Privacy

The distinction runs through everything below, so it comes first.

For your account and our site, we are the controller. We decide why and how we process the data: your email, who you are, what you asked us for, how you use the platform. Everything on this page applies to it directly.

For what you bring into the platform, you are. The contacts, messages, documents, and records that reach Tulina through the tools you connect stay under your control. We process them on your instructions and for no purpose of our own. Your company decides what enters, who sees it, and when it goes. The detail of that is set by our data processing agreement rather than by this page, and if you are using Tulina through your employer, they are the ones to ask about it.

The controller is TULINA, a société par actions simplifiée registered under SIREN 130281025 (RCS Paris), registered office 47 rue Vivienne, 75002 Paris, France. Full details are on the legal notice page.

For anything on this page, write to privacy@tulina.ai. We have not appointed a data protection officer; that address reaches the people who can act.

We do not collect more than we need, and every processing operation has a legal basis under article 6 GDPR.

We do not sell personal data, we do not share it for anyone else's own purposes, and we do not train or improve any model on it. Tulina carries no model of its own.

We use a small number of providers, each processing data on our instructions and nothing more.

We may also disclose data where the law requires it, to a court or a public authority acting within its powers.

Beyond the tools you connect. When you connect a tool or a model to Tulina, your data travels to that provider under your own arrangement with them, on your instruction. We pass it on; we do not choose the destination and we are not the controller of what happens there. That includes any AI model you connect: what you send to it is governed by your contract with that provider, not by this page.

Connecting a Google account to Tulina is optional, and you do it yourself, one service at a time: Gmail, Google Drive, Google Sheets, Google Calendar. Tulina works without it, and nothing is read from a Google account you have not connected.

Tulina's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We access Google user data only to provide the features you explicitly use in Tulina, and only when you, or an AI assistant or agent you have connected to Tulina, ask for it: searching, reading, drafting, sending, archiving and moving to the trash your email (Gmail); searching, reading and exporting your files, creating folders, moving, renaming or deleting files, and sharing a file with someone you name or removing their access (Google Drive); reading your spreadsheets, adding rows, updating or clearing cells and creating new spreadsheets (Google Sheets); and reading your calendars and events, and creating, updating or deleting events (Google Calendar). We do not use Google user data for advertising, we do not sell it, we do not share it with third parties except as needed to provide the feature you requested, and we do not use it to develop, improve or train generalised AI or machine-learning models.

The tokens Google issues are held encrypted, as described under Security, and are used only on your behalf. You can revoke Tulina's access at any time. Disconnecting from your connectors page deletes the stored tokens. If you revoke access from your Google Account permissions instead, the stored tokens stop working and Tulina asks you to reconnect the account; you can then remove it from your connectors page to delete them.

The platform and everything it stores are hosted inside the European Union: the database, the object storage, the secrets, the credential vault, and the sign-in service. All of it currently runs in France. Your working data does not leave the Union to be processed by us.

What does leave it: the tulina.ai website and its audience measurement, demo bookings, sign-up form submissions, and platform error reports, which reach United States providers listed above. Payment and billing data is handled by Stripe's Irish entity, inside the Union, and may be transferred onward to Stripe in the United States.

Those transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the Commission's standard contractual clauses. You can ask us at privacy@tulina.ai which mechanism covers a given provider.

We keep personal data for as long as it serves the purpose it was collected for, and no longer. What sets that period is the purpose itself rather than a fixed calendar:

Contact form submissions stay with us while a conversation with you is still live. Account and platform data stays for as long as the account is open. Connection credentials stay until you revoke the connection or close the account. Disconnecting a Google account in Tulina deletes its tokens from Tulina and asks Google to revoke them, unless the same account is still connected elsewhere in Tulina, where revoking would also cut that connection. Technical logs are kept for as long as they are useful to security and reliability.

Past that, we keep only what the law obliges us to keep — accounting records for ten years being the main one — and what we may still need to defend a claim.

You can ask us to delete your data at any time, and we act on that request whatever the above says.

Connection credentials and API keys are encrypted with AES-256-GCM in a dedicated vault. No credential is stored in clear anywhere. Traffic to the site and the platform is encrypted in transit.

The platform runs on dedicated servers in its own private network, each behind its own firewall, and the machine serving the web app is separate from the one that holds credentials. Access inside a workspace follows the roles its administrators set, and organisations can review what has been done in their own workspace through an audit log.

If you believe you have found a vulnerability, write to security@tulina.ai before disclosing it anywhere else.

Our trust page collects all of this in one place for a vendor review, and shows which of our providers are engaged for everyone and which only by your own use of a connector.

Under the GDPR and the French Data Protection Act you can ask us to give you access to your data, correct it, erase it, restrict what we do with it, or hand it over in a portable form. You can object to processing based on our legitimate interest, and withdraw consent at any time where consent is what we relied on.

You can also leave instructions about what happens to your data after your death, either general or specific, and change them whenever you like.

Write to privacy@tulina.ai. We answer within one month. If the request concerns data your employer put into Tulina, we will point you to them, because it is their instruction we act on.

If you think we have got it wrong, you can complain to the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at cnil.fr.

This site sets no advertising or tracking cookies and builds no cross-site profile, which is why you are not being asked to dismiss a banner. Audience measurement is cookieless. Any cookie strictly necessary to serve the site or to keep you signed in to the platform is exempt from consent and is not used for anything else.

We update this page when what we do changes. The version here is the one in force, and the date at the top says when it last moved. For a change that materially affects your rights we give notice by email before it takes effect.

Privacy questions and rights requests: privacy@tulina.ai. Security reports: security@tulina.ai. Anything else: legal@tulina.ai.