Privacy Policy
Operated by Mitchell Keith Sands (ABN 77 932 608 483), trading as Tallix Effective date: 1 September 2026 Last updated: 6 September 2026
1. Who we are
This Privacy Policy explains how Mitchell Keith Sands (ABN 77 932 608 483), a sole trader trading as Tallix ("we," "us," or "our"), collects, uses, stores, and protects personal information in connection with the Tallix platform, also referred to as the Meta Query Tool (the "Service"), accessible via tallixai.com and its associated application.
We are based in South Australia, Australia, and this policy is written to comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), and, because the Service is available to clients worldwide, to also reflect the principles of the EU/UK General Data Protection Regulation ("GDPR") for users located in those regions.
2. Information we collect
(a) Account and identity information. When you sign up, we collect your name, business/organisation name, and email address, via our authentication provider (currently Clerk). We do not directly store your account password.
(b) Meta advertising data. With your authorisation, we access and store your Meta (Facebook/Instagram) advertising data via scoped, read-only access to your Business Manager account — including campaign, ad set, ad, and performance/insights data. This data is primarily business/commercial data, though it may incidentally include personal information (for example, names or contact details appearing in ad creative, or aggregated audience characteristics).
(c) Usage and conversation data. We store your chat/conversation history with the Service, including the questions you ask and the answers generated, so that you can review past conversations and so the AI can maintain context across a conversation.
(d) Payment data. Payments are processed by Stripe. We do not store your full card details ourselves — Stripe collects and processes this information under its own privacy policy. We retain records of transactions (amount, date, plan) for invoicing (via Xero) and accounting purposes.
(e) Technical and website data. When you visit tallixai.com, we (or analytics/hosting providers acting for us) may automatically collect standard technical data such as IP address, browser type, device information, and pages visited, including via cookies — see Section 8.
(f) Communications. If you contact us for support or otherwise, we keep a record of that correspondence.
We do not knowingly collect any special categories of personal information (e.g., health, biometric, or similarly sensitive data) and ask that you do not include such information in your advertising data or communications with us unless strictly necessary.
3. How and why we use your information
We use the information described above to:
- provide, operate, and maintain the Service, including authenticating you, connecting to and storing your advertising data, and generating AI-powered answers to your questions;
- process payments and issue invoices;
- provide customer support and respond to your requests;
- monitor the data pipeline for failures and alert you to issues affecting your data connection;
- maintain and improve the Service, including diagnosing technical issues;
- comply with our legal obligations (e.g., tax and accounting records); and
- communicate with you about your account, including service updates, billing notices, and — where you have not opted out — occasional product updates.
Legal bases (GDPR). Where GDPR applies, we rely on the following legal bases: performance of a contract with you (providing the Service you signed up for), our legitimate interests (e.g., maintaining and securing the Service, preventing fraud), compliance with a legal obligation (e.g., tax records), and, where applicable, your consent (e.g., for optional marketing communications or non-essential cookies), which you may withdraw at any time.
We do not sell your personal information, and we do not use your advertising data to train AI models for the benefit of other clients.
4. How we store and protect your information
Your data is stored and processed in secure, access-controlled cloud infrastructure, currently:
- Google Cloud (BigQuery) — for your stored advertising data, held in a dataset logically isolated from other clients' data;
- Google Cloud Run — hosts the backend application that processes your requests and generates AI answers;
- A managed Postgres database (Google Cloud SQL) — for your chat history and conversation context; and
- A vector memory store — for retaining patterns from your past successful queries, isolated per client, used only to improve the relevance of answers to your own questions.
Our website and client-facing application are hosted on Vercel.
Access to this infrastructure is restricted to what is operationally necessary, authentication to the Service is handled via Clerk, and data in transit is encrypted. While we take reasonable technical and organisational measures to protect your information, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
5. How long we keep your information
A core purpose of the Service is to retain your historical advertising data for longer than Meta itself retains it, for as long as your subscription is active. If you cancel or your account is terminated, we will retain your data for a reasonable period (currently 30 days) to allow you to request an export, after which we will delete or de-identify it, unless we are required to retain it for longer to comply with a legal obligation (for example, financial/tax records, which we may retain for the period required by Australian law).
6. Who we share information with
We share information with the following categories of third-party service providers ("subprocessors"), solely as necessary to provide the Service:
| Provider | Purpose |
|---|---|
| Meta | Source of your advertising data (via your own authorised access grant) |
| Google Cloud (BigQuery, Cloud Run, Cloud SQL) | Data storage, backend application hosting, and chat-history database |
| Anthropic (Claude) | AI processing of your queries and advertising data to generate answers |
| Clerk | Account authentication |
| Stripe | Payment processing |
| Vercel | Frontend website and application hosting |
| Xero | Invoicing and accounting records |
These providers are only permitted to use your information to provide their service to us, under their own applicable terms and privacy policies. We do not share your personal information with third parties for their own independent marketing purposes, and we do not sell your personal information.
We may also disclose information where required by law, to protect our legal rights, or in connection with a merger, acquisition, or sale of business assets (in which case we will take reasonable steps to ensure your information continues to be protected).
7. International data transfers
Because our subprocessors (including Google Cloud and Anthropic) operate infrastructure in various countries, including the United States, your information may be transferred to and processed in countries outside your own, including countries that may not have data protection laws equivalent to those in your home jurisdiction. Where GDPR applies, we rely on appropriate safeguards for such transfers (such as standard contractual clauses adopted by our subprocessors) where required.
8. Cookies and website tracking
Our website (tallixai.com) uses Vercel Analytics to help us understand how visitors use the site (for example, page views and general traffic patterns). Vercel Analytics does not use cookies to track you across websites and does not collect personal information such as your name or email address. Where required by law (for example, for EU/UK visitors), we will request your consent before setting any non-essential cookies introduced in future, and you can manage your preferences via your browser settings.
9. Your rights
If you are in Australia: under the Privacy Act and the Australian Privacy Principles, you may request access to the personal information we hold about you and request correction of inaccurate information. You may also lodge a complaint with us (see Section 12) or with the Office of the Australian Information Commissioner (OAIC) if you believe we have mishandled your personal information.
If you are in the EU/UK (GDPR): you have the right to request access to, correction of, deletion of, or a copy (portability) of your personal information, to object to or request restriction of certain processing, and to withdraw consent where processing is based on consent. You may lodge a complaint with your local data protection supervisory authority.
All users: you may also request that we delete your account and associated data (subject to Section 5), or export your stored advertising data and conversation history, by contacting us at support@tallixai.com. We will respond to verified requests within a reasonable time and in accordance with applicable law.
10. Children's privacy
The Service is intended for business use by adults and is not directed to, or knowingly used by, individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.
11. Data breach notification
If we become aware of a data breach that is likely to result in serious harm to you, we will take reasonable steps to notify you and, where required, the relevant regulator (such as the OAIC under the Notifiable Data Breaches scheme), in accordance with applicable law.
12. Changes to this policy
We may update this Privacy Policy from time to time, for example to reflect changes in our practices, subprocessors, or applicable law. We will post the updated policy on the Site with a revised "Last updated" date and, for material changes, will make reasonable efforts to notify active clients (such as by email).
13. Contact us
For any questions about this Privacy Policy, or to make a privacy-related request, contact:
Mitchell Keith Sands, trading as Tallix (tallixai.com)