Last updated 7 August 2026
This policy explains how Tarn.hr collects, uses, stores and protects your personal data, in line with the UK GDPR and the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025). It applies to anyone who uses the Tarn.hr website or app.
Tarn.hr is operated by Tarn.hr Ltd, a company registered in Scotland (company number SC898414) (“Tarn.hr”, “we”, “us” or “our”). We are the data controller for the personal data described in this policy. If you have a question about this policy or want to exercise any of the rights below, please get in touch via our contact form.
We collect the information you give us directly, and a small amount of information generated by using the service:
We use your information to:
We do not sell your personal data, and we do not use your scenario data to serve you advertising.
We rely mainly on the basis that processing is necessary to perform our contract with you (providing the Tarn.hr service you have signed up to). Where that does not apply, we rely on our legitimate interests in operating and improving a secure, reliable service, balanced against your rights, or on your consent, for example for optional marketing communications, which you can withdraw at any time.
Where a scenario involves special category data, such as health, pregnancy or disability details, we rely on the fact that you have chosen to provide that information for us to generate guidance on your behalf as our additional condition for processing it under UK GDPR Article 9, in addition to the basis above. We are confirming the precise scope of this condition with a solicitor and will update this section with the final wording.
We share personal data with a small number of service providers who process it on our behalf (our sub-processors), and only to the extent needed to run Tarn.hr:
We do not share your personal data with any other third party for their own marketing purposes, and we will only disclose it further where we are required to by law.
Because OpenAI is based in the United States, using Tarn.hr involves a transfer of the personal data in your scenario answers outside the UK. Where this happens, we rely on the UK’s recognised safeguards for international transfers, such as the UK International Data Transfer Addendum or equivalent standard contractual clauses with our processors. We keep this under review as our arrangements with our providers develop.
Sentry, our error monitoring provider, may also involve a transfer of technical data outside the UK depending on the hosting region we select when we switch it on; where that applies, we will put the same UK-recognised safeguards in place before enabling it.
We keep your account and scenario data for as long as your account is active, so that your scenario history remains available to you. If you delete your account, or ask us to, we will delete or anonymise your personal data within a reasonable period, except where we need to keep limited information for legal, tax or accounting purposes, or to resolve disputes.
Under UK data protection law, you have the right to:
To exercise any of these rights, please contact us via our contact form. We will normally respond within one month. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk, although we would welcome the chance to resolve any concern directly first.
We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls, and secure hosting with our providers. No system is completely secure, but we work to keep your information safe and to respond quickly if anything goes wrong.
Tarn.hr uses essential cookies to keep you signed in and to keep the service secure. Those are needed to run the site, so they do not require your consent. We do not use advertising cookies.
We also use PostHog, a product analytics tool, to understand how Tarn.hr is used so that we can improve it. PostHog sets non-essential analytics cookies, so we ask you first. On your first visit you are asked whether to allow analytics, neither answer is preselected, and nothing is set unless you choose to allow it. Your answer is kept in your browser’s local storage rather than in a cookie, so that we are not setting a cookie in order to record whether you want cookies.
You can change your mind at any time using the Cookies control in the footer of any page. Choosing no stops any further analytics and clears the identity PostHog had built up.
Tarn.hr is intended for use by adults in a professional or managerial capacity, and is not directed at, or intended for use by, children under 18.
Organisations that process personal data in the UK are generally required to pay the ICO’s data protection fee and register with the ICO, unless an exemption applies. We are registered with the ICO, registration reference 00015059173.
We may update this policy from time to time, for example as our service or our providers change. We will post the updated version here with a new “last updated” date, and if the changes are significant we will look for a more prominent way to let you know.
If you have any questions about this policy or how we handle your data, please get in touch via our contact form.