Privacy Policy

Tako (“Tako,” “we”) makes business-management software for small businesses. This policy explains what personal information we handle, why, and the choices you have. It covers our website, the Tako app, and the pages Tako businesses share with their clients (proposals, invoices, contracts, booking pages, forms and the client portal).

We handle two kinds of personal information, and our role differs for each:

• Customer information: details about the businesses that use Tako and the people on their teams (name, email, login, billing). For this information, we decide how it’s used.
• Client information: details a Tako business keeps about its own clients and contacts, such as names, emails, phone numbers, addresses, project details, quotes, invoices, payment status, messages and signatures. The business decides how this is used; we process it on the business’s behalf as its service provider, under our Data Processing Addendum.

From Tako customers and their teams

• Account details: name, email address, password (stored hashed by our authentication provider), role.
• Business details: business name, type of business, contact email, logo, brand settings and workspace settings.
• Billing details: plan, billing interval, billing contact and history. Card numbers are entered on Stripe’s pages and stored by Stripe, not by us.
• Stripe account status, when a business connects its own Stripe account to take client payments (whether it can accept payments and receive payouts). Tako does not see the business’s bank details.
• Messages you send us, such as support requests.

Client information Tako businesses put in or receive

• Contact records, leads, inquiries, notes, tags, projects and tasks.
• Quotes, invoices, payments recorded, contracts and finance records the business imports.
• Information a client sends through a business’s inquiry form, booking page, form or portal, and email forwarded into Tako.
• Payments clients make online: the amount, status and Stripe reference for each payment, so the invoice shows as paid. Card and bank details are entered on Stripe’s pages and are not stored by Tako.
• Email opt-outs and delivery problems: addresses that unsubscribed from a business’s marketing email, bounced or marked a message as spam, so Tako stops sending to them.
• E-signature records when a client signs a contract: typed or drawn signature, name, email, IP address, browser details and time of signing.

Collected automatically

• Technical data needed to run and secure the Service: IP address, browser and device type, pages requested, and error logs.
• The cookies and similar storage described in Cookies.

We don’t buy personal information about anyone, and we don’t use third-party advertising trackers.

• To provide the Service: store your records, show them to your team, and send the messages you approve.
• To run trials, subscriptions and billing, and to send account, security and billing emails.
• To keep Tako secure: authenticate users, keep each workspace’s data separate, and prevent abuse.
• To fix bugs, understand which features are used, and improve the Service.
• To answer support requests and privacy requests.
• To follow the law, and to enforce our Terms of Service.

When a Tako business stores information about its clients, the business controls that information. We use it only to provide the Service to that business, following its instructions, as set out in the DPA. We don’t sell it, use it for advertising, or combine it with data from other businesses.

If you are a client of a business that uses Tako, that business’s own privacy notice applies to you. To access, correct or delete your information, please contact the business directly. If you contact us instead, we will pass your request to the business and help it respond.

When an AI feature runs, Tako sends the records needed for that task to our AI provider, Anthropic, through its commercial API. That happens when someone in a workspace asks for a draft (for example, a proposal), and, on plans that include AI, when a new inquiry arrives, so a suggested reply is ready. Drafts meant for clients come back into the workspace’s Approvals queue for a person to review.

• Customer and client information is not used to train AI models: not by us, and not by our AI provider under its commercial terms.
• We send only what a task needs, not the whole workspace.
• AI features are part of certain plans; a workspace whose plan doesn’t include them sends nothing to the provider.

We use these service providers (“subprocessors”) to run Tako. Each one may process personal information only to provide its service to us, under a contract that requires it to protect the data.

These services receive limited data only when the related feature is used or switched on:

We also share personal information:

• Inside a workspace: with the team members the workspace owner invites.
• When you ask us to: for example, when you send a proposal or invoice link to a client, or connect a calendar feed.
• Client payments: when a client pays a Tako business online, Stripe processes that payment on the business’s own Stripe account, under Stripe’s own privacy policy. Tako never receives or holds that money.
• For legal reasons: when required by law or valid legal process, or to protect the rights, safety and security of our customers, their clients, the public or Tako.
• In a business transfer: if Tako is merged, acquired or sells its assets, subject to this policy’s protections.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

We use only what the Service needs to work. We don’t use advertising cookies or third-party analytics.

• Sign-in cookies keep you logged in and protect your session.
• A workspace cookie remembers which workspace you’re working in when you belong to more than one.
• Browser storage remembers display preferences on your device, such as dashboard layout and whether the sidebar is collapsed.

You can clear these in your browser settings at any time. Without sign-in cookies you won’t be able to stay logged in. If we ever add analytics or other optional cookies, we will update this policy first.

• Active workspaces: as long as the workspace has a trial or subscription.
• Lapsed workspaces: at least 90 days after the trial or subscription ends, so the owner can renew or export. After that, we may delete it. When we delete a workspace, backup copies are overwritten on the backups’ normal rotation.
• Deletion requests: a workspace owner can ask us to delete the workspace earlier, at any time, at legal@takobms.com.
• Billing records: kept as long as tax and accounting laws require.
• Server and error logs: kept for a short period for security and troubleshooting, then deleted.

Data is encrypted in transit (HTTPS) and stored with providers that encrypt it at rest. Every workspace is kept separate at the database level, so one business can never see another’s records. Links shared with clients use long, unguessable tokens. Access to production systems is limited to the people who need it. No system is perfectly secure; if a breach affects your information, we will notify you as the law requires.

Depending on where you live, including California and other US states with privacy laws, you may have the right to:

• know what personal information we have about you and get a copy of it;
• correct information that is wrong;
• delete your information;
• opt out of the sale or sharing of personal information (we don’t sell or share it);
• limit the use of sensitive personal information (we don’t use it for any purpose that requires this);
• appeal if we decline your request.

To make a request, email legal@takobms.com from the address on your account, or tell us how to reach you. We will confirm your identity before acting, answer within 45 days, and tell you if we need more time. You can use an authorized agent; we may ask for proof they act for you. We won’t treat you differently for using these rights.

Workspace owners can also download their workspace’s data themselves anytime from Download my data (also linked from Settings → Export your data). Clients of a Tako business should contact that business first (see Client information belongs to the business).

Tako is a tool for businesses and isn’t meant for children. We don’t knowingly collect personal information from anyone under 16. If you believe a child’s information is in Tako, contact us and we will work with the business to remove it.

Tako is run from the United States, and our primary database is hosted in the United States. Some service providers may process data in other countries; when they do, they are bound by contracts that protect it.

We send account, security and billing emails as part of the Service, including a confirmation when you subscribe and, for yearly plans, a reminder before each renewal. If we send product news or offers, every such email has an unsubscribe link. Emails a Tako business sends to its clients come from that business, and the business is responsible for them. Marketing emails a business sends through Tako carry an unsubscribe link, and Tako stops sending them to anyone who opts out.

When we update this policy, we change the date at the top. If a change is material, we will email workspace owners before it takes effect. We will never use personal information in a materially different way without notice and, where the law requires it, consent.

Privacy questions and requests: legal@takobms.com.