Privacy Policy

Effective 10 September 2026 · Updated 28 October 2026

This Policy explains how Tarlara Digital Ltd uses personal data when people visit our websites, create or use an account, communicate with us or use our services.

1. Who we are

Company: Tarlara Digital Ltd
Company number: 17390332
Registered office: 82a James Carter Road, Mildenhall, England, IP28 7DE
Email: support@tarlaradigital.com
Privacy enquiries: privacy@tarlaradigital.com

Tarlara is the Controller for personal data used to manage accounts, subscriptions, security, support and our own business. A business customer is normally the Controller for personal data it places in the Service, and Tarlara normally acts as its Processor under the Data Processing Agreement.

For Tarlara Home and Tarlara Home+, Tarlara is the Controller for Home customer data — the account and the information, records, files and photos placed in a Home — whether the Home is used by an individual or by a business. The Data Processing Agreement does not apply to it. A business user that records information about other people, such as tenants, guests or contractors, remains responsible for having the right to do so.

The same applies to Tarlara Premises: Tarlara is the Controller for Premises customer data — the account and the information, records and documents placed in a Premises business — and the Data Processing Agreement does not apply to it. A business that records information about other people, such as staff, contractors or its landlord, remains responsible for having the right to do so.

2. Personal data we collect

Depending on the interaction, we may collect:

account information, including name, email address, organisation, role, account identifier, status and permissions;
subscription and transaction information, including plan, billing status, invoices, transaction references and limited billing details;
communications, support requests, feedback and incident reports;
technical and security information, including IP address, browser or device information, authentication events, timestamps, audit events and diagnostic information; and
personal data contained in information or documents that a Customer chooses to enter or upload.

For Tarlara Home, this includes:

information about the home or property, such as its address and rooms;
Things (appliances, systems and other assets) and their details;
documents, receipts and photos kept in the Vault;
checks, reminders, regular care and work records, including the trades used;
Assist (Lara) questions and answers;
billing identifiers, such as the payment provider’s customer and subscription references, and the plan and its status;
each person’s reminder-email preference; and
security and audit information about the account.

For Tarlara Premises, this includes:

the business name and the details of the people who use the account;
information about the premises, such as its address and the other details you add;
Things (equipment) and their details;
documents kept in the Vault;
reminders and walk-round check records;
Lara questions and answers; and
security and audit information about the account.

When paid Tarlara Premises subscriptions start, this will also include the business name and address, and any VAT number, given at checkout for the invoice, and billing identifiers.

Before a Tarlara Home photo is stored, hidden camera information in it — including any GPS location — is removed. The visible picture and its orientation are kept. iPhone HEIC photos remain supported and are stored in the same cleaned form.

When production payments are enabled, card details will be handled by the payment provider and are not intended to be stored by Tarlara.

3. Where the data comes from

We obtain personal data directly from individuals, their employer or organisation, account administrators, use of the Service, communications with us, operational and security systems, payment and service providers, and public sources where appropriate.

4. How and why we use personal data

Purpose	Lawful basis
Provide and administer a subscription purchased by an individual, including a sole trader	Contract, or steps requested before entering a contract
Provide Tarlara Home: its records, files, photos, reminders and reminder emails, Assist and Download my Home	Contract, or steps requested before entering a contract
Provide Tarlara Premises: its records, documents, reminders, walk-round check, Assist, Lara and Download my premises records	Contract, or steps requested before entering a contract
Manage organisational accounts, authorised users and support	Legitimate interests in providing and supporting the Service
Process billing and maintain transaction records	Contract where applicable; legal obligation for required accounting records
Protect accounts, prevent fraud, investigate faults and maintain reliability	Legitimate interests in operating a secure and reliable Service
Improve the Service using proportionate usage and diagnostic information	Legitimate interests in understanding and improving our products
Send marketing about Tarlara products and services	Consent where required; otherwise legitimate interests where lawful
Meet legal duties and respond to lawful requests	Legal obligation
Establish, exercise or defend legal claims	Legitimate interests in protecting our legal rights

Where we rely on legitimate interests, we consider the effect on individuals and balance those interests against their rights. Where we rely on consent, it can be withdrawn at any time without affecting earlier lawful processing.

Where we process Customer Data for a Customer, we act on that Customer’s instructions. The Customer determines the purpose and lawful basis for that processing.

5. Artificial intelligence

Some features use the OpenAI API to generate summaries, classifications, suggestions or other requested output. We limit information sent for this purpose where reasonably practicable.

In Tarlara Home, information is sent to the OpenAI API only for the request being made:

Assist (Ask Lara): your question, with the relevant records of the Home you are looking at and any relevant pages of a manual;
finding a manual: the make, model and type of the Thing, which the OpenAI API uses to search the web for the maker’s manual (the manual’s pages are then read without AI and are not kept);
Smart Capture: a label or receipt is read on your device first; only if the device cannot read it is the label photo, or the text read from the receipt (never the receipt file), sent; and
suggesting a type for a Thing: its make and model.

Assist questions and answers are kept with the Home, so you can see them again, until the Home is deleted. Records of AI usage are kept as set out in section 8.

In Tarlara Premises, when you ask Lara a question, your question and the relevant records of the Premises business you are looking at are sent to the OpenAI API for that request.

Tarlara does not opt in to provider model training and does not use Customer Data to train general-purpose AI models. AI provider and transfer information is summarised in the Supplier and Subprocessor Schedule.

Tarlara does not intend AI features to make decisions based solely on automated processing that produce legal or similarly significant effects about individuals.

6. Sharing personal data

We share personal data with service providers where necessary to operate, secure and support Tarlara, including providers of hosting, databases, storage, artificial intelligence, payments, communications, security and backups. Relevant providers are listed in the Supplier and Subprocessor Schedule.

Address search. Where Tarlara Home or Tarlara Premises offers a “Find your address” box, it suggests matching UK addresses as you type, using Google Maps Platform. What you type into the box (and, in Tarlara Premises, a business name) is sent from our servers to Google, together with a reference that links the steps of one search. Your name, email address and account details are not sent. Google uses this information as an independent controller under its own terms, not as our processor, and its use is subject to the Google Privacy Policy. We keep only the address you choose to save, not what you typed, and our logs record only whether a search worked. You do not have to use the box: you can type the address into the fields below it.

We may also disclose personal data where required by law, to regulators or competent authorities, to protect legal rights or security, or in connection with a business sale or reorganisation subject to appropriate safeguards. We do not sell personal data.

7. International transfers

Some providers may process personal data outside the United Kingdom. Where a restricted transfer occurs, we use a lawful transfer mechanism. Depending on the recipient, this may be UK adequacy regulations or contractual protections based on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

The Supplier and Subprocessor Schedule gives the current known transfer position. Copies of, or further information about, applicable safeguards can be requested from privacy@tarlaradigital.com.

8. Retention

We retain personal data only for as long as necessary for the relevant purpose and for legal, accounting, security and dispute-resolution requirements.

for Tarlara Estate and Tarlara Rural, organisation deletion remains pending for 30 days before finalisation;
for Tarlara Home, when a subscription ends the Home, its records, files and photos, and its sign-in (unless used for another Tarlara product) are deleted on the next scheduled deletion run, with no further grace or recovery period. When your subscription ends, your Home data will be deleted. Download anything you want to keep before then;
for Tarlara Premises, the same as Tarlara Home: when a subscription ends the Premises business, its records, files and photos, and its sign-in (unless used for another Tarlara product) are deleted on the next scheduled deletion run, with no further grace or recovery period. When your subscription ends, your Premises data will be deleted. Download anything you want to keep before then;
for every Tarlara product, our own backup copies are deleted automatically within 30 days of being made, and the managed backups our database provider keeps of the database are deleted after 7 days;
application notifications are retained for up to 180 days;
AI usage records containing user identifiers are retained for up to 12 months; and
billing, security, audit and legal records are retained for the period reasonably required by applicable law, security needs or potential claims.

Data deleted from the live Service may therefore remain in backup copies until they are deleted: for up to 30 days after it was last backed up in our own backups, and for up to 7 days in our database provider’s. While it remains there it is put beyond ordinary use: it is not used for ordinary processing or made available in the Service. If we ever restore from a backup, we apply deletions again before the restored data is used, so an organisation, Home or Premises business that has been deleted is never brought back.

After a Tarlara Home is deleted we keep only a minimal record: a deletion certificate holding no name or content, the billing and tax records the law requires, and email delivery records from which the recipient, subject, content and Home name have been removed. Our payment provider, Stripe, keeps its own customer and payment records separately; they are not part of the Home and are not deleted with it.

9. Cookies and similar technologies

Tarlara uses cookies or similar technologies where necessary for security, authentication, session management and essential functionality. If we introduce non-essential analytics, advertising or similar technologies, we will provide information and obtain consent where required.

10. Marketing

We may send relevant information about Tarlara products or services where permitted by law. We obtain consent where required and provide a clear way to unsubscribe. Service, security and billing messages are not marketing. Tarlara Home reminder emails (“Email me when something in my home is due”) are part of the service and are set per person: each person can turn them off in More → Settings → Notifications.

11. Security

We use appropriate technical and organisational measures designed to protect personal data, including access controls, organisation separation, authentication, private storage, encryption in transit and at rest, logging, encrypted backups and incident procedures.

Stored data, every product. Our database and file-storage providers encrypt the data they store at rest, with keys they manage.
Files in Tarlara Home, Tarlara Home+ and Tarlara Premises. Each uploaded file and photo also has an additional layer of encryption, applied by our service with its own key before it is stored. Those keys are protected by a key that our database and storage provider does not hold. Our service decrypts a file when someone allowed to see it opens or downloads it, when you download your records, and when Lara reads a manual you kept. This is not end-to-end encryption.
Files in Tarlara Estate and Tarlara Rural. These do not currently have that additional layer. They are protected by our providers’ encryption at rest and by our access controls.
Backups, every product. Backup copies made since 25 October 2026 are encrypted before they are stored, with a recovery key that Tarlara keeps offline and our storage providers do not hold. Copies made before then were not encrypted in this way; like every backup copy, they are deleted within 30 days of being made.

No internet-connected service can guarantee absolute security.

12. Your rights

Depending on the circumstances, you may have rights to access, correct or erase personal data; restrict processing; receive portable data; withdraw consent; and exercise rights relating to certain automated decisions. Legal conditions and exemptions may apply.

In Tarlara Home you can download your records and files yourself at any time, using Download my Home under More → Settings → Privacy & data. In Tarlara Premises you can do the same using Download my premises records under More → Settings → Privacy & data.

13. Your right to object

You may object to processing based on legitimate interests. You have an absolute right to object to the use of your personal data for direct marketing. Contact privacy@tarlaradigital.com or use the unsubscribe method in a marketing message.

Where Tarlara processes information only for a Customer, we may refer the request to that Customer as Controller. We normally respond to valid requests within one month, subject to extensions permitted by law.

14. Complaints

Please contact privacy@tarlaradigital.com if you have concerns. You may also complain to the Information Commissioner’s Office through ico.org.uk or by telephone on 0303 123 1113.

15. Children

The Service is intended for business and professional use, and Tarlara Home for adults managing their own homes or property. It is not directed at children. We do not knowingly offer accounts directly to children.

16. Changes and contact

We may update this Policy when our Service, providers, processing or legal obligations change. The current version and effective date will be published through our website or Service, with appropriate notice of material changes where required.

For privacy questions or rights requests, contact privacy@tarlaradigital.com or write to Tarlara Digital Ltd at the registered office shown above.