1. Who is responsible

Tanuki Labs operates this website and determines why and how personal data submitted through it is used. Privacy questions and rights requests can be sent to info@tanukilabs.tech.

2. Data we process

Website and security data: IP address, browser or device information, timestamps, requested pages, and technical logs made available by our hosting and security infrastructure.
Privacy and display choices: your optional analytics choices, their date, and your theme preference, stored in your browser.
Messages: your name, email address, message, and the privacy-policy version accepted when you use the contact form.
Newsletter details: your name if provided, email address, selected interests, consent time, and policy version.
Admin access: login attempts and an essential, encrypted session token for authorised users. We do not disclose or display submitted passwords.
Demo creator accounts: your name, email address, password hash, account status, quota settings, and the card or ticket designs you choose to save. Passwords are never stored in readable form.
Assistant prompts: the text you choose to send to the Tanuki Labs assistant. Please do not include confidential, sensitive, or unnecessary personal data.
Optional measurement: page path and time through our internal analytics; and, if separately enabled, page, referrer origin, browser, operating system, device type, a temporary cookieless session hash, and link interactions through the tanuki.bio monitor.

3. Why we use it and our legal bases

Purpose	Legal basis
Deliver, secure, troubleshoot, and administer the website	Legitimate interests, contract where applicable, and legal obligations
Answer enquiries and discuss requested services	Steps requested before a contract and legitimate interests
Send product news and updates	Your consent, which you can withdraw at any time
Run internal analytics and external monitoring	Your granular consent; both are off by default
Protect restricted admin access	Legitimate interests in security and access control
Provide demo creator accounts and their saved designs	Steps requested before using the demo service and legitimate interests
Respond to legal claims or lawful requests	Legal obligation and legitimate interests

Where processing relies on consent, refusing optional processing does not prevent you from browsing the public website. Consent can be withdrawn as easily as it was given.

4. Who receives data

We do not sell personal data or use it to create advertising profiles. We share only what is needed with:

Vercel, which provides website hosting, content delivery, serverless functions, security, and technical logs. Read the Vercel privacy notice.
tanuki.bio monitoring, only if you enable “External monitoring” in Privacy choices. Its script receives the optional technical and interaction data described above.
Groq, only when the website assistant is available and you choose to send a prompt. The prompt and necessary context are sent server-side to generate a reply. Read the Groq privacy policy.
Configured message integrations, such as operational webhooks, when needed to deliver a contact, newsletter, or analytics event to Tanuki Labs.
QR Server, when an authorised administrator requests a QR preview. The destination URL and visual QR settings are sent to generate that image.
Authorities or professional advisers, only where required by law or necessary to establish, exercise, or defend legal claims.

Card, ticket, social, and other external destinations you choose to open have their own privacy notices and act independently for their services.

5. International transfers

Some service providers may process data outside Italy or the European Economic Area. Where required, transfers are protected through an adequacy decision, approved contractual safeguards, or another lawful transfer mechanism. Provider notices linked above explain their locations and safeguards in more detail.

6. How long we keep data

Privacy choices are remembered for up to six months, then requested again.
The essential admin session expires after eight hours.
Newsletter records are kept until you unsubscribe or withdraw consent.
Enquiries are kept for as long as needed to answer, manage the relationship, and meet reasonable legal or record-keeping requirements.
The website does not intentionally add assistant prompts to its own contact or newsletter records; the service provider's applicable retention terms may still apply.
Security, hosting, analytics, and monitoring records are kept only for their configured operational periods and legitimate security or reporting needs.

A longer period may apply when law requires it or a record is needed for a legal claim. Data is deleted or anonymised when it is no longer required.

7. Your rights

Subject to applicable law, you may ask to access, correct, erase, restrict, or receive your personal data, and you may object to processing based on legitimate interests. You can withdraw consent at any time without affecting processing that was lawful before withdrawal.

Send a request to info@tanukilabs.tech. We may need to verify your identity. You may also lodge a complaint with the Italian Data Protection Authority (Garante).

8. Children and automated decisions

This website is not directed to children and we do not knowingly request their personal data. We do not make decisions with legal or similarly significant effects solely by automated means through this website.

9. Security and policy changes

We use access controls, secure transport, limited administrative sessions, and operational safeguards appropriate to the website. No internet service can guarantee absolute security.

We will update this notice when the website, providers, or legal requirements change. Material changes will be reflected in the date above and, where required, we will request a new choice.