PRIVATE BETA Request access →
Legal

Privacy Policy

Last updated: 21.10.2026 · Version 2.0

Summary

  • Who we are: Takoa AI Group Pte. Ltd. (Singapore) and Takoa AI Finland Oy (Finland) are jointly responsible for the personal data described in this policy.
  • What we collect: the business contact details you give us (name, company, title, work email and phone), your messages to us, basic technical data from your visits to our website and, if you accept analytics cookies, website usage data through Google Analytics.
  • Why: to respond to your enquiries and access requests, manage business relationships, send relevant updates (you can opt out at any time), keep our website secure, and meet our legal obligations.
  • We never sell your data. We share it only with trusted service providers, our advisers, and authorities where the law requires.
  • Your rights: you can access, correct or delete your data, object to its use, and withdraw consent. Contact dpo@takoa.ai.
  • Takoa OS: data processed inside our product on behalf of customers is covered by each customer's agreement with us, not by this policy.

The full policy follows.

1. Who we are

Takoa AI operates through two companies:

  • Takoa AI Group Pte. Ltd., UEN: 202643562M, Singapore.
  • Takoa AI Finland Oy, Business ID: 3633214-6, Espoo, Finland.

In this policy, "Takoa", "we", "us" and "our" refer to both companies together.

Who is responsible for your data

For personal data processed through this website and our sales, marketing and customer support activities, Takoa AI Group Pte. Ltd. and Takoa AI Finland Oy act as joint controllers under Article 26 of the GDPR. We have agreed that Takoa AI Finland Oy is the main point of contact for individuals in the European Economic Area (EEA), the United Kingdom and Switzerland, and Takoa AI Group Pte. Ltd. is the main point of contact for individuals in Singapore and elsewhere. Each company is responsible for the processing it carries out, and you may exercise your rights with either company. We will make sure your request reaches the right place.

This policy is written to meet the requirements of the EU General Data Protection Regulation (GDPR), the Finnish Data Protection Act (1050/2018) and Singapore's Personal Data Protection Act 2012 (PDPA).

2. What this policy covers

This policy applies to personal data we handle as a controller, including when you:

  • browse takoa.ai and its subpages;
  • request access to the Takoa OS private beta or ask us about it;
  • email us (for example at sales@takoa.ai), meet us, or speak with us at events;
  • are a contact person at one of our customers, prospects, partners or suppliers; or
  • interact with our pages on LinkedIn or X.

Data inside Takoa OS

When an organisation uses Takoa OS, any personal data processed within the service (for example user accounts, model-call metadata, audit records and, where a customer enables it, prompts and transcripts) is processed on behalf of that customer. In that role we act as a processor under the GDPR and a data intermediary under the PDPA. That processing is governed by our agreement and data processing agreement with the customer, and by the customer's own privacy notice. If you use Takoa OS through your employer, please contact your employer with any privacy questions about that use.

3. Personal data we collect

We collect the following categories of personal data:

  • Contact and professional details: your full name, company, job title, work email address and phone number. You provide these when you request access or contact us.
  • Enquiry and communication content: your questions and comments, emails, meeting notes, and our correspondence with you.
  • Technical and usage data: IP address, browser and device type, operating system, pages requested, date and time of your visit, and the referring page. These are collected automatically by our web servers and hosting provider.
  • Cookie data: see section 5.
  • Publicly available business information: your name, role, employer and professional profile details, collected from public sources such as company websites and professional networks (for example LinkedIn), where the law permits.
  • Marketing preferences: your opt-outs and communication preferences.

When you request access, we need your name, company and work email to respond. Your phone number, title and comments are optional.

We do not ask for, and ask you not to send us, sensitive personal data such as health information, government identification numbers, or information about racial or ethnic origin, political opinions or religious beliefs. Our website and services are intended for business users and are not directed at individuals under 18.

4. Why we use your data and our legal bases

We use personal data for the purposes below. For individuals in the EEA, the legal basis under Article 6 of the GDPR is shown for each purpose.

  • Responding to access requests and enquiries, assessing fit for the private beta, arranging demos and preparing proposals. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b)) and our legitimate interest in responding to business enquiries (Art. 6(1)(f)).
  • Managing relationships with customers, prospects, partners and suppliers, including contract administration and support. Legal basis: performance of a contract (Art. 6(1)(b)) and our legitimate interest in running our business (Art. 6(1)(f)).
  • Sending updates about Takoa OS, beta access, events and related products. Legal basis: our legitimate interest in business-to-business marketing to relevant professional contacts, where the law permits (Art. 6(1)(f)); otherwise your consent (Art. 6(1)(a)). You can opt out at any time.
  • Operating, securing and improving our website, including preventing spam and abuse. Legal basis: our legitimate interest in keeping our website secure and working (Art. 6(1)(f)).
  • Measuring website use with Google Analytics (see section 5). Legal basis: your consent (Art. 6(1)(a)).
  • Complying with accounting, tax and other legal obligations. Legal basis: legal obligation (Art. 6(1)(c)).
  • Establishing, exercising or defending legal claims. Legal basis: our legitimate interest (Art. 6(1)(f)).

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can ask us for more information about this assessment, and you have the right to object (see section 10).

Singapore

For individuals in Singapore, we collect, use and disclose personal data with your consent, including consent deemed by your conduct when you voluntarily provide your details to us for a stated purpose (for example, when you request access), or where an exception under the PDPA applies, such as the legitimate interests or business improvement exceptions. Business contact information provided solely for business purposes falls outside most PDPA obligations, but we apply the same care to it.

We will not send marketing messages by voice call, SMS or messaging app to a Singapore telephone number unless we have your clear and unambiguous consent or have checked the number against Singapore's Do Not Call Registry, as required by the PDPA.

No automated decision-making

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

5. Cookies and similar technologies

Cookies are small files stored on your device when you visit a website. We use two types:

  • Strictly necessary cookies, which the website needs to function and to protect it against abuse. These do not require your consent.
  • Analytics cookies, which help us understand how visitors use our website. We set these only if you consent.

We do not use advertising or remarketing cookies.

Google Analytics

With your consent, we use Google Analytics 4 to measure how our website is used, for example which pages are visited, how long visitors stay, which site referred them, their approximate location at country or city level, and the type of device and browser used. We use this information only in aggregated form to improve our website and content. We do not use it to identify individual visitors.

Google Analytics is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which processes the data on our behalf as our service provider. Google Analytics sets the following cookies:

  • _ga, which distinguishes unique visitors. Expires after 2 years.
  • _ga_ followed by our website's measurement ID, which maintains the session state. Expires after 2 years.

Google Analytics 4 does not log or store full IP addresses. For visitors in the EU, the IP address is used only to estimate approximate location and is then discarded. User-level data in Google Analytics is deleted automatically after no more than 14 months. We do not use Google Analytics data for advertising purposes.

Data collected through Google Analytics may be transferred to Google LLC in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection. For more information, see Google's privacy policy at policies.google.com/privacy.

Our legal basis for using Google Analytics is your consent (Art. 6(1)(a) GDPR and section 205 of the Finnish Act on Electronic Communications Services, 917/2014).

Managing your choices

When you first visit our website, we ask whether you accept analytics cookies. Google Analytics is not activated until you accept. You can change or withdraw your consent at any time through the Cookie settings link at the bottom of every page. Withdrawing consent does not affect data collected before you withdrew it.

You can also block or delete cookies through your browser settings, or install the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout.

Our website links to our pages on LinkedIn and X. These are plain links, and no data is shared with those platforms unless you click them. Once you visit those platforms, their own privacy policies apply.

6. Who we share your data with

We do not sell personal data. We share it only as follows:

  • Between Takoa companies. Takoa AI Group Pte. Ltd. and Takoa AI Finland Oy share personal data with each other to run our sales, support and business operations, as described in section 1.
  • Service providers. We use trusted providers who process data on our behalf under written agreements and only on our instructions. These currently include Google Cloud for website hosting, in data centres in Singapore or Finland; Google Workspace for email and office productivity; and Google Ireland Limited for website analytics (EU, with possible transfers to the United States).
  • Professional advisers. Lawyers, accountants, auditors and insurers, where necessary and under confidentiality obligations.
  • Authorities. Courts, regulators, law enforcement and other public authorities where we are legally required to share data or need to protect our rights.
  • Corporate transactions. A prospective or actual buyer, investor or successor in connection with a merger, acquisition, financing or sale of all or part of our business, subject to confidentiality obligations.

7. International data transfers

Because we operate in both Finland and Singapore, personal data is transferred between the EEA and Singapore, and some of our service providers may process data in other countries.

Singapore has not received an adequacy decision from the European Commission. When we transfer personal data from the EEA to Singapore or to another country without an adequacy decision, we use the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), together with additional safeguards where needed. For transfers to organisations in the United States that are certified under the EU-U.S. Data Privacy Framework, such as Google LLC, we rely on the European Commission's adequacy decision for that framework.

When we transfer personal data out of Singapore, we take steps to ensure the recipient provides a standard of protection comparable to the PDPA, for example through legally binding contractual obligations.

You can request a copy of the relevant safeguards by contacting dpo@takoa.ai.

8. How long we keep your data

We keep personal data only for as long as necessary for the purposes described in this policy:

  • Access requests and prospect data with no ongoing engagement: up to 24 months after our last interaction with you.
  • Customer, partner and supplier contact data: for the duration of the business relationship and up to 3 years afterwards.
  • Accounting and contract records: as required by Finnish and Singapore accounting and tax laws, generally 5 to 10 years.
  • Website server logs: up to 90 days, unless needed longer to investigate a security incident.
  • Google Analytics user-level data: no more than 14 months, after which it is deleted automatically.
  • Marketing opt-outs: for as long as needed to make sure we respect your choice.

When data is no longer needed, we delete or anonymise it securely.

9. How we protect your data

Security is central to what we build. We apply appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls based on least privilege, multi-factor authentication for internal systems, logging and monitoring, and confidentiality obligations for our staff and service providers.

If a personal data breach occurs, we will act promptly to contain it. Where required, we will notify the Finnish Data Protection Ombudsman within 72 hours of becoming aware of it, and the Singapore Personal Data Protection Commission within three calendar days of assessing that a breach is notifiable, and we will inform affected individuals where the law requires.

10. Your rights

If you are in the EEA, the UK or Switzerland

Subject to the conditions in the GDPR, you have the right to:

  • access your personal data and receive a copy of it;
  • have inaccurate or incomplete data corrected;
  • have your data erased;
  • restrict our processing of your data;
  • object to processing based on our legitimate interests, and object at any time to direct marketing;
  • receive your data in a portable format, where processing is based on consent or contract and carried out by automated means; and
  • withdraw your consent at any time, without affecting processing that took place before withdrawal.

You also have the right to lodge a complaint with a supervisory authority. In Finland this is the Office of the Data Protection Ombudsman (www.tietosuoja.fi). You may also complain to the authority in the EEA country where you live or work.

If you are in Singapore

Under the PDPA, you have the right to:

  • access your personal data in our possession or control, and information about how it has been used or disclosed in the past year;
  • have errors or omissions in your personal data corrected; and
  • withdraw your consent to our collection, use or disclosure of your personal data. We will explain the likely consequences of withdrawal before acting on it.

You may lodge a complaint with the Personal Data Protection Commission (www.pdpc.gov.sg).

How to exercise your rights

Email dpo@takoa.ai. We may need to verify your identity before acting on your request, usually by confirming details you have already given us. We respond to GDPR requests within one month, which may be extended by two further months for complex requests, in which case we will tell you. We respond to PDPA access requests as soon as reasonably possible and within 30 days, or we will tell you when to expect a response. Requests are normally free of charge. For PDPA access requests we may charge a reasonable fee, and we will tell you the amount before proceeding.

To stop receiving marketing emails, use the unsubscribe link in any email or contact us.

11. Data Protection Officer and contact details

We have appointed a Data Protection Officer, who can be contacted with any question about this policy or our handling of personal data at dpo@takoa.ai.

  • Takoa AI Finland Oy, Espoo, Finland: contact for the EEA, the UK and Switzerland.
  • Takoa AI Group Pte. Ltd., Singapore: contact for Singapore and other regions.

12. Changes to this policy

We may update this policy from time to time, for example when we launch Takoa OS more widely or change the services we use. We will post the updated version on this page with a new "Last updated" date and, where changes are significant, notify you by email or through a notice on our website.