This policy explains how Tarn.hr collects, uses, stores and protects your personal data, in line with the UK GDPR and the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025). It applies to anyone who uses the Tarn.hr website or app.
1. Who we are
Tarn.hr is operated by Tarn.hr Ltd, a company registered in Scotland (company number SC898414) (“Tarn.hr”, “we”, “us” or “our”). We are the data controller for the personal data described in this policy, with one exception: for information you enter about other people, such as an employee a situation concerns, your organisation is the controller and we process that information on its behalf, under section 6 of our Terms of Service. If you have a question about this policy or want to exercise any of the rights below, please get in touch via our contact form.
2. Information we collect
We collect the information you give us directly, and a small amount of information generated by using the service:
- Account information: your name, email address, and a securely hashed password (or the details from the provider you signed in with).
- Scenario information: the answers you give when working through a scenario, and the guidance and documents Tarn.hr generates for you. Because Tarn.hr is an HR guidance tool, this can include sensitive information about a workplace situation, and in some cases special category data such as health, pregnancy or disability details, if that information is relevant to the situation you describe. We only collect what you choose to enter.
- Names of other people: Tarn.hr never asks for the name of an employee or anyone else a situation concerns, and does not need one to produce your guidance. No question in any scenario asks for it, and the case reference is for a payroll number or a code of your own. Questions about health ask which kind of situation applies rather than for details. Please do not enter names.
- If a name is typed anyway: before anything you write about a situation, a case or a deadline, or type to Chloe, the assistant on our website, or Ollie, the help assistant in your account, is sent to our AI provider or saved, Tarn.hr checks it and replaces names, email addresses, phone numbers, National Insurance numbers, postcodes, street addresses and dates of birth with a label such as [person A]. It recognises common names and any name that follows a title, an initial or a role such as “my employee”. It cannot recognise every name, so it is a safeguard rather than a guarantee, and the form will point out anything it is unsure about so you can change it.
- Guidance emails: if you sign up on our blog, or tick the box under one of our free tools, to hear about new guidance, your email address. We add it to the list only once you confirm through the link we email to that address. It is used for nothing else, and you can ask to be taken off the list at any time through our contact form.
- When paid plans open: if you ask on our pricing page to be told when paid plans open, your email address. We keep it only once you confirm through the link we email to that address, we use it for that one email and nothing else, and we delete it once that email has been sent. It does not put you on the guidance emails. You can ask us to delete it sooner at any time through our contact form.
- The January 2027 checklist: if you ask for our January 2027 employer checklist by email, your email address and how many of its reminders we have sent you. We keep it only once you confirm through the link we email to that address. We use it to send you the checklist and up to five dated reminders, the last on 4th January 2027, and nothing else. It does not put you on the guidance emails. Every email has a link that stops them and deletes your address, and we delete it in any case once the last reminder has gone, and no later than 11th January 2027.
- Calculator results by email: if you ask for a result from one of our free calculators by email, the address you give and the figures or dates you entered. We use them only to work the result out again and send that one email, and we do not store them. Our email provider keeps its own record of emails it has sent.
- Billing information: if you take out a paid plan, our payment provider, Stripe, processes your payment details on our behalf. We do not see or store your full card details.
- Technical information: basic log and usage data (such as IP address, browser type and pages visited) collected automatically to keep the service secure and working properly, and the product analytics and error monitoring data described in section 10 below.
3. How we use your information
We use your information to:
- create and manage your account, and provide the service;
- generate the guidance and documents you ask for, which involves sending your scenario answers to OpenAI’s API (see “Who we share your information with” below);
- answer the questions you ask Chloe or Ollie, our help assistants. Your question is sent to OpenAI’s API with the name of the page you are on and, inside your account, your plan and how many situations you have used this month. Nothing from your cases, situations or documents is sent, and the conversation is not saved;
- process payments and manage your subscription;
- keep the service secure, prevent misuse, find and fix problems;
- respond to you when you contact us, and send you important service messages;
- send you new guidance by email, if you signed up for it;
- tell you when paid plans open, if you asked us to;
- send you the January 2027 checklist and its reminders, if you asked for them;
- send you a calculator result, if you asked for one by email;
- understand how Tarn.hr is used, so we can improve it. That means which features are used and how long things take, never what you wrote, and aggregated or anonymised wherever possible.
We do not sell your personal data, and we do not use your scenario data to serve you advertising.
4. Our legal basis for processing
We rely mainly on the basis that processing is necessary to perform our contract with you (providing the Tarn.hr service you have signed up to). Where that does not apply, we rely on our legitimate interests in operating a secure, reliable service and improving it from usage information, balanced against your rights, or on your consent, for example for optional marketing communications, which you can withdraw at any time.
We do not use what you enter about a situation, a case, a deadline or a policy for any purpose of our own. It is not used to improve Tarn.hr, it is not used to train any model, and it is not sent to our analytics or our error monitoring. It is used only to give you the guidance and documents you asked for.
5. Who we share your information with
We share personal data with a small number of service providers who process it on our behalf (our sub-processors), and only to the extent needed to run Tarn.hr:
- Supabase: provides our authentication and database infrastructure. Your account and scenario data is stored with Supabase in London, United Kingdom, as are the addresses on our launch and January 2027 checklist lists.
- OpenAI: processes the answers you give during a scenario and the questions you ask Chloe or Ollie, and generates the guidance, documents and answers Tarn.hr returns to you. OpenAI is based in the United States. Under OpenAI’s API terms, data sent through the API is not used to train their models. We only send OpenAI what is needed to generate your guidance; we do not send your name, email address or billing details. OpenAI keeps API data for up to 30 days to detect abuse, unless the law requires longer, and we have a data processing agreement with OpenAI.
- Stripe: processes payments and billing details on our behalf. We do not see or store your full card details.
- Vercel: hosts the Tarn.hr website and application, and counts visits to it with Vercel Web Analytics. For each page viewed this records the address of the page, the site you came from, your approximate location (country, region and city, worked out from the request), and the type of device, browser and operating system. It also counts a few actions on our pages, recording which action and nothing about you: clicks on the buttons in our articles that start a situation (which button and which situation), copying or downloading a letter template (which letter), asking to join the launch list, and watching the demo video on our home page (whether it started by itself or was started, how far it played, which part was chosen and whether it went full screen). It sets no cookies, and it tells one visit from another only by a code made from the request that is discarded after 24 hours, so it cannot be used to identify you or follow you across other websites.
- Sentry: error monitoring, which helps us find and fix bugs. Sentry processes technical error data such as stack traces, the page or request involved, and your IP address. It runs on Sentry’s European region, hosted in Germany, and it does not set any cookies.
- PostHog: product analytics, which helps us understand how Tarn.hr is used so we can improve it. PostHog is hosted on its EU servers, to keep this data in the UK/EU. It runs only if you have agreed to analytics cookies, and it is not loaded at all otherwise. See section 10 below.
- Resend: sends our emails, such as your welcome and renewal emails and the January 2027 checklist, and passes messages sent through our contact form to us, and sends calculator results you ask for. It processes your name, your email address, what you write in the form and the figures in a calculator result. Resend is based in the United States.
We do not share your personal data with any other third party for their own marketing purposes, and we will only disclose it further where we are required to by law.
6. International transfers
Because OpenAI is based in the United States, using Tarn.hr involves a transfer of the personal data in your scenario answers outside the UK. Where this happens, we rely on the UK’s recognised safeguards for international transfers. For OpenAI, our data processing agreement includes the EU standard contractual clauses with the UK Addendum issued by the Information Commissioner. We keep this under review as our arrangements with our providers develop.
Sentry, our error monitoring provider, runs on its European region, so the technical error data it holds is stored in Germany rather than the United States. PostHog runs on its EU host for the same reason. Both are United States companies, so we rely on the same UK-recognised safeguards with them as with our other providers. Resend, which sends our emails, is a United States company too, and its data processing agreement uses the same standard contractual clauses with the UK Addendum. Vercel, which hosts Tarn.hr, is a United States company as well. The application runs on its servers in London, but Vercel’s main processing facilities are in the United States, so the visit counts described in section 5, and other data Vercel holds as our host, may be processed there. Vercel’s data processing agreement uses the same standard contractual clauses with the UK Addendum.
7. How long we keep your information
We keep your account and scenario data for as long as your account is active, so that your scenario history remains available to you. If you delete your account, or ask us to, we will delete or anonymise your personal data within a reasonable period, except where we need to keep limited information for legal, tax or accounting purposes, or to resolve disputes.
If you asked to be told when paid plans open, we delete your address once that email has been sent.
If you asked for the January 2027 checklist, we delete your address when you stop the emails, once the last reminder has been sent to you, and in any case no later than 11th January 2027.
Vercel keeps the visit counts described in section 5 for at least twelve months, has not committed to a maximum, and deletes them when our contract with it ends.
8. Your rights
Under UK data protection law, you have the right to:
- be informed about how your data is used (this policy);
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, in certain circumstances (sometimes called the “right to be forgotten”);
- restrict or object to certain processing;
- receive a copy of your data in a portable format, or ask us to transmit it to another provider;
- withdraw consent at any time, where we rely on consent.
To exercise any of these rights, please contact us via our contact form. We will normally respond within one month.
If you are unhappy with how we have handled personal data, please tell us via our contact form, saying that it is a data protection complaint. We will acknowledge it within 30 days, look into it without undue delay, and tell you what we found and what we have done about it. You can also complain at any time to the Information Commission, the UK’s data protection regulator, which still calls itself the ICO, at ico.org.uk.
9. Keeping your information secure
We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls, and secure hosting with our providers. No system is completely secure, but we work to keep your information safe and to respond quickly if anything goes wrong.
10. Cookies
Tarn.hr uses essential cookies to keep you signed in and to keep the service secure. Those are needed to run the site, so they do not require your consent. We do not use advertising cookies.
We also use PostHog, a product analytics tool, to understand how Tarn.hr is used so that we can improve it. PostHog sets non-essential analytics cookies, so we ask you first. On your first visit you are asked whether to allow analytics, neither answer is preselected, and nothing is set unless you choose to allow it. Your answer is kept in your browser’s local storage rather than in a cookie, so that we are not setting a cookie in order to record whether you want cookies.
You can change your mind at any time using the Cookies control in the footer of any page. Choosing no stops any further analytics and clears the identity PostHog had built up.
11. Children
Tarn.hr is intended for use by adults in a professional or managerial capacity, and is not directed at, or intended for use by, children under 18.
12. ICO registration
Organisations that process personal data in the UK are generally required to pay the ICO’s data protection fee and register with the ICO, unless an exemption applies. We are registered with the ICO, registration reference ZC217056.
13. Changes to this policy
We may update this policy from time to time, for example as our service or our providers change. We will post the updated version here with a new “last updated” date, and if the changes are significant we will look for a more prominent way to let you know.
14. Contact us
If you have any questions about this policy or how we handle your data, please get in touch via our contact form.