TailhedgeTailhedge.ai · Netherlands
Privacy Policy
Last updated: 25 September 2026
This policy explains how Tailhedge.ai handles personal data when you use the platform, contact us or appear in research drawn from public sources.
1. Who is responsible
Tailhedge.ai, based in the Netherlands, is responsible for the personal-data processing described here. Contact [email protected] or use our privacy request form for questions and rights requests. The platform is intended for adults; do not create an account or submit personal information if you are under 18.
2. Data we handle and where it comes from
- Account data: contact and sign-in information, authentication records, account identifiers and settings. If you choose an external sign-in provider, we receive the identity information needed for that sign-in.
- Workspace data: saved watchlists, simulated portfolios, alert rules, preferences and related events that you choose to create. Guest features may use browser storage; signed-in features can save records to your account.
- Payments: subscription status, transaction identifiers and billing records needed to administer a paid plan. Payment providers collect payment details through their own checkout; do not send card details through our contact form.
- Communications: your name, email, selected topic, subject, message and related correspondence when you contact us; newsletter preferences and verification records when you subscribe.
- Technical data: connection and request information, including IP addresses, device/browser information, cookie choices, security events and delivery records. To prevent abuse of the contact form, we keep short-lived records in a scrambled (hashed) form; hosting and security services may separately process request logs. To show Pro prices in the right currency, we use the country that our network provider estimates from your IP address. The Plans page uses this country unless you choose another one. When you start checkout, we send Stripe, our payment provider, the chosen country and whether it matches the estimate. Stripe keeps both with your order, and they help us check which country's VAT (value added tax) applies. We do not keep the estimate anywhere else.
- Research data about people: names, professional roles, disclosed transactions or holdings, dates, public statements and source references from regulatory filings, issuer releases, news, podcasts, public commentary and other lawfully available material. We may use permitted provider data or material supplied by a rights holder. Public availability does not remove privacy protections.
Do not submit sensitive personal data, confidential third-party records, passwords or identity documents through ordinary messages. A name match across companies or filings may be wrong and is not treated as verified identity merely because it appears in research.
3. Purposes and legal bases
| Purpose | Legal basis where the GDPR applies |
|---|---|
| Provide requested accounts, workspace features, subscriptions and service communications | Performance of a contract or steps you request before entering one |
| Answer enquiries, correct records, secure the platform and prevent misuse | Our legitimate interests in operating a reliable service, or contract/legal obligations where applicable; these interests must be balanced against your rights |
| Produce general research from lawfully available source material | Legitimate interests in informing research and analysing public financial activity, subject to necessity, proportionality and your rights |
| Optional newsletters, marketing choices, browser preferences and push permissions | Your consent where required, or another basis only where applicable law permits it |
| Tax, accounting, compliance and responding to lawful requests | Compliance with legal obligations |
| Resolve disputes and establish or defend claims | Legitimate interests and applicable legal obligations |
Consent is not required merely to send a support question. The contact form does not enrol you in marketing. You can withdraw an optional consent without affecting the lawfulness of earlier processing. Contact us to ask about the balancing of a legitimate interest.
4. AI and automated research
AI and automated calculations help summarise sources, classify information, match records and generate research text and scores. Source material can contain personal data. Outputs may be incomplete, biased, out of date or incorrect, including invented details and mistaken identity matches. Report an issue using the correction or privacy route above.
Research outputs do not execute trades or determine your access to credit, insurance or employment. Messages from the contact form go to our support mailbox, not to a generative-AI service. Account permissions and alert matching are automated product functions. If you believe an automated process has had a legally significant effect on you, contact us to request information and any review or safeguards available under applicable law.
6. International processing
Our service and its providers may process information in the European Economic Area and other countries. Where the GDPR requires safeguards for a transfer outside the EEA, an applicable adequacy decision or another lawful transfer mechanism, such as standard contractual clauses with necessary supplementary safeguards, must cover it. Contact [email protected] for information about recipients, destinations and the safeguards relevant to your data. This policy is not a substitute for those arrangements.
7. Retention and security
We keep personal data only as long as needed for its purpose, applicable record-keeping duties and the establishment or defence of legal claims. Relevant factors include whether your account remains active, whether an enquiry or dispute is unresolved, the period covered by a public research record, withdrawal of a subscription or consent, and required accounting periods. These factors can differ across records; account deletion does not necessarily require deletion of invoices or a lawfully retained source record.
The records we keep to prevent abuse of the contact form are deleted within 15 minutes. Contact form messages reach our support mailbox and are kept only as long as needed to handle your request. Once a message is delivered, the copy waiting to be sent is deleted; if delivery fails, we may keep that copy while we retry or look into the problem. Deleting a page cannot immediately erase every backup or a third-party copy.
We use access controls and technical safeguards appropriate to the service. No internet service, storage system or email channel is entirely secure. Tell support promptly if you suspect unauthorised access, and do not send secrets in ordinary email.
Optional website analytics
When you allow analytics, Microsoft Clarity measures clicks, scrolling and time spent on parts of pages. It produces heatmaps and masked session recordings. Google Analytics, when enabled, measures page visits, engagement and navigation paths. These providers receive device, browser and connection information. We use the reports to improve Tailhedge. Analytics scripts do not load before you allow them. Browser preferences and analytics are separate choices.
We mask page text for Clarity and do not deliberately send account identifiers, form entries or portfolio values in analytics events. Clarity recording is disabled on private account and portfolio routes, contact and workspace pages, and URLs containing query parameters. After visiting one of these pages, recording stays off until a full page load. Google Analytics records private page categories only, without account or portfolio details. Advertising consent and Google signals are disabled.
You can withdraw consent in Cookie settings. We clear accessible first-party analytics cookies and reload the page to stop the scripts. Withdrawal does not erase data already processed by a provider. Microsoft and Google may process data outside your country; their privacy notices explain their practices and safeguards. Read the Microsoft Privacy Statement and Google Privacy Policy.
9. Your rights and removal requests
Where applicable, you can request access, correction, erasure, restriction or portability of your personal data; object to processing based on legitimate interests; withdraw consent; and request safeguards for qualifying automated decisions. You can object to direct marketing at any time. These rights depend on the applicable conditions and exceptions.
To request review of any displayed data, use the data correction or removal form or email [email protected]. Identify the page and record, explain the issue and state the action you seek. A request can cover inaccurate data, a mistaken identity match, outdated information, privacy, copyright or another rights concern. We may need proportionate verification of identity or authority. Do not send a copy of your identity document without first agreeing a suitable method with us.
For GDPR rights requests we normally respond within one month. Where the law permits an extension because of complexity or the number of requests, we will explain it within that first month. Requests are generally free; the GDPR’s limited exceptions for manifestly unfounded or excessive requests remain applicable. If we decline a request, we explain the grounds and available complaint rights.
You may ask for removal of any data, but erasure is not absolute. Legal retention duties, freedom of expression and information, public-interest grounds or legal claims may justify retaining some material. We can consider restricting display or correcting it instead. We do not control the original publisher, public registries or copies held elsewhere.
You can complain to the Dutch Autoriteit Persoonsgegevens or the competent data-protection authority where you live or work or where an alleged infringement occurred. You need not contact us first to exercise that right.
10. Changes and contact
We update this policy when our practices or obligations change and provide additional notice where required. The date above identifies the current wording. For questions, contact [email protected]. Working hours are Monday–Friday, 09:00–17:00 UTC; legal response deadlines are unaffected by those hours.