Skip to content

Data Addendum

Effective 28 Sept 2026

This Addendum forms part of the Tayl Terms of Service or any other agreement that incorporates it. It applies when we (Azilo Technologies Limited, trading as Tayl) process personal data for you, the Customer, to provide Tayl at tayl.pro, taylapp.net and in our mobile apps. You are the controller and we are the processor, unless an order says otherwise. We are the controller of Users’ personal Tayl accounts and for the purposes in our Privacy Policy. If this Addendum conflicts with the Terms about this processing, this Addendum applies.

1 Processing and instructions

We process your personal data only on your documented instructions, unless UK law requires otherwise; if so, we will tell you first unless the law prohibits it. We will tell you promptly if we think an instruction breaks data protection law.

Your instructions are the agreement, your account settings and authorised support requests. They include:

  • providing the features you enable, such as Chat, moderation, oversight, reports, integrations, public certificate verification and sharing within an organisation group;
  • keeping a User’s training records, signed documents, certificates and relevant chat messages for seven years after they delete their Tayl account, unless you instruct otherwise; and
  • creating aggregated information that identifies no individual and not you, such as combined ratings of Tayl-supplied courses, which we may use to improve the service.

You decide your lawful basis, give notices to your staff and other data subjects, and are responsible for the legality and accuracy of your instructions and content. Before turning on Chat oversight, you must have a policy on when messages may be reviewed, tell your staff about it and complete any data protection impact assessment you need. You are responsible for each oversight grant your admins open and each decision to delay the participant notice.

Processing details:

  • Subject matter and purpose: providing and securing the Tayl service, including hosting, storing, organising, displaying, reporting, transmitting, backing up, supporting and deleting data.
  • Duration: while you have an account (paid, free or restricted), and until return or deletion is complete under section 7.
  • Data subjects: your admins, staff, contractors and other invited Users.
  • Personal data: names, contact and account details; job, group and site details; training, assessment, certificate and signed-document records, including signatures; HR and rota records you import; sign-in, device and activity data; chat messages, photos and reports; and moderation, oversight, audit and support records.
  • Special category data: you must not use the service to collect special category or criminal offence data, such as health information or criminal record checks, unless we agree additional measures in writing.

2 People and security

We ensure people authorised to process your personal data are bound by confidentiality and appropriately trained. Our staff access your account only as needed to provide support, maintain and secure the service or comply with the law, and that access is logged. They cannot view chat messages or photos except under a written, approved and recorded procedure, used only to comply with the law, respond to a security incident or carry out a data protection request.

We apply appropriate technical and organisational security measures for the risk, including access controls, encryption, backups, monitoring, incident response and regular review, as described in our Information Security Policy (available on request). We may update them without materially reducing overall protection. You remain responsible for your account settings, authorised Users and your own security.

3 Subprocessors

You give us general written authorisation to use subprocessors to provide, support and secure the service. The current list, with what each does and where, is in section 9 below. We will email your admins at least 30 days before adding or replacing a subprocessor, so you can object on reasonable data protection grounds. If we cannot resolve an objection, you may end the affected service and receive a refund of prepaid fees for the unused period. We impose equivalent data protection duties on each subprocessor and remain responsible for its performance.

4 Assistance and incidents

Taking into account the processing and the information available to us, we will help you with data subject requests, security, breach notification, data protection impact assessments and prior consultation with the ICO where required. If you ask us to erase chat messages or photos, we will do so through our documented procedure. We will not respond to a data subject request about your data except on your instructions or where the law requires.

We will tell you without undue delay after becoming aware of a personal data breach affecting your personal data, share the information reasonably available to us, and cooperate with your response.

5 International transfers

We will not make a restricted transfer of your personal data outside the UK unless a valid transfer mechanism applies, such as UK adequacy regulations or appropriate contractual safeguards, with any required risk assessment. Our subprocessor list shows where each provider processes data, and we will give more detail on request.

6 Audits

We will make available the information reasonably needed to show we meet these obligations, and allow and contribute to reasonable audits by you or an independent auditor, on appropriate notice and subject to confidentiality, security, protection of other customers and reasonable limits on disruption. We will first use existing policies, reports and records where they meet your needs. Each party bears its own costs, unless an audit reveals a material breach by us.

7 Return and deletion

When a paid plan ends, your account moves to the free plan or is restricted, and you instruct us to keep storing your personal data so you can export it or return to a paid plan. At any time, you may request an export, or instruct us to close your account and return or delete your personal data. We will provide exports in CSV and PDF within 30 days, and delete active copies within 30 days of your instruction or of closing an inactive account under section 6 of the Terms, unless UK law requires us to keep them. Copies in our providers’ logs expire under their standard retention periods.

Backups are put beyond ordinary use and overwritten within 35 days. If we restore a backup before then, we will reapply deletions before the data is used. Any data we lawfully keep stays protected under this Addendum.

8 Liability

Each party’s liability under this Addendum is subject to the limits in section 8 of the Terms.

9 Subprocessors and service providers

Last updated 28 Sept 2026

This section lists the providers that process personal data for Tayl. We will email Customers’ admins at least 30 days before adding or replacing a subprocessor, as set out in section 3 of our Data Processing Addendum.

Tayl runs on two platforms with separate infrastructure: Tayl V3 at tayl.pro, and Tayl V2 at taylapp.net, which some Customers use until they move to V3.

Tayl V3 (tayl.pro)

Customer data is hosted in the UK.

  • DigitalOcean: application servers, database, background jobs, SCORM player and backups. Location: UK.
  • Cloudflare: file storage (including chat photos, certificates and SCORM content), content delivery and network security. Location: UK (storage); global (delivery and security).
  • Postmark (ActiveCampaign): account, sign-in, reminder and notification emails. Location: US.
  • Apple Push Notification service: iOS app notifications, including the sender’s name and chat message previews. Location: global.
  • Google Firebase: Android app notifications, including the sender’s name and chat message previews, and mobile app crash reports. Location: global.
  • Browser push services (Google, Mozilla, Apple, Microsoft): deliver encrypted browser notifications; they cannot read the content. Location: global.
  • AppSignal: error and performance monitoring and application logs. Location: Netherlands.
  • Help Scout: support requests, in-app help widget and AI help answers. Location: US.
  • jsDelivr, JSPM: deliver some scripts to your browser; they receive your IP address and browser details. Location: global.

Tayl V2 (taylapp.net)

Customer data is hosted in Ireland and the UK, with database backups stored in the US.

  • Heroku (Salesforce): application hosting, database, backups, logs and background jobs. Location: Ireland (backups: US).
  • Redis Cloud (Redis Ltd): background job queue and cache. Location: Ireland.
  • Amazon Web Services (S3, CloudFront): file storage (including signatures, certificates and SCORM content) and SCORM delivery. Location: UK (storage); global (delivery).
  • Amazon Web Services (SES): account, sign-in, reminder and notification emails. Location: US.
  • AppSignal: error and performance monitoring and application logs. Location: Netherlands.
  • Help Scout: support requests and in-app help widget, which identifies signed-in users by name and email. Location: US.
  • OpenAI: AI writing assistant for course authors; it receives the text authors enter, not account details. Location: US and other countries.
  • Wistia: onboarding videos. Location: US.
  • Font Awesome, Google Fonts, rsms.me, unpkg, cdnjs, npmcdn, jsDelivr, JSPM: deliver icons, fonts and scripts to your browser; they receive your IP address and browser details. Location: global.

Other service providers

These providers support our billing, sales, marketing, website and administration across both platforms. We are the controller for this information.

  • Stripe: payments, invoices and fraud prevention; may also act as an independent controller. Location: US.
  • QuickBooks Online (Intuit): invoicing for some Customers. Location: UK.
  • Google Workspace: business email and documents. Location: global.
  • Pipedrive: customer relationship management, website chat and meeting booking. Location: EU.
  • HubSpot: meeting booking. Location: Germany.
  • Zapier: passes Tayl V2 sign-up details to our customer relationship management system. Location: US.
  • Customer.io: onboarding and account emails for Tayl V2 sign-ups. Location: EU.
  • Google Analytics and Google Ads (through Google Tag Manager): website analytics and advertising measurement on tayl.net, with your consent. Location: global.
  • Google reCAPTCHA: spam protection on tayl.net forms. Location: global.
  • CloudCannon: hosting of tayl.net and its forms. Location: New Zealand and global hosting.
  • CookieYes: cookie consent on tayl.net. Location: Ireland.
  • Reditus: referral tracking on tayl.net. Location: Germany.
  • Wistia, Colossyan: videos on tayl.net. Location: US (Wistia); Germany and UK (Colossyan).
  • Font Awesome, rsms.me, jsDelivr, unpkg: deliver icons, fonts and scripts on tayl.net. Location: global.

Not our subprocessors

If a Customer connects an HR, rota or payroll system, such as Deputy, Fourth, Planday, Rota Ready, RotaCloud, Rota King, Breathe HR, Cezanne, S-Four, Workforce, Harri or Ubeya, or sets up webhooks or API connections, information is exchanged under the Customer’s own agreement with that provider. Course authors may also embed content from services such as YouTube, Vimeo or Unsplash, which may set their own cookies.