1. Introduction

Tailkey does not sell personal information and processes analytics data solely for the purpose of providing the Services requested by its customers.

This Privacy Policy (this "Policy") describes how Tailkey G.K. ("Tailkey," "we," "us" or "our"), a godo kaisha organized under the laws of Japan with its principal office at Fuji Building 40, 15-14 Sakuragaokacho, Shibuya-ku, Tokyo 150-0031, Japan, collects, uses, discloses and protects information in connection with our marketing website located at tailkey.com, our application located at app.tailkey.com, and related support and sales communications (collectively, the "Services").

This Policy should be read together with our Terms & Conditions, our Refund Policy, our Data Processing Addendum (the "DPA") and our Member Code of Conduct. In the event of any conflict between this Policy and the DPA or an executed Enterprise agreement with respect to the processing of Customer Data, the DPA or such agreement, as applicable, shall prevail.

Effective date: 01/10/2026. Last updated: 01/10/2026.

2. Tailkey's Role as Controller and Processor

Tailkey acts in different capacities depending on the category of data concerned, as set out below.

Customer Data generally relates to visitors to our customers' websites rather than to our customers themselves. Each customer is solely responsible for establishing a lawful basis for, providing all required notices regarding, and obtaining any consents necessary for, the collection of such data and its disclosure to Tailkey. Individuals who visit a customer's website should direct any inquiries regarding their personal information to that customer in the first instance, and Tailkey will assist the customer in responding to such inquiries.

3. Information We Collect

Account and seat information. When you register for an account at app.tailkey.com, we collect your name, work email address, password or Google sign-in identifier, company name and job role. Authentication is provided through Firebase Authentication. Your user profile, subscription plan, seat assignments and permissions are stored in Firestore.

Billing information. Payments are processed by Stripe. Tailkey does not receive or store full payment card numbers. We retain your Stripe customer and subscription identifiers, subscription plan, billing status, invoice history and data-usage totals for the purpose of applying usage limits and overage charges.

Customer Data through the BigQuery connection. When you connect your Google Cloud project, Tailkey accesses the Google Analytics 4 ("GA4") export tables that you authorize. Raw GA4 data remains in your BigQuery project, and any query charges incurred are billed to your Google Cloud account. GA4 exports may include pseudonymous identifiers (such as user_pseudo_id), any user_id values you assign, device and browser information, approximate location, page and event data, and traffic source information.

Customer Data through file upload. If you elect to upload CSV or JSON files, Tailkey stores those files in Google Cloud Storage within Tailkey's own Google Cloud project until you delete them or your account is closed, subject to Section 9.

Model outputs. We store the outputs generated by the Services, including attribution scores, ranked journeys and behavioral segments, in BigQuery within our Google Cloud environment.

Usage and technical data. We log sign-in events, feature usage, errors, IP addresses, browser type and request metadata in order to operate, secure and improve the Services. Cloudflare processes network traffic to tailkey.com and app.tailkey.com for the purpose of protecting against malicious activity.

Communications. If you contact us at support@tailkey.com or hello@tailkey.com, request a demonstration or submit a form, we retain the related correspondence.

What we do not collect. The Services do not currently set tracking cookies on the devices of our customers' website visitors, capture advertising-platform click identifiers, or collect visitor email addresses or telephone numbers. Customers must not submit special categories of personal information (including health information, religious beliefs, sexual orientation, precise geolocation, government-issued identification numbers and financial account numbers) to the Services, and the Member Code of Conduct prohibits such submissions.

4. How We Use Information

We use Account Data, Website Data and usage data to create and secure accounts, provide customer support, process billing, enforce plan limits, deliver service notices, detect and prevent abuse, comply with legal obligations and improve the Services. With your consent, or as otherwise permitted by applicable law, we may send you product updates, from which you may unsubscribe at any time.

We process Customer Data solely to provide the Services to the applicable customer, including running attribution models, ranking journeys, building segments, generating reports and exports, troubleshooting at the customer's request and maintaining the security of the platform.

With respect to Customer Data, Tailkey:

• does not sell or rent Customer Data, or "share" it for cross-context behavioral advertising;

• does not combine one customer's Customer Data with that of any other customer, or use it to develop benchmarks, profiles or products for other customers;

• does not use Customer Data for its own advertising or marketing purposes;

• does not use Customer Data to train general-purpose or cross-customer machine learning models, and runs models separately for each customer using only that customer's data;

• does not attempt to re-identify any individual associated with a pseudonymous identifier; and

• permits its personnel to access Customer Data only to the extent necessary to provide or support the Services, subject to confidentiality obligations and least-privilege access controls.

Notwithstanding the foregoing, we may use aggregated, de-identified statistics regarding platform performance (for example, processing volumes or error rates) that cannot reasonably be linked to any customer or individual.

Legal bases (EEA/UK). Where the General Data Protection Regulation ("GDPR") or the UK GDPR applies, we rely on the following legal bases: performance of a contract (to administer your account); our legitimate interests (security, product improvement and business-to-business marketing); compliance with legal obligations (tax and accounting records); and consent (optional marketing communications and non-essential cookies). With respect to Customer Data, the customer's lawful basis applies.

Automated processing. Tailkey's models score content, journeys and segments to support customers' marketing analysis. The Services do not make decisions based solely on automated processing that produce legal effects concerning, or similarly significantly affect, any individual.

5. Google User Data

Tailkey's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect a Google Cloud project, either by signing in with Google (OAuth) or by granting Tailkey's service account read access, Tailkey accesses only the BigQuery datasets and tables that you authorize, with read-only permissions [confirm scopes/IAM roles]. Tailkey uses such access solely to perform the analyses you request within the Services. Tailkey does not transfer Google user data to third parties except as necessary to provide the Services, to comply with applicable law, or in connection with a merger, acquisition or sale of assets, with notice to you. Tailkey personnel do not read such data except at your request for support purposes, as necessary for security purposes, or as required by applicable law.

You may revoke such access at any time through your Tailkey account settings, through your Google Account permissions, or by removing Tailkey's service account from your Google Cloud Identity and Access Management (IAM) configuration.

Your GA4 property and the data therein remain subject to your agreements with Google, including the Google Analytics Terms of Service, the Google Ads Data Processing Terms and How Google uses information from sites or apps that use our services. Where you use the Services to build GA4 audiences that you share with Google Ads, Google's Personalized advertising policy and EU user consent policy also apply to you.

6. Cookies and Similar Technologies

Tailkey does not place tracking cookies on the devices of our customers' website visitors. On our own websites, we use a limited number of cookies and similar technologies, as described below:

Where required by applicable law, we obtain your consent before setting non-essential cookies, and you may withdraw or modify your consent at any time through [cookie settings link]. You may also configure your browser to block cookies; however, strictly necessary cookies are required for sign-in and payment functionality.

7. Service Providers and Subprocessors

We engage the service providers listed below to host, secure and process payments for the Services. Each provider is bound by a written agreement containing confidentiality and data protection obligations, and each provider's own policies govern the protection of data on its infrastructure.

We will maintain a current list of subprocessors at [tailkey.com/subprocessors] and will provide customers with at least 30 days' prior notice before engaging a new subprocessor that processes Customer Data, during which period customers may object to such engagement.

We may also disclose information to our professional advisers; to governmental or regulatory authorities where required by law (in which case we will notify the affected customer unless legally prohibited from doing so); or to a successor entity in connection with a merger, acquisition or sale of assets, provided that such information remains subject to this Policy.

8. International Data Transfers

Tailkey is located in Japan, and our Google Cloud resources are hosted in [region, e.g. asia-northeast1 (Tokyo) or a customer-selected region]. Customers using the BigQuery connection retain raw GA4 data in the region of their own Google Cloud project. Our personnel and contractors located in Japan and Bangladesh may access data remotely for the purposes of providing support and operating the Services, subject to confidentiality agreements and access controls.

Where personal information is transferred across national borders, we implement appropriate safeguards. For transfers from the European Economic Area ("EEA") and the United Kingdom, such safeguards include the European Commission's adequacy decision with respect to Japan and, where required, the Standard Contractual Clauses and the UK International Data Transfer Addendum. For transfers from Japan, we take the measures required by the APPI for the provision of personal information to third parties in foreign countries. The transfer mechanisms relied upon by our service providers are described in the policies referenced in Section 7.

9. Data Retention and Deletion

We retain information only for as long as necessary to fulfil the purposes described in this Policy, as set out below.

You may delete individual uploads, datasets or segments at any time, disconnect your BigQuery project, or request deletion of your entire account. Customers may request an export of their model outputs prior to account closure.

10. Security

We implement technical and organizational measures appropriate to the sensitivity of the data we process, and we rely on the certified infrastructure of our service providers for physical and network security. These measures include the following:

• Encryption. Data is encrypted in transit using TLS 1.2 or higher and at rest using Google Cloud's default AES-256 encryption (Google Cloud encryption at rest).

• Tenant isolation. Each customer's data and outputs are logically segregated, and access is enforced through Firebase Authentication custom claims and Firestore and Cloud Storage security rules.

• Access control. BigQuery access is read-only and limited to the datasets that the customer authorizes. Personnel access to production systems requires individual accounts with multi-factor authentication, is granted on a least-privilege basis, is logged and is reviewed quarterly. Access is revoked within 24 hours of a change in role or termination of engagement.

• Logging and monitoring. We maintain audit logs of administrative and data access activity through Google Cloud Audit Logs and generate alerts in response to anomalous activity.

• Change management. All code changes are peer-reviewed and tested prior to release, and production deployments are restricted to authorized personnel.

• Resilience. Data is backed up and restorable, and we maintain a documented recovery procedure with a target recovery time of 24 hours.

• People. All personnel with access to Customer Data are bound by confidentiality obligations, complete security and privacy training upon onboarding and annually thereafter, and are subject to background checks where permitted by local law.

• Vendor management. We select service providers that maintain independent security attestations, review them annually, and bind them to written data protection terms. Google Cloud (compliance), Stripe (security) and Cloudflare (compliance) each publish SOC 2 or equivalent reports. Payment card data is processed exclusively by Stripe, a PCI DSS Level 1 certified service provider, and Stripe webhooks are signature-verified before being acted upon by our Cloud Functions.

• Network protection. Cloudflare provides distributed denial-of-service (DDoS) mitigation, a web application firewall and bot management.

• Account security. We support multi-factor authentication for members and permit account administrators to revoke seats immediately.

• Policies and review. Our security and privacy policies are maintained by a designated security lead, reviewed at least annually, and tested through annual incident response exercises.

Security Incidents and Data Breaches

We maintain a written incident response plan, which we implement whenever we suspect any unauthorized access to, or loss, alteration or disclosure of, personal information. Our response includes the following steps:

1. Contain. We take immediate action to contain the incident, including, as appropriate, by revoking credentials, isolating affected systems or disconnecting integrations.

2. Investigate. We determine the nature and scope of the incident, the data and customers affected, and the risk to individuals, and we preserve relevant evidence.

3. Notify customers. We notify affected customers without undue delay, and in any event no later than 72 hours after confirming a breach affecting their Customer Data. Such notice will describe the nature of the breach, the categories of data involved, the likely consequences, the measures taken and any recommended actions, and we will provide updates as further information becomes available.

4. Notify regulators and individuals. Where Tailkey acts as a controller, we notify Japan's Personal Information Protection Commission, the competent supervisory authorities in the EEA or the United Kingdom, the Office of the Privacy Commissioner of Canada and any other competent authority within the period required by applicable law, and we notify affected individuals where required. Where Tailkey acts as a processor, we provide customers with the information reasonably necessary for them to fulfil their own notification obligations.

5. Recover and improve. We restore affected services, remediate the root cause and document lessons learned.

We will not delay any required notification for the purpose of protecting Tailkey's reputation. Notices will be sent to the email address of the account owner and posted within the Services.

To report a security vulnerability or suspected incident, please contact [security@tailkey.com]. We will acknowledge reports within 2 business days and will not initiate legal action against good-faith security research conducted in accordance with our disclosure guidelines.

11. Your Rights

Wherever you live, you always have the right to access, correct, delete and obtain a copy of your personal information; to restrict or object to its processing; to withdraw your consent; and to opt out of marketing communications. To exercise these rights, please contact support@tailkey.com. We will respond within 30 days, or within any shorter period required by applicable law. We will verify your identity before fulfilling a request and will not discriminate against you for exercising your rights. Depending on your jurisdiction, you may also have the following additional rights:

• Japan (APPI). You may request the disclosure, correction, suspension of use or deletion of your retained personal data, and the disclosure of records relating to its provision to third parties.

• EEA and UK (GDPR / UK GDPR). You also have the right to lodge a complaint with the data protection supervisory authority in your jurisdiction.

• California and other US states. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use or disclose sensitive personal information for the purpose of inferring characteristics about consumers.

• Canada (PIPEDA and provincial laws). You may access and request correction of your personal information, and you may file a complaint with the Office of the Privacy Commissioner of Canada.

Browser privacy signals. Where required by applicable law, we treat Global Privacy Control ("GPC") signals as a valid request to opt out of non-essential cookies and of any sale or sharing of personal information. As no uniform standard for Do Not Track ("DNT") signals has been adopted, we treat DNT signals in the same manner as GPC signals [confirm].

Requests about Customer Data. Where your personal information was provided to Tailkey by one of our customers, that customer is the controller of such information. We will refer any request we receive to the relevant customer and will assist that customer in responding.

12. Children, Changes to this Policy and Contact Information

Children. The Services are intended for businesses and are not directed to individuals under the age of 16. We do not knowingly collect personal information from children, and customers must not submit to the Services any data that they know relates to children.

Changes. We may update this Policy from time to time and will post any updates on this page with a revised effective date. We will notify account owners by email of any material changes at least 30 days before such changes take effect.

Contact. Tailkey G.K., Fuji Building 40, 15-14 Sakuragaokacho, Shibuya-ku, Tokyo 150-0031, Japan (〒150-0031 東京都渋谷区桜丘町15-14 フジビル40). Privacy inquiries and general support: support@tailkey.com.

Sources

Third-party policies are linked where cited above. Links were drafted without live lookup and must be opened and confirmed before publishing.