Privacy

Takibi is operated by Deian Isac, a sole proprietor, at Calle Secretario Artiles 94, 103, 35007 Las Palmas de Gran Canaria, Spain. Contact support@takibibase.com for privacy questions or requests.

We are responsible for account, billing, security and service-administration information. When you put personal data into your workspace on behalf of your organisation, your organisation determines its purpose and we process it to provide the service. Contact us with questions about how we process workspace data.

• Account information: your name, email, password hash, verification and password-reset records, and sign-in sessions. Session records include creation and expiry times, browser information supplied by your device, and an IP address when available. We use these to authenticate requests, help you manage active sessions and protect your account.
• Workspace content: uploaded originals, converted text, searchable chunks, collections, folders, task context and artifact links.
• Agent configuration: Profiles, permission grants, key identifiers and credential-verification records.
• Requests and activity: questions, retrieval outcomes, usage counts and events needed to operate the workspace and investigate problems. Security and activity records can identify the user, agent credential or system performing an action, the organisation and resource affected, the action, its time and its outcome. These include records of access changes, exports, deletions and billing events.
• Chat and companions: chat messages and replies, the cards and document excerpts read to answer them, proposed and approved actions, companion settings and instructions, run records (status, timing, costs and tool-call details), the files a run works on and its results, and model keys and connected-app records you add. Model keys are stored encrypted.
• Billing and correspondence: subscription identifiers, billing status and communications you send us.

Only upload information you are authorised to use. A document hold or grant warning can help identify issues but is not a guarantee that sensitive information has been detected.

Takibi uses TypeSafe's Jev for judgments involved in questions, import organisation and content checks. Depending on the feature, a request can include your question, document excerpts or text, filenames and relevant context. Ordinary document listing and text search do not call Jev.

TypeSafe's customer agreement (opens in a new tab) restricts use of customer data for model training without prior consent. TypeSafe publishes a data-processing addendum (DPA) for its API. Its processing is not described as EU-only.

If you copy a consolidation prompt into an external agent, you choose that tool and share the included source text with it. That tool's own privacy terms apply. The same applies to services you link as task artifacts.

Chat. When you use Chat (Emi), your message, earlier messages in that conversation, the cards, document excerpts, collection names and identifiers Emi reads to answer it, and a fixed set of instructions with the current date are sent through OpenRouter to the provider that runs the model. Chat currently uses Xiaomi's MiMo model. OpenRouter chooses which provider serves it, and that provider can be outside the EEA. Chat does not search the web.

Companions. A companion is an AI agent that works on tasks you assign to it. For each run, the task, its instructions, the documents and cards its Profile may read, and its working files are processed on Takibi's companion service and in a temporary virtual machine created for that run. The model receives this context through OpenRouter, together with identifiers for the companion, run and task. For companion runs, Takibi asks OpenRouter to use only providers that do not train on or publish prompts (OpenRouter's data_collection: deny setting); OpenRouter and its providers apply that setting under their own policies.

Included models. Without your own key, requests use Takibi's OpenRouter account and the included models. That account sends Chat and companion requests only to providers that do not train on or publish your data (see OpenRouter's provider data policy settings (opens in a new tab)). Providers may keep requests for a short time under their own terms, for example to detect abuse. The default is Xiaomi's MiMo; OpenRouter chooses which provider serves it, and that provider can be outside the EEA. Anthropic's Claude Haiku is offered as the EU option for companions: for it, Takibi restricts OpenRouter to the Google Vertex (Europe) and Amazon Bedrock (eu-west-1, Ireland) endpoints, with no fallback to other providers. OpenRouter still handles those requests.

Your own key. If you add your own OpenRouter key, requests made with it are billed to and processed under your OpenRouter account. With your own key, OpenRouter handles routing and you're responsible for where your data goes. You can restrict providers and regions in your OpenRouter settings. Takibi does not apply the EU restriction to requests on your own key.

Web search. When you allow a companion to search the web or read web pages, its search queries and the page addresses it requests are sent to Exa, which returns results and page text. The companion writes those queries, so they can reflect the task it is working on.

Connected apps. Companions reach apps such as Google Docs, Sheets and Drive through Composio. You connect each app with your own account for it. Composio holds that connection and relays each tool call — its inputs and the app's answer — as Takibi's sub-processor. The app itself, for example Google, processes the data under your own account and agreement with it. Takibi offers companions only an allowlist of tools, and you can limit a connection to specific documents, folders or sites.

We use account and workspace information to deliver the service you request: sign you in, store and retrieve your documents, apply access rules and coordinate tasks. Contract performance is the basis for providing an individual's account; for organisational workspace content, we follow the customer's instructions.

We use service and security records for our legitimate interests in preventing abuse, diagnosing failures and maintaining the product. Applicable legal obligations may require us and our billing provider to retain transaction records. Where processing requires consent, we must obtain it before that processing starts.

You can change your password, manage two-factor authentication and review or revoke active sessions in Settings → Security. Sign-in uses necessary cookies on the app origin, app.takibibase.com. The marketing site links to the app and does not use those cookies to make authenticated API requests. The app can also remember display preferences on your device.

The app includes optional Rybbit analytics for page usage and selected product events. When enabled, events can include operational counts and identifiers supplied by the app. The marketing site loads the same Rybbit page-view tracking; its sample workspaces do not load that analytics integration. See the provider list for Rybbit's policies.

When you sign up from a link on this website, we record where the account came from: the page the link was on, the plan and companion role you picked, and any campaign tags in the link (utm_* and ref). We keep this with your organisation to learn which pages lead to signups, and add it to your checkout at Polar so it shows next to your subscription. Until you sign up, the app keeps it on your device for up to 30 days.

Hosting, AI processing, account email, billing, Chat and companions involve external providers. The sub-processor page names them and what they receive.

The hosted app runs on Sevalla (Kinsta): one replica, managed Postgres and object storage, served at app.takibibase.com. The backup bucket is configured in Western Europe. Sevalla's object storage and HTTP ingress run on Cloudflare infrastructure (Cloudflare R2), under Sevalla/Kinsta's terms. We update the provider list when hosting arrangements change. Account, support and production security-alert mail is sent with Resend from send.takibibase.com (Ireland, eu-west-1). Polar is merchant of record for paid plans and handles buyer and payment data as its own controller. TypeSafe processes Jev requests under its own terms. We do not describe the whole service as EU-only.

Chat and companions run on a separate Takibi service hosted on a Prized server, which stores chat history, companion settings and run records. Companion runs execute in temporary virtual machines from boat, which states that its sandboxes run in the EU. Model requests go through OpenRouter, web search through Exa and connected apps through Composio; OpenRouter and Exa are based in the United States. Tailscale carries encrypted connections to the companion service, including those from the Takibi API. The provider list describes what each one receives.

Workspace data is held so the service can provide your knowledge base and task history. You can download original files and export collections. Contact support@takibibase.com from your account email for an account or workspace-erasure request; cancelling billing does not by itself erase your data.

Deleting a document in the app is different from erasing every associated log, backup and provider record. Security and billing records can require separate retention. We do not promise a fixed-day deletion deadline across every provider.

Chat: the event records used to resume a live conversation are deleted after seven days. A conversation is kept while you use it and for at least 90 days after its last activity, and it is not removed while any of its actions or charges are unresolved. Companions: each run's virtual machine is deleted when the attempt ends, without disk snapshots. Working files of older runs are deleted once they are more than seven days old; the three most recent runs of each companion on a task are kept so it can continue its work, and connected-app answers stored with a run are deleted after seven days. When your organisation or its Emi profile is deleted, its chat data is deleted from the companion service. Run records (status, costs and tool-call details) have no fixed deletion period, and the results a companion writes to your tasks are part of your workspace content. Providers keep their own records under their own terms.

Where applicable, you can request access, correction, erasure, restriction, portability or object to processing. If processing is based on consent, you may withdraw it. We may need to verify your identity before acting on a request.

Contact support@takibibase.com. If your data is in a customer's workspace, we may need to refer the request to that customer or help them respond. You may also complain to your local data-protection authority, including Spain's Agencia Española de Protección de Datos (opens in a new tab).