Privacy Policy
Last updated: 05.11.2026
This policy explains which personal data TangrAI processes, why, on what legal basis, who we share it with and what rights you have.
1. Data controller
TangrAI is provided by Veneta Dimitrova Kirilova, a natural person, address Lomska 94 Str., Kozloduy, Bulgaria ("we").
For any question about personal data: hello@tangrai.com, phone +359 878904586
2. Data we process
- Account data: email, name, password (stored only as a bcrypt hash), preferred language, sign-up date, plan, number of generations used and whether your email is verified.
- Google sign-in: email, name and profile picture URL, received from Google through Emergent's sign-in service.
- Data you enter in the AI tools: business name and type, city, country, services, promotion text, website address, plus the generated content and your favourites. Please do not enter other people's personal data in these fields.
- Security data: IP address and email when you request a password reset or a new verification email (abuse prevention).
- Technical data: a session cookie and server logs containing your user ID and a masked email (e.g. v***@gmail.com). Logs never contain full emails, passwords, tokens or verification/reset links.
- AI quality monitoring: if an AI answer is not in your chosen language, we store a snippet of up to 500 characters of the rejected answer, the tool, the language and your user ID. Your input text is not stored there.
We do not collect payment data, phone numbers, postal addresses or sensitive data.
We do not use advertising or behavioural tracking tools. Our hosting provider's network (Cloudflare, via Emergent) may collect aggregated, anonymous visit statistics (Cloudflare Web Analytics), which, according to Cloudflare, does not use cookies.
Providing your email is required to create an account; without it we cannot provide the service. All other data is optional.
3. Purposes and legal bases
- Purpose
- Creating and running your account, sign-in
- Data
- Account data, session cookie
- Legal basis (GDPR)
- Art. 6(1)(b) – performance of contract
- Purpose
- AI content generation and history
- Data
- AI tool data
- Legal basis (GDPR)
- Art. 6(1)(b) – performance of contract
- Purpose
- Verification and password-reset emails
- Data
- Email, name, language
- Legal basis (GDPR)
- Art. 6(1)(b) – performance of contract
- Purpose
- Beta programme: plans and limits
- Data
- Account data
- Legal basis (GDPR)
- Art. 6(1)(b) – performance of contract
- Purpose
- Abuse prevention, rate limiting, security
- Data
- IP address, email, server logs
- Legal basis (GDPR)
- Art. 6(1)(f) – legitimate interest (service security)
- Purpose
- AI language-quality monitoring
- Data
- AI answer snippet, user ID
- Legal basis (GDPR)
- Art. 6(1)(f) – legitimate interest (service quality)
- Purpose
- Remembering language and theme in your browser
- Data
- localStorage
- Legal basis (GDPR)
- Art. 6(1)(f) – your choice, technically necessary
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating and running your account, sign-in | Account data, session cookie | Art. 6(1)(b) – performance of contract |
| AI content generation and history | AI tool data | Art. 6(1)(b) – performance of contract |
| Verification and password-reset emails | Email, name, language | Art. 6(1)(b) – performance of contract |
| Beta programme: plans and limits | Account data | Art. 6(1)(b) – performance of contract |
| Abuse prevention, rate limiting, security | IP address, email, server logs | Art. 6(1)(f) – legitimate interest (service security) |
| AI language-quality monitoring | AI answer snippet, user ID | Art. 6(1)(f) – legitimate interest (service quality) |
| Remembering language and theme in your browser | localStorage | Art. 6(1)(f) – your choice, technically necessary |
We make no automated decisions that produce legal effects for you (Art. 22 GDPR).
4. Recipients
- Emergent (our processor) – hosting through its sub-processors: Google Cloud (application server, region us-central1, Iowa, USA), MongoDB Atlas managed by Emergent (database, region us-central1, Iowa, USA) and Cloudflare (the site is delivered through Cloudflare's network); intermediary for AI requests and Google sign-in. The data is stored in the USA.
- We do not use advertising or behavioural tracking tools. Our hosting provider's network (Cloudflare, via Emergent) may collect aggregated, anonymous visit statistics (Cloudflare Web Analytics), which, according to Cloudflare, does not use cookies.
- OpenAI (USA) – generates the text. The request path is: your browser → our server → Emergent → OpenAI. Only the tool form data is sent; we do not send your email, name or user ID.
- Resend (USA) – sends verification and password-reset emails; receives your email, name and the link in the message.
- Google (USA) – only if you choose Google sign-in. Your profile picture is loaded from Google's servers when displayed.
We do not sell personal data or share it for advertising.
5. Transfers outside the EU/EEA
OpenAI, Resend and Google process data in the USA. Hosting and database (Google Cloud and MongoDB Atlas via Emergent) are in region us-central1 (Iowa, USA).
Resend is certified under the EU–US Data Privacy Framework. Transfers via Emergent (hosting, database, AI processing by OpenAI and Google sign-in) are covered by Emergent's Data Processing Agreement, which includes the EU Standard Contractual Clauses. You can request a copy of the applicable safeguards at hello@tangrai.com.
6. Retention
- Data
- Account
- Period
- Until you delete your account
- Data
- Content history and favourites
- Period
- Until you delete them or your account
- Data
- Sign-in session
- Period
- 7 days; removed on logout
- Data
- Email verification link
- Period
- 24 hours
- Data
- Password reset link
- Period
- 30 minutes
- Data
- Rate-limit records (email + IP)
- Period
- 1 hour
- Data
- AI request rate-limit records (user ID)
- Period
- 2 minutes
- Data
- AI monitoring records
- Period
- 90 days
- Data
- Server logs
- Period
- Up to 1 year at our hosting provider. They contain no passwords, tokens or full email addresses (emails are masked).
- Data
- Backups
- Period
- Up to about 1 year. Data deleted from the live database can remain in backups until they expire, isolated from further processing.
| Data | Period |
|---|---|
| Account | Until you delete your account |
| Content history and favourites | Until you delete them or your account |
| Sign-in session | 7 days; removed on logout |
| Email verification link | 24 hours |
| Password reset link | 30 minutes |
| Rate-limit records (email + IP) | 1 hour |
| AI request rate-limit records (user ID) | 2 minutes |
| AI monitoring records | 90 days |
| Server logs | Up to 1 year at our hosting provider. They contain no passwords, tokens or full email addresses (emails are masked). |
| Backups | Up to about 1 year. Data deleted from the live database can remain in backups until they expire, isolated from further processing. |
7. Your rights
- Access (Art. 15) and rectification (Art. 16).
- Erasure (Art. 17): the "Delete account" button in Account settings immediately deletes your profile, history, favourites, sessions, tokens and monitoring records. Copies in backups expire within about 1 year. You can also request erasure by email.
- Restriction (Art. 18) and data portability (Art. 20).
- Objection (Art. 21) to processing based on legitimate interest.
Send requests to hello@tangrai.com. We reply within one month.
You may complain to the Bulgarian Commission for Personal Data Protection (КЗЛД / CPDP): 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg – or to the supervisory authority where you live.
8. Security
Passwords are stored as bcrypt hashes. Connections are encrypted (HTTPS). The session cookie is HttpOnly and Secure. Verification and reset links are single-use and short-lived. Reset and resend requests are rate-limited.
9. AI-generated content
Texts in the tools are generated by artificial intelligence and labelled as such. Review them before publishing.
10. Age
The service is intended for people aged 18 or over. We do not knowingly collect data from minors.
11. Changes
We will publish any new version on this page with a new date. We will notify you by email of material changes.