Draft. This text is not in force yet: it is waiting to be reviewed. The place marked in yellow is still to be filled in.
Privacy policy
What personal data tarcus collects, why, where it is kept and for how long, and what rights you have. The service is provided by TARCON OÜ.
Last changed 13 October 2026
Who we are
TARCON OÜ, registry code 16487228, address Meruski tn 10-4, 51017 Tartu, Estonia, e-mail info@tarcon.ee.
tarcus is building information software: 3D models, drawings, 360° photos, notes and maintenance work. It is used at app.tarcus.tech and in the tarcus iPhone app.
In two roles
When a company (the client) uses tarcus for its buildings, the client is the controller of the data about its users and buildings. We are the processor and handle that data only on the client's instructions, as the data processing agreement says.
We are the controller ourselves for data we keep for our own purposes: the client's contacts and billing, support requests, the software's security and error logs, and this website.
What tarcus keeps
- Account: name, e-mail address, a hash of the password (never the password itself), role in the organisation, chosen appearance (light or dark). The two-factor sign-in secret is kept encrypted and recovery codes as hashes.
- Sign-ins: sessions with the IP address and the browser's name, and browsers you asked to be remembered for 30 days.
- Activity history: who did what and when, for example uploaded a model or marked a note done.
- Content that names a person: notes and replies, work orders and their comments, the name and contact of whoever reports a fault, if they give them, and who uploaded a file.
- Photos: 360° photos and pictures of notes may show people. The iPhone app blurs faces before a picture is saved on the phone. Pictures uploaded any other way are kept as they were uploaded.
- Notifications: your notification settings, notifications sent, and your phone's token for iPhone notifications if you allowed them.
- Error reports: when the software fails, the error, the page, the browser's name and the signed-in user are recorded.
Building data (models, drawings, assets, work orders, budgets, documents) is the client's business data, not personal data, except where a person is named in it.
Why, and on what basis
- To provide the service to the client: sign-in, checking permissions, showing content to the right people, notifications. Basis: the contract with the client and the client's legitimate interest in organising its work.
- For security and to fix faults: sign-in and activity logs and error reports. Basis: the legitimate interest in keeping the service safe and working.
- For the client relationship and billing: contacts and invoices. Basis: the contract and accounting law.
We do not use the data for advertising, do not sell it and do not build profiles from it.
Where it is kept, and who sees it
All data is in the European Union. We use these providers (sub-processors):
| Company | What it does | Where |
|---|---|---|
| Railway Corporation (USA) | Servers and database | EU, Amsterdam (Netherlands) |
| Cloudflare, Inc. (USA) | File storage (models, photos, documents, backups) and tarcus.tech | EU |
| Elkdata OÜ (veebimajutus.ee), Estonia [check that the e-mails go through them] | Sending e-mails (invitations, password resets, notifications) | EU |
| Apple Inc. (USA) | iPhone notifications, only if allowed on the phone | Apple's service |
The European Commission's standard contractual clauses are in place with the US companies. People in your organisation see the data according to their role. TARCON can join a client's organisation to help; this is always written into the client's own activity history, and TARCON's account shows in the client's list of users.
For how long
| Data | Kept |
|---|---|
| Activity history | 365 days |
| Error reports | 30 days |
| Notifications | 92 days |
| Sessions, invitations, password resets | until they expire |
| Deleted files | 30 days, so an administrator can put them back |
| Nightly backups (encrypted) | 14 nights |
| Account and content | until the client deletes them or the contract ends |
| Invoices | 7 years (accounting law) |
When a client ends the contract, the organisation is closed and its data deleted 30 days later. It leaves the backups within the next 14 nights.
Your rights
- Get a copy of your data: Account → My data → Download my data.
- Correct your name: Account.
- Have your account erased: ask your organisation's administrator, or us. The activity history stays but no longer says it was you.
- Restrict processing or object to it.
- Complain to the Estonian Data Protection Inspectorate (aki.ee).
If you use tarcus through your employer, ask them first: they decide about your data. You can also write to us: info@tarcon.ee. We answer within a month.
Cookies
tarcus uses only strictly necessary cookies: the sign-in cookie, and a cookie that remembers your browser for 30 days if you ask it to. Your preferences, such as light or dark appearance, are kept in the browser's storage. There is no analytics and no advertising. The website tarcus.tech uses no cookies.
Security
Passwords are hashed, connections are encrypted (HTTPS), administrators sign in with two factors, backups are encrypted and each organisation's data is kept apart from every other's. We tell the client of a breach, and the Data Protection Inspectorate where required, within 72 hours.
Changes
If we change this policy in a way that matters, we tell clients at least 30 days ahead.