Tacto Cost Reference: privacy
Tacto Cost Reference answers questions about what industrial goods cost. This page says what a question sends us, what we keep, for how long, who handles it for us, and how you have an answer deleted. Last updated 2 November 2026.
In short
- No account, no sign-up, no cookie, no advertising.
- We never sell your data or share it for money.
- An answer, with the question it was given for, is kept 90 days so its receipt link opens.
- We don't store IP addresses.
- You can have an answer deleted
- Email hello@tacto.ai with its receipt id.
Who is responsible
Tacto Technology GmbH, Sandstraße 33, 80335 Munich, Germany, is responsible for the data described here. Our imprint has the full details; the privacy notice of tacto.ai covers our website, here.
What a question sends us
When an AI assistant or a program calls a tool (over MCP or the HTTP API), we receive what it passes: the item, the country, prices, dates and any text it adds, such as the reasons from a supplier's price letter. We use it only to compute the answer, and we treat the text as data, never as instructions.
Please don't pass personal data or confidential information you may not share. Supplier letters usually don't need names or contact details; leave them out.
What we keep, and for how long
| What | Why | Kept |
|---|---|---|
| Each answer with its question, the sources and the reasons passed in (a receipt, opened by its link) | So the receipt link opens and we can see which questions we can't answer yet | 90 days, then deleted |
| A record of each visit and call: the page or tool, the outcome, the country (from Cloudflare), the kind of client and a visitor code that changes every month | To see how the reference is used and to find faults | 90 days, then deleted |
| The same visit and call records, without the question, in our analytics (Mixpanel, EU) | Usage reports | As long as the report needs them |
| A daily call counter per client (a monthly code, no address) | The limit against abuse | 2 days |
The visitor code is a keyed hash of the network and the user agent, so it names no address and no person, and it changes every month. We keep no IP address, and set no cookie and no browser storage. Anyone who has a receipt's link can open that answer; the link is long and can't be guessed, so share it only with people who may read it.
Who handles it for us
- Supabase
- Our database and the function that answers calls.
- Cloudflare
- Delivers the pages and passes the request on; it sees the network address in the course of delivery.
- Mixpanel (EU data location)
- The usage reports above.
They process the data for us, under contracts that bind them to our instructions. We do not pass your data on to anyone else, and we do not sell it.
Why we may do this
We answer your question because you asked it, and we keep the records above for our legitimate interest in running the reference securely and improving it (Article 6(1)(f) GDPR).
Delete an answer
Every answer's receipt link ends in its receipt id (the part after /agents/audit/). To have that answer deleted, email hello@tacto.ai with the id. We delete the answer and the question stored with it, and reply when it is done. Without a request, answers and the records in our database are deleted by themselves after the periods in the table.
Your rights
You can ask us for access to data about you, to correct or delete it, to restrict our use of it, and you can object to it. Write to hello@tacto.ai. You can also complain to a data protection authority; for us that is the Bayerisches Landesamt für Datenschutzaufsicht.
Changes
If what we keep or who handles it changes, we change this page first and show the date at the top.