Privacy Policy

The controller for the processing described here is:

This policy covers tardesk.com, the Taresy account (sign-up and login at sso.taresy.com), the Tardesk app (op.taresy.com and the other Tardesk addresses we run for companies) and the online stores hosted with Tardesk (name.taresy.com or a store's own domain). Our company website taresy.com and KOS24 have their own privacy policies.

• No cookies, no analytics. The website sets no cookies, stores nothing in your browser and uses no tracking or analytics tools.
• Server. Like every website, our server receives your IP address and browser information to deliver the page. We don't keep access logs for tardesk.com.
• Fonts. The fonts are loaded from Google Fonts, so your browser connects to Google, which receives your IP address. See Google's privacy policy.
• Contact form. The form does not send anything to our server. It opens your own email app with your message filled in; nothing is sent until you press send there. We then receive your email like any other email and use it only to answer you.

When you sign up we store: your name, email address, password (only as a secure hash, we can't read it), company name, company address and phone (if you give them), country, currency and language. From this we create your user and your company workspace in Tardesk.

What you put into Tardesk (clients, quotes, invoices, expenses, receipts, vehicles, work orders, products, orders, files, emails, notes and so on) is stored so that Tardesk can show it to you and your team. We don't use it for anything else.

Login records. For every login we store the time, whether it worked, your IP address, your browser, operating system and device type. To show a country flag next to each session, we send the IP address to ip-api.com, which returns the country. You can see and end your own sessions under your profile, "Sessions". We use these records for security (spotting suspicious logins) and support.

Last seen. While you use Tardesk we store when you were last active, your IP address and an approximate location (city, region and country) that ip-api.com works out from the IP address. Only the latest value is kept. Your company's administrators and ours can see it, for example to spot a login from an unexpected place.

Usage statistics. While you are logged in we record which pages you open and which buttons or links you click (the button text and where it leads), with the time and device type (computer, phone, tablet or app). We never record what you type into forms, and we don't record anything in the personal time-tracking area or during support sessions. These statistics are linked to your user account and are visible to the Taresy administrators. We use them to see which features are used, where people get stuck and what to improve. They are not shared with anyone.

Change history. For records such as invoices, quotes, clients and contracts, Tardesk notes who created or changed them and when, so your team can follow what happened.

Push notifications (only if you allow them): your browser gives us a technical address for notifications, which we store with your browser type. Notifications are delivered through your browser maker's push service (for example Google, Apple or Mozilla).

Face ID / fingerprint login (only if you turn it on): your fingerprint or face never leaves your device. We store only a public key that your device creates.

Your signature (only if you save one in the PDF editor) is kept in your own browser, not on our server.

Emails you send from Tardesk (invoices, quotes, reminders, order emails and the automatic service or appointment reminders a workshop can turn on) go out through the email account you or your company owner set up, or through our own mail server if none is set up. The recipient's address and the content are processed for that.

Mailbox (only if you connect an email account): Tardesk fetches the emails in your inbox over IMAP and stores them so you can read and answer them in Tardesk.

Vehicle lookups. When you look up a vehicle by its VIN, Tardesk sends only the VIN to auto.dev and to the US road-safety authority NHTSA to fill in make, model and year.

Website enquiries. If your company connects its website's contact form to Tardesk, enquiries (name, contact details, message and any photos) arrive in Tardesk.

Google Search Console (only for companies that connect it in the SEO module): Tardesk fetches your website's search statistics from Google.

Companies use Tardesk to manage data about their own customers, suppliers and employees, for example contact details, vehicles, invoices and, in the workshop module, employee records such as payslips, working hours, holidays and sick leave. For this data the company is the controller and we are its processor: we store and process it only to run Tardesk for that company and on its instructions.

The company is responsible for having a legal basis for this data and for informing the people concerned. This matters especially for sensitive data such as sick-leave records, which the law protects more strongly. If you are a customer or employee of a company that uses Tardesk, please contact that company first; you can also write to us.

Each store is run by its owner, a business that uses Tardesk. As in section 5, the store owner is the controller for the data of the store's customers and we are the processor.

When you buy from a store, the store receives your name, email, phone, delivery address, your note and the order itself. You get an order confirmation by email with a private link to your order status.

Card payments go through the store's own Paysera account. We pass Paysera the order number, amount, your name and your email; you enter your card details on Paysera's page, never on ours, and we never see them. Paysera's own privacy policy applies to that payment.

Store statistics. To show the owner how many people visit, we count page and product views with a random visitor ID kept in a cookie. We store the page, product, the website you came from (only its domain), the device type and the time. We don't store your IP address with these statistics, and there are no third-party tracking scripts on stores. This data is deleted automatically after 180 days.

Fonts and videos chosen by the store. If a store owner picks a Google font for the store's design or embeds a YouTube or Vimeo video, your browser loads it from Google, YouTube (in its privacy-enhanced mode) or Vimeo, which then receive your IP address.

The tardesk.com website uses none. The Tardesk app and the stores use only these, all set by us, none for advertising:

The app also keeps a few settings in your browser's local storage: whether the sidebar is collapsed, the preview device in the store editor and, if you save one, your signature for PDFs. They stay on your device until you clear them.

• You and your team. People in your company workspace see what their role allows. The company owner decides who is in the team.
• Taresy administrators. Our administrators can see accounts, plans, login records, last-seen information and usage statistics, and can open your account to help you ("log in as user"). We do this only for support, billing, security or when the law requires it. Support sessions are excluded from usage statistics.
• Service providers listed in section 9, only as far as needed for their task.
• Authorities, only when we are legally obliged to.

We never sell, rent or trade personal or business data, and we don't use it for advertising.

• Contabo GmbH (Munich, Germany) as our hosting provider. tardesk.com, the Taresy account, the Tardesk app, the stores and all their databases and files run on a server we rent from Contabo in a data centre in Germany, so this data is stored in the EU. We set up and manage the server ourselves; Contabo provides the hardware and network and processes the data only as our hosting provider.
• Paysera for card payments in stores that turn them on (section 6).
• auto.dev and NHTSA (USA) for vehicle lookups by VIN (section 4).
• ip-api.com to turn an IP address into an approximate location (section 3).
• Google: fonts on tardesk.com and in stores that use a Google font, and Search Console only for companies that connect it.
• YouTube and Vimeo for videos a store owner embeds (section 6).
• Content delivery networks: the Tardesk app and the stores load parts of their code (design framework, charts, PDF viewer and similar) from cdn.tailwindcss.com, cdn.jsdelivr.net, cdnjs.cloudflare.com and esm.sh. These services receive your IP address when the files load.
• Browser push services for notifications you allowed (section 3).
• Email providers: your own or your company's email provider for the mailbox and for emails sent from Tardesk, otherwise our own mail server (section 4).

Your data is stored in Germany (EU), which means it leaves Kosovo; the EU offers a high level of data protection under the GDPR. Some of the other providers above (auto.dev, NHTSA, Google, YouTube, Vimeo, the content delivery networks, browser push services, ip-api.com) may process data outside the EU, in particular in the USA. Where this is the case, the transfer is based on the provider's own data-protection safeguards.

• Account and business data (including mailbox emails and change history): as long as your account exists, unless you delete it earlier. When the account is closed we delete it, except for records the law requires us or you to keep (for example invoices).
• Store statistics: deleted automatically after 180 days.
• Last seen: only the latest value is kept; it is replaced the next time you are active.
• Login records and usage statistics: currently not deleted automatically. Administrators can delete usage statistics, and we delete both when an account is closed or when you ask us to.
• Emails to [email protected]: as long as needed to handle your request.

• Contract: to provide your account, Tardesk and your store, and to process orders in stores.
• Legitimate interest: login records, last-seen information and security, usage statistics to improve Tardesk, store statistics for store owners, answering messages.
• Consent: push notifications, Face ID / fingerprint login, connecting a mailbox or Google Search Console. You can withdraw consent at any time in your browser or profile.
• On behalf of companies: for the data described in sections 5 and 6, the company's own legal basis applies.
• Legal obligation: keeping records required by tax and commercial law.

Under Kosovo Law No. 06/L-082 on the Protection of Personal Data and, where it applies, the EU GDPR, you can ask us to:

• tell you what data we hold about you and give you a copy;
• correct wrong or incomplete data;
• delete your data or limit how we use it;
• give you your data in a machine-readable format;
• stop processing based on legitimate interest (for example usage statistics).

Write to [email protected]. We answer within 30 days. If you are a customer of a store or of a company that uses Tardesk, you can also contact them directly. You also have the right to complain to the Information and Privacy Agency of Kosovo or, in the EU, to your local data-protection authority.

Our websites, the app and the stores use encrypted HTTPS connections. Passwords are stored only as hashes, login cookies can't be read by scripts, and stores' Paysera keys are stored encrypted. The server is hosted in a data centre in Germany and access to it is limited to us. No system is completely secure; if a breach affects your data, we will inform you and the authorities as the law requires.

Tardesk is a tool for businesses and is not meant for people under 16.

When we change how we handle data, we update this page and the date at the top. For important changes we also inform account holders by email or inside Tardesk. See also our Terms of Service.