Privacy Policy

Last updated 17 September 2026

Tarka Digital Ltd ("Tarka Digital", "we", "us") is a digital agency registered in England and Wales. This policy explains what personal data we collect, why, how long we keep it, and the rights you have. It covers our website at tarkadigital.com, our client portal at app.tarkadigital.com, and the work we do on social media accounts on behalf of our clients.

We are the data controller for the website and the portal. When we manage advertising, email or social media accounts for a client, we act as a processor on that client's instructions, and the client's own privacy policy applies to their customers.

1. What we collect and why

Website visitors

• Usage data (pages viewed, approximate location, device and browser type) through Google Analytics via Google Tag Manager, used to understand how the site is used. See the cookies section below.
• Enquiries: the name, email address, company and message you send us through a contact form, by email, or when booking a call through Calendly. Used to reply to you and, if you become a client, to set up your account.

Portal users (our clients and their team)

• Account details: name, email address and the company you belong to. Used to sign you in (by a one-time code sent to your email) and to show you your account's work.
• Work data: tasks, projects, ideas, meeting notes, messages, service requests, proposals, invoices and files you or we add to your account. This is the substance of the work we do together.
• Files: photos, documents and brand assets uploaded by you or by us, stored in a private bucket in the European Union. Files are only visible to members of your account and to Tarka Digital staff.
• Social media posts: draft posts, captions, images, your comments and approvals. Used to prepare, review and publish content for your accounts.
• Notifications: we email you when something on your account needs your attention (a task, a post to approve, a comment). You can reply to any email to ask us to send fewer.

Meeting notes

With your agreement, meetings may be recorded and transcribed by Fireflies.ai. Transcripts are summarised into notes, decisions and tasks that appear in your portal. Ask us before a meeting if you would rather it were not recorded.

2. Facebook and Instagram

We publish posts to clients' Facebook Pages and Instagram professional accounts through Meta's APIs, using a Meta app owned by Tarka Digital. To do this:

• A Tarka Digital administrator connects the Pages that Tarka Digital already manages through Meta Business Manager. Clients do not log in to our app with their own Facebook accounts.
• We store the Page's ID and name, the linked Instagram account's ID and username, and an access token that lets our system publish to them. Tokens are stored on our servers, are never shown in the portal, and are only used to publish content the client has approved, to read the result (the post's link), and later to read basic performance statistics for that content.
• We do not collect or store data about the Page's followers, messages or comments, and we do not use Meta data for any purpose other than the service the client has asked us for.

3. Who we share data with

We use a small number of providers to run our services. Each processes data only on our instructions:

• Supabase (database and authentication, EU region) and DigitalOcean (servers and file storage, Amsterdam) host the portal.
• Resend sends our emails.
• Anthropic provides the AI model we use to summarise meeting notes, read invoices, tag news and help draft or revise content. Data sent to it is used to produce that output and is not used to train models.
• Fireflies.ai records and transcribes meetings where agreed.
• Meta receives the content we publish on a client's behalf.
• Google (Analytics, Tag Manager, Fonts) on the website.
• Revolut and our accountant for invoicing and bookkeeping.

We do not sell personal data. We may disclose data where the law requires it.

4. Where data is stored

Portal data and files are stored in the European Union. Some providers above operate in the United States; where data leaves the UK or EU we rely on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses.

5. How long we keep it

• Enquiries that do not lead to work: 12 months.
• Portal accounts and work data: for the duration of our relationship and 12 months afterwards, so a returning client finds their history intact. Files are deleted at the end of that period or sooner on request.
• Meta access tokens and account identifiers: until the client disconnects, or 30 days after a deletion request.
• Invoices and accounting records: six years, as UK tax law requires.
• Analytics data: as set in Google Analytics (14 months).

6. Our lawful basis

We process client and portal data to perform our contract with the client. We process enquiries and analytics under our legitimate interest in running and improving our business. Meeting recordings and marketing emails are based on consent, which can be withdrawn at any time.

7. Cookies

The website uses Google Analytics cookies to measure traffic. The portal uses only the cookies needed to keep you signed in. You can block cookies in your browser; the website still works without them.

8. Your rights

Under UK GDPR you can ask us to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw consent. Email harry@tarkadigital.com and we will respond within one month. If you are unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.

9. Security

The portal is served over HTTPS, access to each account is restricted to its members, files live in a private bucket, and secrets such as API tokens are stored only on our servers. Sign-in uses one-time codes rather than passwords.

10. Contact

Tarka Digital Ltd
Email: harry@tarkadigital.com
Phone: 07526 075765

We may update this policy from time to time; the date at the top shows the latest version.