Privacy Policy
Here we explain what personal data we process when you use Taguj (the website taguj.io and the Taguj mobile app), why, for how long, who we share it with and what rights you have. Processing is governed by Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll., on the Processing of Personal Data.
Data controller
Pro Tvůj Brand s.r.o., IČO (company ID) 24683108, DIČ (VAT ID) CZ24683108
U Golfu 722, Horní Měcholupy, 109 00 Praha 10
Data protection contact: info@taguj.io (support: support@taguj.io)
We have not appointed a Data Protection Officer; please send all questions to the email address above.
1. Terms
- Personal data
- any information about you by which you can be identified directly or indirectly (name, email, photo, account identifier, IP address, etc.).
- Processing
- anything we do with data – collecting, storing, displaying, sharing, erasing.
- Controller
- whoever determines why and how data is processed – for Taguj, this is Pro Tvůj Brand s.r.o.
- Processor
- a supplier that processes data for us and on our instructions (e.g. hosting).
- Recipient
- anyone to whom we disclose data – a processor or an independent controller (e.g. an affiliate network).
- Profiling
- automated evaluation of your preferences, for example to rank the feed.
2. What data, why and for how long
Legal bases under Article 6(1) GDPR: contract (performance of a contract and steps prior to entering into it, point b), legal obligation (point c), legitimate interest (point f) and consent (point a).
| Data category | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Registration and profile data: name, username, email, password (in encrypted form only), profile photo, bio, language, Google / Apple / Facebook account identifier | creating and managing your account, signing in, providing Taguj | contract | for as long as the account exists |
| Date of birth | verifying that you are at least 18 | contract; legitimate interest (keeping minors off Taguj) | for as long as the account exists |
| Content: photos, videos, stories, captions, tagged products, comments | publishing and displaying content | contract | until the content or account is deleted; stories stop being shown to others after 24 h, we delete story videos from storage 2 days later, the story image remains until the story or account is deleted |
| Activity in the app: likes, saves, follows, content views, clicks on products, taste chosen when registering | running social features; personalising the order of the feed | contract; legitimate interest (a relevant feed) – you can object | for as long as the account exists; we delete it after the account is deleted |
| Click and order data: click identifier, time, link, merchant, order status and value, commission amount (without details of exactly what you bought, unless the merchant sends them) | crediting commission to the creator, settlement with affiliate networks and merchants, statistics for creators | contract (towards the creator); legitimate interest (settlement with partners) | for as long as necessary for settlement and commission claims; after the account is deleted, without name and email |
| Data for creator payouts: name, address, account number / IBAN, country of tax residence, IČO (company ID), DIČ (VAT ID) and VAT payer status (for businesses), declarations on honour (18+, own name, sanctions, PEP), verification result | paying out commissions, verifying identity and checking sanctions lists, statements and invoicing | contract; legal obligation (accounting and tax regulations, international sanctions); legitimate interest (fraud prevention) | for the duration of the collaboration and then for the period required by accounting and tax regulations (usually 5 to 10 years) |
| Invitation data: who invited whom, registration date, reward amount | calculating the invitation reward | contract | for the duration of the entitlement to the reward and settlement |
| Payments for paid features, if we introduce them: plan, amount, date, payment status, Stripe customer identifier (we neither see nor store card details) | providing the paid feature, accounting | contract; legal obligation | for the duration of the subscription and then in accordance with accounting and tax regulations (up to 10 years) |
| Communication with support, including the support chat with AI replies | handling your enquiry, complaint or grievance | contract; legitimate interest | for as long as necessary to handle it and to defend any claims; after the account is deleted, we disconnect the messages from the account, and the email given in a message stays with it |
| Reports, moderation, blocks, warnings and bans | content moderation, fulfilling obligations under the DSA, protecting users | legal obligation (DSA); legitimate interest | for as long as the account exists; reports submitted by a user are deleted when their account is deleted |
| Security and technical data: IP address, device and browser type, request and sign-in logs | security, preventing misuse, troubleshooting | legitimate interest | a sign-in is valid for no more than 60 days; records of failed sign-ins and rate limiting are deleted within 2 days; other technical logs only for as long as necessary for troubleshooting and security |
| Device token for notifications (push) | sending notifications in the app | contract; notifications enabled on your phone | until you sign out, delete your account or turn off notifications |
| Email for service messages (address verification, password reset, waiting list confirmation, changes to the terms) | service communication | contract; legal obligation | for as long as the account exists |
| Email for news and marketing | sending commercial communications | consent, or legitimate interest for our own similar services (Section 7 of Czech Act No. 480/2004 Coll.) | until consent is withdrawn or you unsubscribe |
| Analytics and marketing data from the website (Google Analytics 4, Meta Pixel): cookie identifiers, pages visited, events such as registration | measuring traffic, evaluating ads | consent (only after “Accept all”) | until consent is withdrawn; in the tools, for the retention period set in Google Analytics and at Meta |
| Data from brands and local businesses (contact person, email, phone, IČO (company ID)) | arranging and managing collaborations | contract; legitimate interest | for the duration of the collaboration and in accordance with accounting regulations |
Where we process data on the basis of legitimate interest, we have assessed that your interests and rights do not override it. We will give you details on request.
Providing the data marked as required for an account or payout is a contractual requirement; without it, we cannot create an account or pay out a commission.
3. Where we get data from
- from you – when you register, edit your profile, publish content, communicate with us or fill in your payout details;
- from your use of Taguj – activity, clicks, technical data;
- from sign-in providers – Google, Apple or Meta (Facebook) pass us basic data (typically name, email and account identifier); with Apple you can choose to hide your email;
- from affiliate networks and merchants – order status and value and the commission linked to the click identifier;
- from public registers – ARES (verifying IČO (company ID)) and sanctions lists;
- from other users – when they invite you, tag you in content, report you or communicate with you.
4. What other users can see
Your public profile at taguj.io/u/your-username can be seen even by visitors who are not signed in: your username, name, profile photo and published posts. Signed-in users in the app can also see your comments and stories. If another user invites you, we will tell her that you joined via her link and credit her with a reward from your commissions. Your date of birth, email, payout and payment details are not public.
5. Who we share data with
We do not sell data. We share it only to the extent necessary with the following recipients:
| Recipient | What they do for us / why they receive data | Where they process it |
|---|---|---|
| Cloudflare, Inc. | hosting, database, file storage (photos, videos), protection against attacks | EU and global network, USA |
| Resend | sending emails | USA |
| Anthropic | AI replies in the support chat (the content of your message) | USA |
| Google (Google Ireland Ltd. / Google LLC) | sign-in via Google; Google Analytics 4 (only with consent); Firebase Cloud Messaging – notifications on Android | EU, USA |
| Apple (Apple Distribution International Ltd. / Apple Inc.) | sign-in via Apple; Apple Push Notification service – notifications on iPhone | EU, USA |
| Meta Platforms Ireland Ltd. | sign-in via Facebook; Meta Pixel (only with consent, not yet deployed) | EU, USA |
| Stripe | processing payments for paid features, if we introduce them; independent controller of payment data | EU, USA |
| Fakturoid | statements and invoicing of payouts to creators | Czech Republic / EU |
| GIPHY | stickers in stories: we send the search term via our server, the stickers themselves load directly from GIPHY, so GIPHY sees the device’s IP address | USA |
| Affiliate networks (CJ, Awin, eHUB, Dognet and others) and merchants | click identifier for crediting commission; independent controllers | EU, USA (depending on the network) |
| ARES (Ministry of Finance of the Czech Republic) | verifying a business’s IČO (company ID) (query with the IČO) | Czech Republic |
| Czech National Bank | exchange rates for converting payouts – we do not share any personal data | Czech Republic |
| Our bank | making the payout (name, account number, amount) | Czech Republic / EU |
| Accountants and tax advisers, auditors, lawyers | accounting and legal services; bound by confidentiality | Czech Republic |
| Public authorities | only where required by law (e.g. a court, the police, the tax office) | Czech Republic / EU |
When you sign in via Google, Apple or Facebook and when you pay via Stripe, these companies are partly independent controllers and follow their own privacy policies. You can remove Taguj’s access to your Facebook account at any time in your Facebook settings, to your Apple account in your Apple ID settings and to your Google account in your Google account settings.
If we were to transfer Taguj or part of it to another company, data may pass to the successor; we will let you know.
6. AI, content ranking and automated decision-making
6.1 Support chat. Questions in the support chat may be answered by artificial intelligence (a model by Anthropic). The chat states that AI is replying and that it will pass more complex matters on to the team. You can ask for a reply from a human at any time at support@taguj.io. Please do not enter sensitive data in the chat (health, card numbers, passwords). We do not use the content of messages to train AI models; under its commercial terms for the API, Anthropic does not use customer data for training.
6.2 Feed ranking. We determine the order of posts automatically based on freshness, popularity, who you follow, the taste you chose when registering and your activity (likes, saves), as well as the boost for weekly goals and paid promotion. This is simple profiling with no legal effects. You can object to it at info@taguj.io, or use the “Following” tab, which shows only posts from people you follow, newest first.
6.3 Moderation. Captions and comments are checked by an automatic filter for inappropriate expressions. Text containing such expressions cannot be published until you edit it. A human always decides on the removal of reported content.
6.4 We do not carry out any decision-making based solely on automated processing that would have legal effects for you or similarly significantly affect you (Article 22 GDPR).
7. Cookies and measurement
On the website we use essential cookies and local storage (sign-in, basket, settings, storing your consent choice). We only load Google Analytics 4 and Meta Pixel with your consent, which you give in the cookie banner with the “Accept all” button. The “Essential only” option is equally prominent and Taguj works the same way. Neither analytics nor the pixel load in the Taguj mobile app. You will find details and how to change your consent in the Cookie Policy.
8. Notifications (push) and emails
We only send notifications in the app if you allow them on your phone; you can turn them off in your phone settings. We always send service emails (address verification, password reset, important changes), because they are necessary for your account to work. You can unsubscribe from marketing emails at any time using the link in the email or by writing to info@taguj.io.
9. Security
We protect data with appropriate technical and organisational measures: encrypted transmission (HTTPS), storing passwords only in hashed form (PBKDF2), limiting the number of sign-in attempts, restricting access to data to authorised people only, and data processing agreements with suppliers. If there were a security breach posing a high risk to your rights, we would inform you and report it to the ÚOOÚ (Office for Personal Data Protection).
10. Transfers outside the EU
Some of our suppliers (in particular Cloudflare, Resend, Anthropic, Google, Apple, Meta, Stripe and GIPHY) may process data in the USA or other countries outside the European Economic Area. We only make transfers with appropriate safeguards: on the basis of a European Commission adequacy decision (including the EU-US Data Privacy Framework for certified companies) or standard contractual clauses approved by the European Commission. We will provide you with a copy of the safeguards on request.
11. What happens after you delete your account
You can delete your account in the app (Profile → Delete account), on the page taguj.io/smazani-uctu or by email to support@taguj.io. After deletion, we delete your posts, photos, stories, likes, comments, follows and settings. Data is removed from backups within 30 days. Only the data necessary for settling commissions with merchants and for meeting legal obligations remains (without name and email, unless required by law – e.g. for accounting documents relating to payouts), together with data about an account ban, if the account was banned for breaking the rules.
12. Your rights and how to exercise them
You have the right:
- of access – to find out what data we process about you and to get a copy of it;
- to rectification – to have inaccurate data corrected or incomplete data completed (you can edit most of it yourself in your profile);
- to erasure – to ask for data to be deleted if it is no longer needed or the processing is not lawful (you can delete your account yourself in the app);
- to restriction of processing – e.g. while the accuracy of the data is being verified;
- to data portability – to receive the data you have provided to us in a machine-readable format and pass it on to another controller;
- to object – to processing based on legitimate interest, including profiling for feed ranking; to direct marketing at any time and without giving a reason;
- to withdraw consent – at any time, without affecting the lawfulness of processing before withdrawal (for cookies via “Cookie settings” in the website footer).
How to do it: write to info@taguj.io from the email address linked to your account. If we have doubts about your identity, we may ask for additional information. We will reply within 1 month of receiving your request; in complex cases we may extend this by a further 2 months, and we will let you know within a month. This is free of charge; for manifestly unfounded or repeated requests, we may charge a reasonable fee or refuse the request.
13. Age 18+
Taguj is only for people over 18. We do not create accounts for younger people and we do not knowingly process children’s data. If we find out that an account belongs to someone under 18, we will delete it and erase the data. If you know of such an account, write to us at support@taguj.io.
14. Complaint to the authority
If you believe that our processing breaks the rules, you can lodge a complaint with the supervisory authority: Úřad pro ochranu osobních údajů (ÚOOÚ, Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz. You can also turn to the supervisory authority in the EU country where you live or work (e.g. Slovakia or Poland). We would be glad if you got in touch with us first – we will try to sort everything out.
15. Changes to this policy
We may update this policy when the service, our suppliers or the law change. The current version is always on this page, and you will find the date of the last update at the top. We will inform you of material changes (e.g. a new purpose of processing) in advance by email or in the app.