This policy explains what personal information Tamaat Inc. collects when you use Tamaat, why, who receives it, where it is kept, how long we keep it, and the choices and rights you have. If something is unclear, write to us at privacy@tamaat.com.
1. Who we are and who is responsible
Tamaat is provided by Tamaat Inc., a corporation incorporated under the Canada Business Corporations Act, with its registered office in Calgary, Alberta, Canada.
Our Privacy Officer is the person in charge of the protection of personal information at Tamaat and is accountable for our compliance with this policy and with privacy law. You can reach our Privacy Officer at privacy@tamaat.com.
2. What this policy covers
This policy covers personal information we handle about people who visit our websites, create an account, are invited to an organization or to view a map, or write to us.
It does not cover the content of the maps and datasets that our customers bring into Tamaat. A customer decides what data goes into its organization and who may see it, and is responsible for it. We process that content on the customer's behalf, only to provide the Service. If your personal information is in a customer's data, please contact that customer; we will help them respond. The Data Processing Addendum sets out how we handle that content.
Our websites and the Service may link to other websites and services that we do not run. This policy does not cover them; each has its own.
3. What we collect
- Account
- What it isYour name, email address, an optional public handle, your password, your language and display preferences, and whether you accepted these documents.
- Where it comes fromYou
- Organization and membership
- What it isThe organizations you belong to, your role in each, invitations sent to or by you (including the email address invited), and what has been shared with you.
- Where it comes fromYou and the people who invite you
- Sign-in and security
- What it isFor each session: IP address, browser type, and times of sign-in and last use. A record of security events such as sign-ins and password changes. If you turn on multi-factor authentication, what is needed to verify it.
- Where it comes fromYour device
- Billing
- What it isYour plan, seats, subscription status and the identifiers Paddle gives us for your customer and subscription records. Paddle, not Tamaat, holds your payment card details.
- Where it comes fromYou and Paddle
- Usage
- What it isCounts of the work your organization does that is measured against your plan, such as processing time, storage, API requests and views of published maps.
- Where it comes fromThe Service
- Activity records
- What it isA record of administrative actions in your organization, such as inviting or removing a member, sharing a map or publishing.
- Where it comes fromThe Service
- Assistant
- What it isThe conversations you have with the AI assistant: your questions and its answers.
- Where it comes fromYou and the model provider that answers
- Messages to us
- What it isWhat you send through our contact form or by email, including attachments.
- Where it comes fromYou
- Error reports
- What it isWhen the application fails in your browser: the page, the error, and your browser type, linked to your account so that we can fix it.
- Where it comes fromYour browser
We do not ask for, and ask you not to give us, sensitive personal information such as health information, government identifiers or financial account numbers. We do not collect your device's precise location. A map you make may contain locations; that is your content.
4. Why we use it
We use personal information only for these purposes:
- to create and run your account and provide the Service you asked for;
- to let the people in an organization work together, and to show the people you share with what you shared;
- to keep accounts and the Service secure, detect misuse and investigate incidents;
- to bill for paid plans and apply plan limits;
- to send you messages about your account and the Service: verification codes, security notices, invitations, billing notices and notices about your data;
- to answer you when you write to us and to fix problems;
- to meet our legal obligations, such as tax and accounting rules.
By creating an account you consent to this use. We do not use your personal information for advertising, and we do not build profiles of you. We do not make decisions about you by automated processing alone.
We do not send marketing email today. If we begin to, we will ask for your consent first, and every such message will let you unsubscribe.
Every notice and invitation we send by email has a link to stop that kind of email. If you use it, we keep your email address only so that we do not write to it again. This applies even if you have no account, for example when someone invited you. The same link turns the emails back on. Messages needed to run your account, such as verification codes and security notices, cannot be stopped.
5. The AI assistant
The assistant uses models operated by Anthropic, OpenAI or Google. When you use it with Tamaat credits, a model operated by Typesafe first reads your question to choose which of them answers. When you use it, your request, the conversation, and the data needed to answer (for example a layer's column names, or the rows a query returns) are sent to the provider that runs the model, which may process them in the United States.
You can use the models through us, or connect your own account with a provider. If you connect your own, the key you give us is stored encrypted, and that provider's agreement with you governs what it does with what is sent.
We do not use your conversations or your content to train models, and we send them to model providers only to produce your answer. You do not have to use the assistant.
6. Cookies and similar technologies
We use cookies only to keep you signed in and to keep your session secure.
- Sign-in cookies
- PurposeKeep you signed in while you work, so that you do not have to sign in on every page.
- LifetimeUp to 30 days
- Viewing cookie
- PurposeLets you open a shared map or dashboard after you have signed in to view it.
- Lifetime1 hour
Your browser also stores a few preferences on your device, such as your language, your theme and the layout of your workspace. You can clear cookies in your browser at any time. You will then be asked to sign in again.
When you pay, the checkout is run by our payment provider, which sets its own cookies on that page to process the payment and prevent fraud. The first time you visit, a notice at the bottom of the page tells you which cookies we use; that you have seen it is remembered on your device, not in a cookie.
7. Who receives personal information
We do not sell personal information, and we do not share it for advertising. We give it only to:
- Amazon Web Services
- What forHosting of the application, databases and files; sending our email.
- WhereCanada (Montreal). Content is delivered to you through a global network of edge locations.
- Google Cloud
- What forHosting of a second deployment of the Service.
- WhereCanada (Toronto). Content is delivered to you through a global network of edge locations.
- Paddle
- What forSelling paid plans as merchant of record: payment, invoices and sales tax.
- WhereUnited Kingdom, United States and other countries where Paddle operates
- Anthropic, OpenAI, Google, Typesafe
- What forRunning the AI models, only when you use the assistant.
- WhereUnited States
Other people in your organization can see your name, email address and role, and what you created or changed there. People you share a map with can see that you shared it.
Services you connect with your own key, such as basemaps or geocoding, receive the requests you make through them, under your own agreement with them. Open data services we call for elevation, terrain or satellite imagery receive the area requested, not who you are.
We may disclose personal information where the law requires it, for example in response to a court order, or to protect the rights and safety of our customers, the public or Tamaat. Our Law Enforcement Requests page explains how we handle requests from authorities. If Tamaat is involved in a merger or a sale of its business, personal information may be transferred to the successor, which must continue to honour this policy.
8. Where your information is kept
Our application, databases and file storage are located in Canada, in data centres in Montreal and Toronto.
Some of the recipients listed in Section 7 are outside Canada or outside your province, in particular Paddle and the AI model providers. When personal information is in another country it is subject to that country's laws and may be available to its courts, law enforcement and national security authorities. We use those recipients under agreements that require them to protect the information and to use it only to provide their service to us. You may ask us about our policies and practices for service providers outside Canada by writing to the address in Section 1.
9. How long we keep it
We keep personal information only as long as needed for the purposes above, then delete or anonymize it.
- Your account
- Kept forUntil you delete it. See "Deleting your account" below.
- Sign-in sessions and security events
- Kept forWhile your account exists. They are erased with it.
- An organization's content after a paid subscription ends
- Kept for30 days, then permanently deleted.
- Content of a free organization that is not used
- Kept forDeleted after 90 days without use and a further 30 days' notice.
- Items in the trash
- Kept for14 days, then permanently deleted.
- An organization scheduled for removal
- Kept for30 days, then permanently deleted.
- Application and error logs
- Kept for30 days.
- Security logs
- Kept for12 months.
- Database backups
- Kept for14 days, then they expire.
- Billing and tax records
- Kept forAs long as tax and accounting law requires, generally six years.
- Messages you send us
- Kept forAs long as needed to answer you and to keep a record of the request.
- Email addresses that asked us to stop notices or invitations
- Kept forFor as long as the emails stay stopped.
- Limited information kept after an account is erased
- Kept forAs long as needed to prevent misuse of our services, resolve disputes, enforce our agreements and meet our legal obligations.
Deleting your account. You can delete your account yourself, at any time, from your account settings. The account is closed immediately: you are signed out everywhere and your API tokens stop working. We keep the account and the content of your organization for 30 days so that you can restore them by signing in; this protects you against an accidental or unauthorized deletion. After 30 days we permanently erase the account's identifying information (name, email address, password, sign-in factors, sessions, sign-in history, notifications and assistant conversations) and your organization with its content.
Content you created inside another customer's organization belongs to that organization and stays with it, no longer attributed to you by name. Erased data may remain in encrypted backups for up to 14 further days, after which those backups expire.
After an account is erased we may keep limited information for as long as needed to prevent misuse of our services, resolve disputes, enforce our agreements and meet our legal obligations.
10. How we protect it
We protect personal information with safeguards appropriate to its sensitivity, including: encryption of data in transit and at rest; protection of passwords; optional multi-factor authentication; sessions that end after a period without use; separation of each customer's data by organization; access by our staff limited to what a task requires; and monitoring of our systems.
No system is perfectly secure. If a breach of our safeguards creates a real risk of significant harm to you, we will notify you and the relevant privacy regulators as the law requires, and we keep a record of every such incident.
11. Your rights and choices
Subject to the law that applies to you, you may:
- ask whether we hold personal information about you and obtain a copy of it;
- have inaccurate or incomplete information corrected. You can change most of it yourself in your account settings;
- withdraw your consent to our use of your information, subject to legal and contractual limits. Withdrawing may mean we can no longer provide the Service to you;
- have your information deleted, by deleting your account or by asking us;
- receive the personal information you gave us in a structured, commonly used format, or have it sent to another organization;
- ask us to stop disseminating your personal information, or to de-index a link attached to your name, where the law provides for it;
- ask how your information has been used and to whom it has been disclosed.
To exercise a right, write to us at the address in Section 1. We will ask for what we need to confirm your identity, and we will answer within 30 days. There is no charge. We will not treat you differently for exercising a right.
If you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada, or to the privacy regulator of your province, such as the Commission d'accès à l'information du Québec, the Office of the Information and Privacy Commissioner of Alberta, or the Office of the Information and Privacy Commissioner for British Columbia.
12. Children
Tamaat is for adults. It is not directed to children, an account requires that you be at least 18, and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, tell us and we will delete it.
13. Additional information for residents of the United States
This section applies if you live in a state with a comprehensive privacy law, such as California, Colorado, Connecticut, Oregon, Texas, Utah or Virginia. Tamaat may not meet the thresholds at which those laws apply to a business, but we extend the following to you in any case.
- The categories of personal information we collect, their sources, our purposes and the recipients are those set out in Sections 3, 4 and 7. In the terms of California law, they are identifiers, commercial information, internet or network activity, and the content of your communications with us.
- We do not sell personal information and we do not share it for cross-context behavioural advertising. We have not done so in the past 12 months.
- We do not use or disclose sensitive personal information for any purpose that would give you a right to limit its use.
- You have the right to know, to access, to correct, to delete, and to obtain a portable copy of your personal information, and the right not to be discriminated against for exercising these rights.
- You may make a request yourself or through an authorized agent, by email to privacy@tamaat.com or through your account settings. If we decline a request, you may appeal by replying to our decision, and we will respond within the time your state's law requires.
- Some browsers send a "Do Not Track" signal. There is no common standard for what it means, and we do not respond to it. We do not track you across other sites in any case: our cookies only keep you signed in.
14. Additional information for people in the European Economic Area and the United Kingdom
Tamaat is operated from Canada and is offered primarily to customers in Canada and the United States. If you use it from the European Economic Area, the United Kingdom or Switzerland, Tamaat Inc. is the controller of the personal information described in this policy.
We rely on the following legal bases: performance of our contract with you, for running your account and the Service; our legitimate interests in keeping the Service secure and improving it, which we balance against your rights; and compliance with legal obligations, for billing and tax records. Canada is recognized by the European Commission as providing adequate protection for personal information handled by commercial organizations. You have the rights set out in Section 11, and the right to object to processing based on legitimate interests and to complain to your local data protection authority.
15. Changes to this policy
We will update this policy when our practices or the law change. The date at the top shows the latest version. If a change is material, we will tell you by email or in the Service before it takes effect.
16. Contact
Privacy questions and requests: privacy@tamaat.com. Privacy Officer, Tamaat Inc., 687 Arbour Lake Dr NW, Calgary, AB T3G 4T6, Canada.