How we handle the data that concerns you.

1In short

The essentials, before the details:

• In the bot we identify you by your numeric Telegram ID and your username; if you have no username, by the name you set on Telegram. We neither ask for nor read your last name, phone number, email or profile photo from Telegram
• Your content stays inside your organization: no data selling, no advertising, no commercial profiling
• The AI assistants only see the organization they work in, and the model provider does not train its systems on your data
• When something is "anonymous", we tell you exactly what that means — before you send, not after (see 5.6 and 5.7)
• Database on servers in the European Union, encrypted backups, verifiable PDF exports
• Many deletions you can do yourself from the bot; for everything else, one email is enough (section 13)

2What this notice covers

This notice covers two things:

• The Tavora bot on Telegram — the platform where you create an organization, connect your groups and use proposals, votes, tasks, shifts, events, forms, the Library, the Service desk, your personal space and the AI assistants
• The tavora.net website — the landing pages, the guides and the support form (section 15)

Tavora runs inside Telegram, but it is not Telegram: it is an independent project, not affiliated with Telegram. Whatever you send through Telegram is also processed by Telegram under its own privacy policy.

Reading this page does not commit you to anything: it is a notice, not a contract. The legal bases we rely on are listed in section 7.

3Data controller

Tavora is an independent project in beta, developed and run by its developer, who acts as the data controller within the meaning of Art. 4(7) GDPR. There is no company yet: for any question about your data, the point of contact is this address:

• tavorasystems@gmail.com

No Data Protection Officer (DPO) has been appointed: for the nature and scale of this processing, Art. 37 GDPR does not require one. We answer data requests within the deadlines of Art. 12 GDPR (as a rule, within one month).

4Tavora and the organizations: who is responsible for what

Tavora is a platform: the organizations running on it are created and managed by other people. To understand who answers for what, the distinction is this:

• Tavora is the controller for the processing needed to run the platform: accounts, infrastructure, security, backups, anti-abuse limits, the technical operation of the AI assistants
• The managers of each organization (founder, admins, staff) decide how to use the tools on their own members: whom to admit, which roles and permissions to grant, what to write in a member's record (notes, warnings, recognitions, labels), which rules to give the AIs. For those choices they act as independent data controllers of their organization, and Tavora processes the data on their behalf as the platform provider

What this means for you as a member: for content that your organization's staff writes about you, your first point of contact is the organization's managers. You can always write to us too (section 17): we will help you exercise your rights in any case.

Managers are required to use Tavora's tools in compliance with data-protection law. If you believe an organization is abusing them, report it to us.

5Data we process

5.1 Telegram data

When you interact with the bot, Telegram automatically provides us with:

• Telegram User ID — your unique numeric identifier
• Telegram username — your public username (it updates by itself if you change it)
• Language code — used to offer you the interface in your language (changeable in the settings)
• Date and time of your first and last interaction
• Telegram name (never the last name) — we receive it when you interact with the bot: in private, by writing in a connected group, by joining a connected group or by tapping the card of a Meeting or a List in any chat. We show it only if you have no username: to name you as the author of proposals, votes, comments and named responses, in the organization's lists (members, roles, staff, join requests, banned, departments) and to show who tapped a List or a Meeting in a chat. It is deleted together with your account data

On top of these come the preferences you set yourself: time zone (for reminders), per-organization notification settings. If you block the bot on Telegram, we record the event so we stop contacting you; the flag clears by itself if you come back.

5.2 Organizations and membership

• Role in each organization (member, admin, founder) and custom permissions
• Departments and duties you belong to, and their managers
• Join requests, invites and their approvals
• Organization-level bans — with User ID, ban author and date
• Ownership transfer requests for an organization (the two User IDs involved and the status)
• Presence in connected Telegram groups — group ID, group name, and who is present there (ID and username only), to verify membership
• Organization language ("🌐 Organization language"): the language of messages in the groups and of the private messages members receive from the organization (an organization setting, not a personal one: your menus stay in your own language)

5.3 Content you create

• Proposals and agenda items: title, text, type, attachments, comments
• Votes: your vote linked to your User ID (who can see it: section 8)
• Tasks: title, description, checklists, assignments, notes (public or private), reminders, change history
• Shifts: slots, assignments, swap requests
• Events and calendar: events, sign-ups/RSVPs, reminders
• Forms: your answers (for anonymity: 5.7)
• Library: uploaded materials (documents, chapters, pages) and who uploaded them
• Service desk: proposals, requests and reports sent to the managers (for anonymity: 5.6)

To preserve the formatting you enter (bold, italic, links, animated Telegram Premium emoji) we also keep a "rich" HTML version of the content. Premium emoji are stored as a numeric identifier, not as an image. Attachments (photos, videos, documents) are not stored on our servers: we only keep the reference (file_id) provided by Telegram — the files stay on Telegram's servers. The only exception: for PDFs and text files uploaded to the Library or to the AI Instructions with the AI turned on, we also keep the full text (split into parts for search), so the AI can use it to answer (section 6). The same applies if the AI is turned on later for a document already uploaded. The text stays as long as the document exists, even if the AI is later turned off.

5.4 Member record — data the staff enters about you

Your organization's staff can keep a record on each member. It may contain:

• Internal staff notes (not visible to you or to other members)
• Warnings and sanctions, with author and date
• Recognitions, assigned labels and custom profile fields: free-text information written by the staff (for example a staff number, a team, an internal phone number). The staff decides field by field whether you can see it; a new field is visible to the staff only
• History: joins/leaves, groups you have been seen in, activity statistics (proposals, tasks, events)
• Activity log of staff actions on your profile: who did what and when. When a note, a sanction or a field is deleted (one at a time or with "🧹 Clear dossier", even if it was given through an AI), its text does not stay in the log

This content is decided and written by the organization's managers, who answer for it as independent controllers (section 4). The staff can clean up the record with "🧹 Clear dossier", including the record of someone who is no longer a member ("👥 Members" → "🧰 Tools" → "👤 Former members"): for a former member the cleanup also deletes custom fields and revokes pending invites, while recognitions stay. Deleting your account erases the whole record (section 13).

5.5 Personal space

Outside the organizations you have a space of your own: agenda (including the place of an event, if you send a location), to-dos, habits with their journal, deadlines (with a photo of the document if you add one: it stays on Telegram like other attachments), notes, reminders (recurring too), personal forms, Meetings and Lists in a chat. This data is visible only to you: it appears in no organization, ends up in no Library, and no manager can see it. The only exception is what you share yourself: the card of a Meeting or a List sent to a chat is seen by the people in that chat, and a note or a form shared by link opens for anyone who has the link. Whoever taps one of those cards, even without using Tavora, sends us their User ID and their username (or their name, if they have no username): we store them to write them on the card and make the Meeting or the List work. If a habit involves sensitive data (smoking, alcohol, drugs, gambling), we save it only because you expressly ask for it: in the habits panel the bot first shows you a notice and waits for your yes, and the personal assistant creates it only when you ask for it in your own words; you can delete it whenever you like. Your personal AI assistant accesses it only when you ask it to (section 6.4).

5.6 Service desk and anonymity — told honestly

From the Service desk a member can send the managers a report anonymously. Here is exactly what that means:

• To the managers it is truly anonymous: they see no name, username or ID — not even by searching. In the CSV export the sender column is empty
• To the system it is not: the database still records who sent the report. This prevents abuse and lets you follow your own case
• The bot tells you this clearly at the moment of sending, before you choose

The identity of the sender of an anonymous report is never revealed to the managers in any screen of the bot. It could be disclosed only if a legal obligation required us to (section 7).

5.7 Forms and anonymity

Whoever creates a form chooses whether it is named or anonymous, and the choice can no longer be changed after publication. In an anonymous form:

• While you fill it in, the system keeps a temporary link between you and the draft (so you can resume filling it in); on submission that link is deleted: the submitted answers can no longer be traced back to you in the database
• It remains recorded that you answered (to prevent duplicate responses), but not what you answered
• That is why an anonymous form does not allow editing your answers after submission

5.8 Donations (Telegram Stars)

If you support the project with a donation in Telegram Stars we record: User ID and username, the amount, the transaction ID (charge_id, useful for refunds), date and time, and your Telegram first name, used here exclusively to thank you publicly if you accept, or for the donor badge. We neither receive nor store any payment details (cards, accounts): the transaction happens entirely inside Telegram.

5.9 Technical data

• Audit trail: for tasks and management actions we record who did what and when
• Temporary wizard sessions (proposal/task creation…): deleted automatically after 48 hours of inactivity
• Attachments of bug reports/feedback sent from the bot: kept as Telegram references and deleted after about 30 days
• Verification of exported PDFs: every exported PDF carries a verification code, and when it is generated we store the fingerprint (SHA-256) of the whole file, with no additional personal data. Whoever receives the PDF can send it to the bot in a private chat to find out whether it is authentic or has been modified
• Technical logs: the bot's logs contain no tokens and no sensitive content
• Internal product statistics (beta phase): aggregated activation events (e.g. creating your first organization) and usage counters for some screens, tied to User ID and timestamp. They stay internal, feed no profiling or advertising, and will be removed or anonymized at the end of the beta. You can request early deletion

5.10 Data we do NOT collect

The bot does not ask for or collect on its own initiative:

• Last name, email, phone number: we neither ask for them nor read them from Telegram. If you write them in some content yourself, or the staff records them in a field of your profile (5.4), we keep them like any other content
• Profile photos or biographical data
• Location or GPS data: we never detect them. If you send a location yourself as the place of an event in your agenda, we keep its coordinates together with the event
• Private messages outside the conversation with the bot
• Data from other apps or services, browsing history, cookies, device data
• Payment details (cards, accounts, IBAN)

6AI assistants

Tavora includes several AI assistants. The same ground rules apply to all of them: answers are generated by the Claude model from Anthropic (section 10), the data sent to the provider is not used to train its models, each assistant sees only the organization (or the personal space) it works in, and they act only when someone asks them to. The only exception is the Member Management AI's periodic instructions, which run by themselves on the days and at the time chosen by the staff (6.2).

6.1 Tavora AI (for members)

It answers questions based on the Library materials marked "AI = Yes" by the staff and on Tavora's base knowledge. We keep:

• Conversation memory in private chat: each exchange deletes itself 30 days after it was written, even if you keep using the assistant, or earlier if you delete it; in groups (/ask) the memory is separate, per user, and each exchange expires after 7 days
• Automatic summary of older turns when the conversation gets long (the 10 most recent turns stay intact)
• Synthetic profile of your interaction style (max 300 characters), updated once a week if you used the assistant often in the past week, only to calibrate the tone
• Usage counters to enforce the limits (they contain no question text)
• Answer cache for public questions to the global Tavora AI, to answer similar questions instantly

What is sent to the AI provider: the question, the previous turns of the conversation, the relevant Library excerpts and the staff's AI Instructions. Your User ID and username are not sent: to the provider, Tavora AI users are not identifiable.

6.2 Member Management AI (for the staff)

An assistant reserved for founders and admins. When the staff uses it, the member data needed for the request is processed — and partly sent to the AI provider: usernames, roles, labels, custom fields, activity statistics, sanctions, limited to that one organization. The staff's conversation memory lasts at most 32 exchanges / 14 days, isolated per organization and per admin. On a clear request about a single person it acts at once; on several people, and for private messages and announcements, it first asks for written confirmation. At most 20 recipients per action, and every action lands in the management history. Periodic instructions saved by the staff apply on their own only labels, roles, private messages foreseen by the rule, unbans, group invites and internal notes: expulsions, bans, warnings, recognitions and profile fields remain suggestions that the staff confirms.

6.3 Task AI, Shifts AI and Forms AI (for managers)

Same principles as 6.2, applied to tasks, shifts and forms: they read the boards, workloads, rosters and forms of only the area the manager has permissions on. The Task AI asks for written confirmation for actions on several tasks or several people and for every deletion. Before publishing, closing, reopening or deleting a form (or a question that already has responses), deleting a shift with people in it or removing a person from a shift, the Forms AI and the Shifts AI ask for confirmation in the conversation: the action runs only after the user's "yes" in a later message, checked by the bot and not by the AI. The AI provider receives the task, shift and form data relevant to the request (titles, assignees, deadlines, questions, responses to grade), never the whole database.

6.4 Personal assistant (personal space)

It works only on your personal data: to-dos, habits, agenda, notes, reminders, deadlines, Meetings, Lists in a chat and personal forms. It has a memory separate from everything else and does not talk to the organizations' AIs.

6.5 Automatic moderation of AI Instructions

When the staff saves an AI Instruction (a behavior rule for the assistant), its text is sent to the provider for an automatic safety check. If it violates the usage rules (insults, prompt injection, illegal activities) it is marked as "ignored" and the AI does not apply it. Only the instruction text is sent, no other data.

Embeddings (the numeric representation of texts used for search in the Library and in the cache) are computed locally on our server with an open-source model: for this operation no data leaves our infrastructure.

7Legal bases and purposes

We do not process data "because you use the bot and therefore agree": every processing activity has a legal basis under Art. 6 GDPR.

• Performance of the service you request (Art. 6(1)(b)) — everything Tavora does: organizations, proposals, votes, tasks, shifts, events, forms, Library, Service desk, personal space, AI assistants, notifications and reminders
• Legitimate interest (Art. 6(1)(f)) — security and abuse prevention (rate limits, bans, audit trail), backups and service continuity, aggregated internal statistics to improve the product, defense of our rights. You can object to these activities (section 13)
• Consent (Art. 6(1)(a)) — the public thank-you for donors and the support form on the website; explicit consent (Art. 9(2)(a)) to save a personal-space habit that involves sensitive data (smoking, alcohol, drugs, gambling). Revocable at any time: for a habit, just delete it
• Legal obligation (Art. 6(1)(c)) — responding to legitimate requests from the authorities, where applicable

No fully automated decision produces legal or similarly significant effects on you (Art. 22 GDPR): the AI assistants propose, people decide. Expulsions and bans are never executed automatically by an AI.

Your data is not used for commercial or advertising profiling, is not sold, and feeds no marketing of any kind.

8Who sees your data

Other members of your organization see

• Your username (or, if you have none, your Telegram name) as the author of proposals and in comments published in the groups
• Your assignments on tasks and shifts, and public notes
• Your event sign-ups, where the attendee list is visible
• Who the organization's founder and admins are (visible to every member)
• The member list (name or username only, never the Telegram ID), if the founder makes it visible to everyone; otherwise only the staff and those with member permissions see it

Only the managers see

• Individual votes (e.g. via /votes), where the organization allows it
• The member record (internal notes, warnings, recognitions, labels, history — section 5.4)
• The Service desk cases — with the sender visible only if not anonymous (5.6)
• The respondents of named forms (never the answer↔person link in anonymous ones, 5.7)

Nobody sees

• Your private conversations with the bot and the AI assistants
• Your personal space (agenda, to-dos, habits, deadlines, notes, reminders), except what you share yourself (5.5)
• Proposals you have hidden from your own view

Beyond this, technical access to the database is limited to the developer (section 12). No data is shared with third parties other than the providers listed in section 10.

9Retention

General rule: we keep data for as long as you use Tavora and the organization it belongs to exists. In detail:

• Deleting an organization: members leave immediately; for 10 days the founder can restore it from "My organizations" (content and settings come back, members rejoin with a new invite link), then the data (proposals, votes, tasks…) is deleted permanently and automatically
• Deleting your personal space ("🗑 Delete my space"): for 10 days you can restore it, as long as you don't create a new one in the meantime; then it is deleted permanently
• Wizard sessions: 48 hours of inactivity
• Bug report and feedback attachments: ~30 days
• AI memories: Tavora AI: each exchange 30 days after it was written (7 in groups), management AIs 14 days — on top of the manual resets (section 13)
• Synthetic AI profile: replaced at each weekly update; deleted with the memory reset, with the account, or on its own when no private exchange is left in memory
• AI answer cache: invalidates itself when the underlying materials change
• Pending proposals: finalized automatically after 7 days
• Bans: an organization ban keeps only the User ID (with author and date) for as long as it is active; a global Tavora ban also keeps the username for as long as it is in force. After a deletion request only the ID remains, for as long as the ban is active
• Blocking the bot: the data remains but we no longer contact you; you can request its deletion
• Beta statistics: removed or anonymized at the end of the beta
• Backups: encrypted copies, made every night and kept on our server for at most 14 days, then removed by rotation; the encrypted copies from the last 5 nights are also stored on Google Drive (section 10). Deleted data may therefore survive in a backup for up to 14 days

10External providers

Tavora relies on a small number of providers, each for one precise job. There are no third-party analytics services, pixels, advertising SDKs or data brokers.

For the bot

• Telegram — the platform the bot lives on: messages, files and interactions pass through its servers under its own privacy policy. Telegram is an independent controller of its own processing
• Anthropic (USA) — the provider of the Claude model behind the AI assistants. It receives only the data described in section 6, does not use it for training (it keeps it for a limited period for safety purposes, then deletes it) and processes it under its privacy policy and its Data Processing Addendum
• Hosting — the bot and the PostgreSQL database run on a virtual private server in the European Union, managed by us. The bot's data resides only on this server; the one exception is the encrypted backup copies stored on Google Drive (next item)
• Google Drive (Google) — stores a copy of the encrypted backups from the last 5 nights. Each backup is encrypted on our server as soon as it is made, with a public key (OpenPGP, AES-256), and the unencrypted version is deleted: only encrypted files reach Google Drive, and Google cannot read them because it does not have the key. The private key needed to restore them is kept by Tavora outside the server and outside Google. Older copies are deleted from Drive automatically and permanently (they do not go to the trash)

For the website

• Vercel — hosting of tavora.net and the support form
• Resend — delivery of the support form emails
• Cloudflare Turnstile — anti-bot verification of the form, with no persistent cookies and no cross-site tracking

11Transfers outside the EU

The bot's database resides in the European Union. Some providers, however, operate from the United States:

• Anthropic — for the requests to the AI assistants (section 6)
• Vercel, Resend and Cloudflare — for the website and the support form (section 15)
• Google — for the encrypted backup copies on Google Drive, which may also be stored outside the EU (section 10)

These transfers rely on the safeguards of Chapter V GDPR: certification under the EU-US Data Privacy Framework and/or Standard Contractual Clauses (SCCs), depending on the provider. Telegram processes data under its own policy, as an independent controller.

12Security

Main measures in place:

• Encryption in transit — communications with Telegram and between bot and database travel over encrypted channels
• Encrypted backups — with AES-256 and a public key (OpenPGP): the server can encrypt the backups but cannot open them; the key to restore them is neither on the server nor with Google
• Verifiable PDFs — every exported PDF has a verification code: sending it to the bot in a private chat tells you whether it is authentic or has been modified (a single changed byte is enough)
• Limited access — only the developer has direct access to the database
• Parameterized queries — protection against SQL injection
• Input validation and length limits on everything you enter
• Anti-abuse rate limiting on creations and interactions
• Sober logging — no tokens and no sensitive content in the logs

No system is 100% secure. Should a breach occur that puts your rights at risk, we will notify the authority and — in the cases set out by Art. 34 GDPR — you as well.

13Your rights

The GDPR grants you these rights (Arts. 15–21), all free of charge:

• Access — knowing what data we hold about you and getting a copy
• Rectification — correcting inaccurate data (your username updates by itself from Telegram)
• Erasure — the complete deletion of your account: you request it by email and we carry it out (details below)
• Restriction — asking us to "freeze" a processing activity while we check a dispute you raised
• Portability — receiving your data in a structured, commonly used format; from the bot you can download on your own the PDF of your personal-space to-dos and the ZIP of your proposals; for a complete copy of all your data, write to us
• Objection — objecting to the processing based on legitimate interest (section 7)
• Withdrawal of consent — at any time, without affecting what happened before

Complaint to the authority: you always have the right to turn to the Italian Data Protection Authority (Garante) (Art. 77 GDPR) or to the supervisory authority of your country, without having to notify us first.

What you can do yourself, right now, from the bot

• AI memory reset — the "🧹 Reset memory" button immediately deletes conversation turns, synthetic profile and summaries (the operation is irreversible and asks for confirmation)
• Leave an organization at any time
• Delete agenda events, notes, to-dos, reminders, deadlines and habits in your personal space
• Delete your whole personal space with "🗑 Delete my space": for 10 days you can still restore it, then it is deleted permanently (section 9)
• Hide proposals from your own view
• Block the bot to stop all communication

What deleting your account entails

• Deleted: account, memberships, roles, member records about you (profile fields and recognitions included), join and transfer requests, event answers, shift places, the record that you answered forms, AI memories and periodic instructions, beta statistics; the personal space is deleted immediately. Your name is also removed from other people's Meetings and Lists, including the titles those Meetings put in their agendas
• Kept: active bans, with the User ID only, to prevent rejoining
• Deleted: the organizations you founded, with the 10-day window of section 9: during that period Tavora can restore them only by handing them to a new owner
• Anonymized: proposals, votes, comments, tasks and notes you created inside other people's organizations — the content remains (it is the organization's collective heritage), but with no link to you anymore. Aggregated vote counts stay unchanged, the voter's identity is removed. Form answers and Service desk requests also remain without ID or name: the sender shows as "Deleted user"

To exercise the rights that require our intervention, write to tavorasystems@gmail.com stating your Telegram User ID. We reply as a rule within one month (Art. 12 GDPR).

14Minors

Tavora is not intended for children under 16 and we do not knowingly collect their data. If a parent or guardian believes a minor has provided us with personal data, they can write to us for removal (section 17).

15Website and support form

The tavora.net website

The website uses no cookies, has no banner because none is needed, and embeds no trackers, third-party analytics or pixels. The hosting (Vercel) generates technical delivery logs processed under its own privacy policy.

The support form

When you send a report from the form (/support/) we collect what you write: type, title (max 120 characters), description (max 4000), your email (to reply to you), optional attachments (max 3 files; allowed types: images, videos, PDF, TXT), the page language and a hash of the IP (SHA-256 with salt) used only for rate limiting — never the IP in the clear.

Legal basis: your explicit consent (mandatory checkbox) and the performance of your request (replying to you). The emails travel via Resend and land in our inbox; the anti-bot verification is by Cloudflare Turnstile, with no persistent cookies.

• Email retention: the time needed to handle the report, at most 24 months
• Form diagnostic logs: 7 days, with no personal data in the clear
• Withdrawal: you can withdraw your consent at any time by writing to us; the withdrawal does not affect the lawfulness of what already happened

16Changes to this notice

If Tavora changes, this page changes with it. For substantial changes we notify you with a message in the bot; the date of the last update is always at the top of the page. Previous versions are available on request.

17Contact

For questions about this notice or to exercise your rights:

• tavorasystems@gmail.com

State your Telegram User ID in the request: it is the only way we have to identify your data with certainty (we will never ask for your name or documents, except in case of well-founded doubts about the requester's identity under Art. 12(6) GDPR).