Privacy policy.

Last updated 25 August 2026

TIDORA OÜ (registry code 17222130, Tornimäe tn 5, 10145 Tallinn, Estonia) is the controller of personal data processed through this website. You can reach us at info@tidora.io. We have not appointed a data protection officer, as we are not required to.

What we collect, and on what basis

What you send us. Name, email address and message content, submitted through the booking link or by email. The legal basis is Art. 6(1)(b) GDPR — steps taken at your request before entering into a contract — and, where your message is not about engaging us, our legitimate interest in replying to it under Art. 6(1)(f).

Our own visit logs. The page requested, time, approximate city-level location, network operator, browser type and language, and the referring site. Legal basis: our legitimate interest under Art. 6(1)(f) in understanding interest in our services and protecting the site. These use no cookies and no advertising identifiers and contain no full IP addresses. Brief notifications derived from them (the page opened, and the country) reach our team via Slack.

Analytics, only if you consent. On our private proposal pages, our own measurement includes mouse-movement heatmaps and a session replay of page interaction. We are also evaluating PostHog (PostHog, Inc.), which measures the same things across the whole site, records an equivalent session replay, and sets its own cookies. Legal basis for all of it: your consent under Art. 6(1)(a).

PostHog also stores your approximate location — country and city — derived from your IP address. The IP address itself is discarded and is not stored. Text you type into any field is masked in your browser before anything is sent, so it never reaches either us or PostHog through a recording.

Automated analysis of session recordings

With the same analytics consent, PostHog runs two automated scanners over new session recordings. One classifies how a visitor engaged with a proposal page; the other scores how much friction a visit showed. Both are large language models operated by Google as PostHog’s sub-processor, and both read the recording — which, as above, contains no text you typed.

The output is a label or a score attached to a visit. It is used to decide what to improve on the site and, on proposal pages, how to follow up a conversation. No decision producing legal effects or similarly significant effects is made about anyone by automated means, and there is no automated decision-making within the meaning of Art. 22 GDPR. You can object to this processing, or withdraw analytics consent, at any time.

Who receives your data

We do not sell personal data and we do not run advertising trackers. We use these processors:

• PostHog, Inc. — analytics, heatmaps and session replay. Data is held on PostHog’s EU infrastructure in Frankfurt, Germany. Google acts as PostHog’s sub-processor for the automated analysis described above.
• Cloudflare, Inc. — hosting and delivery of the site. Traffic to the site passes through it.
• Slack Technologies — internal notifications derived from our own visit logs.

Transfers outside the EEA. Your data is stored in the European Union. PostHog, Inc., Cloudflare, Inc. and Slack are US-incorporated, so access from outside the EEA cannot be excluded; where it occurs it is covered by the European Commission’s standard contractual clauses under Art. 46(2)(c) GDPR, agreed in our data processing agreement with each of them.

How long we keep it

• What you send us — for as long as needed to deal with your inquiry and any engagement that follows it, then deleted.
• Our own visit logs and session replays — 3 months.
• PostHog session recordings — 90 days.
• PostHog analytics events — up to 7 years.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict how we process it;
• receive data you gave us in a portable form, and have it transmitted to another controller;
• object to processing based on our legitimate interest, including the visit logs and the automated analysis above;
• withdraw your consent at any time — withdrawal does not affect the lawfulness of processing carried out before it.

To exercise any of these, email info@tidora.io. It costs you nothing and we will respond within one month.

If you believe we are handling your data unlawfully, you can lodge a complaint with the Estonian supervisory authority, the Data Protection Inspectorate (Andmekaitse Inspektsioon), aki.ee.

Changes

We may update this page. The current version always lives here and the date above says when it last changed. PostHog is described as under evaluation; if we stop using it, this page will say so.