1. Who we are
Taalo is a household life-admin service operated from the United Kingdom. In this notice, “Taalo”, “we” and “us” mean the operator of the Taalo app and taalo.io.
Questions or privacy requests can be sent to support@taalo.io.
2. What we collect
Depending on the features you use, Taalo may handle:
- account details such as your name, email address and sign-in identifiers;
- content you add, including household records, product information, documents, routines, dates and preferences;
- technical and security information such as device, browser, diagnostic and audit data, and anonymous usage and error statistics (see section 6);
- information from services you choose to connect, as described below.
- food preferences, if you add them: ingredients you want to avoid (for example nuts or gluten), used only to flag whether a product suits your household. Optional, never public, remove any time. Taalo doesn’t give medical advice.
- community Deal data, including a separate public username, exact Product and shop branch, Prices, Deal type, observation time, notes, comments, confirmations, follows, reports and camera photos.
We only ask for information needed to provide, protect and improve the features you use.
3. Connected email accounts
If you choose to connect Gmail, Google asks you to approve the restricted
gmail.readonly permission, shown as “View your email messages and
settings”. Taalo uses it to read a bounded set of recent Inbox messages and identify
household details that may be useful to you.
If you choose to connect Outlook or Microsoft 365, Microsoft asks for
User.Read and Mail.Read. These let Taalo identify the
connected account and read messages for the same bounded household-information flow.
Taalo does not request permission to send, edit or delete Microsoft mail.
Google data Taalo accesses
For messages within the connection settings you choose, Taalo may access message and thread identifiers, sender and recipient addresses, subject lines, dates, labels, body text, attachment names and supported attachment files. Taalo also receives the Google account identifier and email address needed to keep the correct mailbox connected. It does not request permission to compose, send, edit or delete mail.
How Taalo uses Google data
Taalo uses this information only to provide and protect the Gmail-connected features you request: checking the selected Inbox window, detecting useful household information, showing it to you for review, processing supported attachments, preventing duplicate work, maintaining the connection and diagnosing failures. Security scanning and configured AI-assisted extraction may be used only to deliver these features. Taalo does not use Google user data for advertising, sell it, build advertising profiles from it, or use it to train general-purpose AI models.
Storage, sharing and protection
Connected-email access and refresh tokens are encrypted server-side using authenticated AES-256-GCM encryption. They are not placed in the mobile app or public website. Raw email text and attachment files are stored only for the retention period you select, from 6 hours to 30 days, unless you explicitly confirm an attachment for longer-term storage in Taalo. Provider message identifiers, sync cursors, security records and useful household details you choose to keep may remain so Taalo can operate reliably and show your saved records.
Google data is shared only with Taalo’s contracted cloud hosting, database, malware-scanning and configured processing providers when necessary to deliver the Gmail-connected feature. Those providers process it for Taalo under appropriate confidentiality and security controls. We may also disclose information when legally required or when necessary to protect users and the service. We do not allow providers to use Google data for their own advertising or general-purpose model training.
Deletion and revoking access
Disconnecting Gmail in Taalo stops future mailbox checks and deletes Taalo’s encrypted Google credentials and sync cursors. Temporary raw email text and attachments are automatically scrubbed or deleted when the selected retention period expires. Saved household details and any attachment you explicitly confirmed for longer-term storage remain until you delete that record or ask us to close your account. You can also revoke Taalo directly from your Google Account’s third-party connections. For deletion help, email support@taalo.io.
Taalo’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
4. Community Deals and moderation
Community Deal responses use an opaque public profile identifier and public username. Your private account name, email address, sign-in provider identity and profile image are not public Deal fields. Exact shop and observation time are used to keep a Deal traceable and locatable.
Taalo privately prepares a provisional public username for each account, even if its owner never posts. This may happen for a new account or when an existing account is prepared for the feature. Taalo may request a Xiaomi MiMo suggestion to refine that username before you first post. For this separate suggestion, MiMo receives only an opaque public profile identifier, the provisional username and the fixed locale; it does not receive your private name, email, provider identity, profile image or location. Taalo checks the suggestion before using it. Taalo does not rename a username once you have posted with it.
Public Deal posting is part of the service we provide under our Terms, so it is on once you accept them. Deals you post are public under your public username, never your private name. Your profile and content become public only when you post and the community release gate is open. You can turn public posting off in Profile › Deal matching; Deals you save after that stay private, and Deals you already posted are hidden.
New or edited Deal notes, comments and public profile text stay non-public while Taalo checks them for spam, scams, harassment, sexual content, threats, illegal facilitation and personal information. Taalo may use Xiaomi MiMo as a bounded moderation processor. The request contains the submitted text, content kind, locale and an opaque content identifier—not your name, email, household data, Product, shop, Price, username or profile image. Uncertain or conflicting results remain held.
Original Deal photos stay private. Only a separate sanitised derivative may become public after applicable privacy and image-safety checks. Taalo may send that metadata-free derivative to Xiaomi MiMo to check for personal details and unsafe imagery; uncertain results go to human review. MiMo does not receive your private account name, email or original photo in this check. Private storage paths and image metadata are never returned in a public Deal. Reports, blocks and moderation receipts are retained only as needed to operate and protect the community.
5. Deal matching and Find it
Find it shows which Item types and services households nearby are looking for, so people can post Deals that help. To do this, Taalo counts each household’s open Cart lines and Stock items, and services due in the next 90 days or used often, as Item types and service types.
- Counts are grouped by area: the postcode district of the household’s home postcode (for example G12), or across the UK if there is no home postcode.
- Only vague bands are shown (1+, 5+, 10+ and so on), never an exact number of households.
- Taalo never shows or shares names, list text, dates, prices paid, or anything about health, diet or ages. Health, baby, personal-care, alcohol and other sensitive Item types and service types are never counted.
- Counts are refreshed every hour, so changes show within about an hour.
Our basis is legitimate interests: helping households find deals on what they need, using only aggregated, banded counts. You have the right to object. The household owner can turn counting off with one tap in Profile › Deal matching, and it applies to the whole household from the next refresh. Other members can ask the owner or email support@taalo.io.
Your choices for public posting and Find it are kept as a dated record so we can show what you chose and when.
6. App usage and error statistics
To find problems and improve Taalo, the app sends anonymous usage and error statistics to PostHog, our analytics provider, which hosts them in the EU.
- What is sent: the screens you open (by name only, for example “Recipes”), the main actions you complete (for example “receipt saved”), how long screens stay open, your app version, device platform and language, and error messages with personal details removed.
- What is not sent: your name, email, account, household details, receipt contents or location. PostHog is set to discard your IP address rather than store it. Statistics use a random ID for the app on your phone. They are not linked to your Taalo account and can’t be used to identify you.
- Why: only to understand, in aggregate, how Taalo is used and to fix what goes wrong. Never for advertising.
- Your choice: this is on by default. Turn it off any time in Profile › Privacy and security › Help improve Taalo. Nothing new is sent from that phone once it is off.
Our basis is legitimate interests in improving the service. UK law allows this kind of statistical measurement without asking first, as long as you can switch it off. You have the right to object, by using the switch or by emailing support@taalo.io.
7. How we use information
We use information to provide and personalise Taalo, maintain connections you request, protect accounts, diagnose faults, respond to support requests, meet legal obligations and improve reliability. Where UK data-protection law applies, our bases include performing our contract with you, your consent for optional connections, legitimate interests in secure and dependable operation, and compliance with law.
9. How long we keep information
We keep account and household information while your account is active and as needed for the purposes described above. Specific records may have their own controls.
For raw message content temporarily retrieved from a connected Gmail or Outlook mailbox, you can choose a retention window from 6 hours to 30 days. Your current selection is shown in Taalo. Derived household details you choose to keep can remain until you delete them or your account, subject to necessary security and legal records.
Backups and audit records may persist for a limited period before secure expiry.
10. Your choices and rights
You can review or correct profile information, control connected accounts, pause email checking, delete supported content, or ask us to close your account. Depending on where you live, you may also have rights to access, correct, erase, restrict, object to or receive a copy of personal data, and to complain to your data-protection authority.
You can use the in-app account-deletion control or our public account-deletion page. Account deletion covers your public Deal Hunter profile, Deals, comments and media as well as associated private account data, subject to any retention we must explain for security or law.
Disconnecting email
Disconnecting an email account in Taalo stops future mailbox checking and removes Taalo’s encrypted local credentials and sync cursors. It does not necessarily revoke the provider’s overall permission grant. Remove Taalo from your Google or Microsoft account settings if you also want to revoke that grant. See the Gmail connection guide for Google-specific steps.
11. Security
We use technical and organisational safeguards designed to protect information, including encrypted connections, restricted access, encrypted credentials and operational monitoring. No internet service can promise absolute security; please protect your device and sign-in details.
12. Children
Taalo accounts are for people who are at least 18, or old enough to enter the service agreement where they live. Household information about others should only be added when you have a lawful and appropriate reason.
13. Changes to this notice
We may update this notice as Taalo changes. We will publish the new effective date here and provide additional notice when a change is significant.
14. Contact
Email support@taalo.io for privacy questions or requests. You may also complain to the UK Information Commissioner’s Office at ico.org.uk.