contractual Clauses (2021/914) and, for UK transfers, the UK International Data Transfer Addendum (or the UK International Data Transfer Agreement), with a transfer risk assessment [[TO FILL: confirm the SCC/IDTA modules in each subprocessor DPA]].

Some AI models are hosted by providers in other countries. [[TO FILL: business decision: restrict model routing to providers in the UK, EEA, US-DPF or adequate countries, or list the further countries here]]. You can ask us for a copy of the safeguards that apply.

#How long we keep it

We keep information only as long as we need it. Most of it stays while your account exists and is deleted when you delete your account. Some records are deleted sooner, automatically, by a retention job that runs every hour:

Backups: our database provider keeps point-in-time recovery data for [[TO FILL: Neon PITR window, e.g. 7 days]], so deleted information can remain in backups for that long before it is gone for good. Logs kept by our hosting provider are kept for [[TO FILL: Fly.io log retention]].

#Your rights under UK and EU law

You have the right to:

• Access: get a copy of the personal information we hold about you. You can download it yourself at any time from Legal & privacy (a ZIP of JSON files with a manifest).
• Portability: receive it in a machine-readable format (that same download).
• Rectification: have inaccurate information corrected. You can change most of it in the app.
• Erasure: have your information deleted. You can delete your account from Legal & privacy. We wait 14 days in case you change your mind, then delete everything: database records, stored files, running machines and deployed apps, and sessions.
• Restriction: ask us to limit how we use your information while a concern is resolved.
• Object: object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent: where we rely on consent (push notifications), withdraw it at any time; this doesn't affect what we did before.
• Not be subject to solely automated decisions with legal or similarly significant effects (we don't make any).

To use a right we don't offer in the app, email [[TO FILL: privacy contact email]]. We may need to confirm it is you. We reply within one month (extendable by two months for complex requests, in which case we tell you why). There is no fee unless a request is clearly unfounded or excessive.

Deleting your account does not delete content you created in an organization you don't own: it belongs to that organization. It stays there without being linked to you.

#Complaints

You can complain to a data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk, 0303 123 1113). In the EU you can complain to the authority where you live or work; our lead supervisory authority is [[TO FILL: lead EU supervisory authority, if we have an EU establishment]]. We'd appreciate the chance to sort it out first: [[TO FILL: privacy contact email]].

#California residents

This section applies if you live in California and adds to the rest of this policy (California Consumer Privacy Act, as amended by the California Privacy Rights Act, "CCPA").

What we collected in the last 12 months, using the CCPA's categories: identifiers (email, name, IP address, account ids); internet or network activity (sign-in sessions, request and audit logs); commercial information (credits granted and used); the content of communications you or your bots create (chats, files, email handled by bot mailboxes); inferences we do not make; and no sensitive personal information other than account log-in credentials, which we use only to provide and secure the service. Sources, purposes and recipients are described above; we keep each category for the periods in How long we keep it.

We do not sell or share personal information (as "sell" and "share" are defined in the CCPA), and have not done so in the last 12 months. We have no actual knowledge of selling or sharing information of anyone under 16; Tidal AI is for adults only. You can still record a "Do Not Sell or Share" request, and we honour Global Privacy Control signals as such a request.

Your rights: to know what we collect and how we use and disclose it; to access a copy; to delete; to correct; to opt out of sale or sharing; and to limit the use of sensitive personal information (we use it only as the CCPA permits, so there is nothing further to limit). You can use these rights in the app (Legal & privacy), by email at [[TO FILL: privacy contact email]] or by [[TO FILL: toll-free number or other second method, if required]]. We verify requests by confirming control of the email address on the account, and respond within 45 days (extendable once by 45 days with notice).

Authorized agents may make a request for you. We will ask for your signed permission (or a power of attorney) and may ask you to confirm your identity with us directly.

Non-discrimination: we will not deny you service, charge a different price or give a different quality of service because you used your rights.

[[TO FILL: if required, metrics on CCPA requests received in the previous calendar year]]

#Other US states

Residents of other US states with privacy laws (for example Colorado, Connecticut, Virginia, Utah, Texas, Oregon) have similar rights to access, correct, delete and port their data, and to opt out of sale, targeted advertising and profiling. We don't sell data, do targeted advertising or profile people in ways that produce legal or similar effects. To make a request, use the in-app tools or email [[TO FILL: privacy contact email]]; if we decline, you can appeal by replying to our answer, and then contact your state Attorney General.

#Security

We protect information with encryption in transit (TLS) and at rest, encrypted storage of the credentials of services you connect (AES-256-GCM, with keys kept out of AI models' reach), isolated machines for code your bots run, strict sign-in (email links, no passwords), role-based access inside organizations, an audit log, security headers, rate limits and abuse monitoring. No system is perfectly secure; if a breach affects you, we will tell you and the regulator as the law requires.

#Children

Tidal AI is only for people 18 and over. We ask everyone to confirm their age when they first sign in. If you believe someone under 18 has an account, contact [[TO FILL: privacy contact email]] and we will delete it.

#Cookies

We use only strictly necessary cookies. See our Cookie Notice.

#Changes to this policy

When we change this policy we update the version at the top. If a change is significant, we tell you in the app or by email before it takes effect.