Privacy Policy

tiama.page is operated by The Traveling Twins Co., Ltd., a company incorporated in Taiwan (company registration number 42920198) with its registered address at 7F.-5, No.329, Sec. 3, Jiankang Rd., Anping Dist., Tainan City 708, Taiwan (R.O.C.), which is responsible for the personal-data processing described in this policy. Contact hello@tiama.page with privacy questions or rights requests.

Depending on the features you use, we may collect:

• Account and identity data: name, the email address supplied by your sign-in provider (some providers supply none), your contact email address (which defaults to the one from your sign-in provider and you may change) together with the time it was confirmed, profile image, interface language, and the provider name, user ID, and avatar URL supplied by Google, Facebook, or LINE.
• Business and content data: business name, category, address, coordinates, telephone number, opening hours, services, prices, website and social links, booking links, descriptions, FAQs, SEO copy, uploaded or imported images, and other website content.
• Reviews and public-source data: Google place identifiers, ratings, review counts, reviewer names, ratings, review text and dates, review or album images, and source identifiers.
• Billing data: third-party payment customer, subscription, and transaction identifiers; plan and subscription status; billing dates; amount, tax, currency, and invoice number. Complete card numbers and payment credentials are collected and processed directly by the payment service and are not normally available to us.
• Support data: your name, email address, message, and follow-up correspondence submitted by contact form, email, or live chat; for live chat, also the IP address, approximate location, browser and device information, referring site, and pages viewed that the chat service records.
• Technical and usage data: IP address, user agent, device and browser information, session data, sign-in and last-activity time, requests, actions, errors, and security logs.
• Shop-website performance data (first-party): views, button clicks, and feedback submissions on published shop websites, together with the referring domain name, campaign parameters, device category, country code, event time, and a pseudonymous identifier derived from IP address and user agent. We do not store the raw IP address, the full user agent, full URLs, or referrer paths in this data.

Data may be provided directly by you, supplied by sign-in or payment services, generated automatically by your device and browser, or obtained from public or third-party sources such as Google and Google Maps when you use an import feature by searching for and selecting a business or providing a Google Maps business link.

Third-party reviews and images may contain personal data about reviewers or creators. We process them based on user selection, the service relationship, and applicable law. If you believe content infringes your rights, contact hello@tiama.page.

We do not claim ownership of the content you upload or create. Text, images, and other material remain owned by you or the original rights holder, and we process them only as far as operating the service requires: generating and editing a shop website, publishing and hosting it, providing previews, and maintaining the service itself.

Those purposes need a limited licence from you — to host, cache, back up, resize, and publicly display the content — whose scope, duration, and termination are set out in the "Your Content and Shop Website" section of our Terms of Service. We do not use your content for anything beyond those purposes.

We process personal data only where we have a legal basis for it. Each purpose below names its basis under Article 6 of the EU General Data Protection Regulation (GDPR); equivalent local rules apply elsewhere:

• Create, manage, preview, and publish shop websites — performance of our contract.
• Provide sign-in, account linking, language preferences, billing, subscriptions, notifications, and customer support — performance of our contract.
• Import business, review, and image data and generate editable AI copy drafts — performance of our contract.
• Provide live chat on the main-domain marketing pages, sign-in page, and dashboard, including keeping the chat window working and continuing earlier conversations — legitimate interests (answering questions from prospective and existing users); questions about your account or the service raised in a chat — performance of our contract.
• Enforce plan and import limits and prevent abuse, fraud, and unauthorised access — legitimate interests (keeping the service available and secure).
• Analyse usage, diagnose errors, monitor performance, and improve the service — legitimate interests (operating and improving the service); Google, Meta, X (Twitter), and OpenAI website analytics and advertising measurement on the main domain rely on your consent instead.
• Keep transaction or dispute records and meet tax, accounting, security, and other legal obligations — legal obligation, and legitimate interests where we establish, exercise, or defend legal claims.

Where we rely on legitimate interests, we first weigh them against your rights and freedoms and process only what the purpose requires. You may object to that processing under the rights described below.

Where we rely on consent, such as analytics cookies on the main domain, you can withdraw it at any time and as easily as you gave it. Withdrawal does not affect processing already carried out lawfully beforehand.

A shop website is made available through a public subdomain only after the account holder publishes it. Anyone and any search engine may view, index, cache, or share its business details, contact information, services and prices, opening hours, external links, reviewer names, ratings and review text, and images.

After unpublishing or account deletion, we stop serving the website from tiama.page, but cannot control copies already made by search engines or other third parties. Do not place unnecessary private or sensitive data on a shop website.

When you use AI copywriting, we send necessary business names, categories, areas, addresses, services, imported or selected review text, and reviewer names to AI service and model providers to generate a draft.

AI service and model providers may process data outside Taiwan. Their retention, training, and security practices vary by model endpoint, our service settings, and their policies.

We do not use your content to train our own models, and we do not supply or sell it to anyone for the purpose of training theirs. The AI providers we use do not train models on what we send them under their API terms, and we have not authorised them to do so. If a change of provider or configuration ever changes this, we will update this policy first and obtain your consent where the law requires it.

Do not submit confidential, sensitive, or personal data that you are not authorised to process.

We do not sell your personal data. We may share necessary data with third parties only in the following circumstances:

• Sign-in providers: Google, Facebook, and LINE.
• Payment and billing services, which independently handle the data needed for payments, tax, invoicing, and refunds.
• Business-data sources: Google, Google Maps, and other data services.
• AI services and the model providers they use.
• Live chat: tawk.to (based in the United States), which provides the chat on our main-domain marketing pages, sign-in page, and dashboard.
• Operations: cloud hosting, databases, object storage, CDN, email, error monitoring, and website analytics and advertising measurement (Google, Meta, X, OpenAI) when enabled.
• To comply with law, court orders, or authorities, or to protect users, third parties, and service security.
• In a reorganisation, merger, or asset transfer, or in another situation with your consent.

Processors acting for us may handle data only as needed to provide their services. Third parties that are independent controllers process data under their own privacy policies.

Necessary cookies support sessions, CSRF protection, remembered sign-in, and language preferences; the language cookie may last for up to one year. Display-mode preference is stored in browser localStorage rather than a cookie. Disabling necessary storage may prevent sign-in or other features from working.

Marketing and dashboard pages on our main domain (tiama.page) use Google website analytics and advertising measurement, the Meta (Facebook) tracking pixel, the X (Twitter) conversion tracking pixel, and the OpenAI ChatGPT ads measurement pixel, but they load only after you allow them. On your first visit we ask with a banner, and no analytics code loads until you choose. You may decline, and the site works exactly the same. Once allowed, Google may set cookies such as _ga. We turn first-party cookies off for both the Meta pixel and the X pixel, so they set neither _fbp nor _twclid, _twpid, and _twsid; Meta and X may still set third-party cookies from facebook.com and their own domains where your browser allows them. The OpenAI pixel sets three cookies: __oppref (ad attribution, about 30 days), __obref (browser identifier, about one year), and __oaiq_consent (your consent status, about 30 days). If you arrive from a ChatGPT ad, until you choose we only hold the ad link’s parameter for your current visit and never send it to OpenAI; it is discarded if you decline. These services collect page interactions, device and browser data, IP-derived information, and identifiers to measure service usage and advertising performance such as completed sign-ups. We also turn off the X pixel’s automatic collection of form contents such as email addresses and phone numbers, and of the content you click, so it sends only the events we define. That data is sent to Google, Meta, X, and OpenAI and handled under their own policies; cookie retention depends on each service’s configuration and browser policies.

Your choice is recorded in browser localStorage together with its time and version and remains valid for at most 180 days, after which we ask again. We also ask again when the purposes change materially. You can change your choice at any time through “Cookie settings” in the footer, so withdrawing is as easy as giving. Clearing browser data clears the record, and we ask again.

Marketing pages, the sign-in page, and the dashboard on our main domain (not shop websites or their previews) show a live-chat button in the corner; the chat itself is provided by tawk.to. The button is our own code: showing it does not contact tawk.to or create a chat visitor-identifier cookie, and only deletes old chat cookies that were written to cover subdomains (see below). We load tawk.to and open the chat window only after you click it. Because you open the chat yourself, it does not go through the consent banner above. Once loaded, tawk.to sets cookies and uses localStorage in your browser to keep the chat connected and recognise a returning visitor so an earlier conversation can continue; the visitor identifier is the cookie whose name begins with twk_uuid_, which tawk.to sets to last about 180 days. It also records your IP address, approximate location, browser, device, referring site, and the chat-enabled pages you view in the same tab after it loads. None of this is sent to tawk.to until you click the chat button; once you click, it is sent even before you type a message. tawk.to stores chat conversations on our behalf. If you do not want to use tawk.to, simply don’t click the chat button; the rest of the site works the same, and you can use the contact form or write to hello@tiama.page instead. To make sure it never loads, even by accident, you can block scripts from embed.tawk.to with a browser setting or content blocker. tawk.to’s cookies are first-party cookies set on our main domain, so blocking only third-party cookies does not stop them; to remove an identifier left from an earlier visit, clear this site’s cookies and site data.

Published shop websites load neither Google website analytics nor the Meta pixel, the X pixel, or the ChatGPT ads pixel. They use our own first-party performance collection instead: no analytics cookie and no localStorage identifier: the server derives a pseudonymous identifier from IP address and user agent to estimate the number of unique visitors. There is therefore no third-party tracking on a shop website to consent to, and no banner appears. The Google, Meta, X, and OpenAI trackers on the main domain are also configured never to write their cookies to a subdomain, so none of _ga, _fbp, _twclid, or __obref follows you onto a shop website. tawk.to’s live chat has no such setting, so before it loads we make cookies that scripts write on that page stay on the main domain, which keeps its visitor identifier (beginning with twk_uuid_) off subdomains; any copy written earlier so that it covered subdomains is deleted the next time you open a main-domain page that shows the chat button, without needing to click it.

That identifier uses a fixed secret, so it can link a visitor’s events across days for as long as the raw events are retained. It is a pseudonymous online identifier rather than anonymous data, and may still constitute personal data under some laws. We use it only for aggregate statistics: we do not build per-visitor activity trails and we never disclose it to businesses.

We rely on legitimate interests for this processing — understanding how shop websites are used so we can operate and improve them. It neither stores nor reads anything on your device, so it is not a technology that requires cookie consent; you may still object to it under the rights described below by writing to hello@tiama.page.

Businesses see only aggregate numbers in their dashboard (for example daily views, estimated unique visitors, clicks per button, and traffic-source distribution). They cannot access individual events, the pseudonymous identifier, or anything that identifies a visitor. Country and source entries with too few events are merged into “Other / too few”.

Access logs from our content delivery network, hosting, and web servers are a separate data set from performance analytics. They are recorded for operations, troubleshooting, and information security, may contain IP addresses and user agents, and are kept for the period needed under our security settings. These logs are never merged into the performance data that businesses can see. Separately, when a shop website receives cookies it never sets, our anomaly monitoring may record the names of those cookies (never their values) and the type of page, to confirm that main-domain cookies are not leaking onto shop websites.

The pricing and billing pages load third-party payment code, pages with maps may load a Google Maps iframe, and the site requests fonts from external font services. These third parties may receive IP address, user agent, referrer, or set necessary technologies. You may use browser controls and provider opt-out tools to manage non-essential tracking. Where applicable law requires it, we will obtain consent before loading non-essential tracking.

Retention depends on the type and purpose of the data:

• Account, business, content, and import-quota records are generally kept until account deletion. Place-fetch records retained to prevent quota resets after deleting a business remain until the account is deleted.
• Session, system, error, and security logs are kept for the period needed under our security settings, troubleshooting, and abuse prevention.
• Support correspondence is kept as needed to resolve and follow up on the request and handle disputes. Live-chat conversations and visitor information are stored with tawk.to; you can write to us to have them deleted.
• Billing and transaction data is retained under payment-service policies and applicable tax, accounting, refund, chargeback, and legal obligations.
• Shop-website performance data: raw events are deleted after 60 days, and no aggregate copy is kept once they are gone. The numbers in a business dashboard are computed on demand from the events that still exist, over a maximum range of 30 days. Where third-party website analytics is enabled on the main domain, that part is retained according to its own configuration and policy.
• Backups and media files may remain temporarily after deletion until backup rotation or object-storage cleanup. Data may be retained longer where required for law, fraud prevention, rights claims, or dispute handling.

When the purpose ends or a retention period expires, we delete, anonymise, or stop using the data unless a legal or other valid retention reason applies.

Account deletion is not self-service at the moment: email hello@tiama.page from the address on your account to request it. If your account has no email address, write from the contact address you entered, or verify your identity through the sign-in provider linked to the account. We confirm that any active third-party payment subscription has been cancelled, then delete the account, linked OAuth identities, local subscriptions and transactions, businesses, and related records from the primary database. The account is not deleted until the subscription is cancelled, so that billing cannot continue after the account is gone.

Deletion does not require payment services, email systems, analytics, error monitoring, search engines, or other independent third parties to immediately delete data they lawfully retain under their own policies. Media objects and backups may also be removed later under the cleanup periods described above. Contact us if you need help confirming or following up on deletion.

Depending on applicable law, you may have the following rights over your personal data:

• Access: query, view, or request a copy.
• Rectification: ask us to complete, correct, or update data that is inaccurate or incomplete.
• Erasure: ask us to delete your personal data.
• Restriction: ask us to pause processing in certain circumstances while keeping the data.
• Objection: object to processing we base on legitimate interests, including the pseudonymous identifier used for shop-website performance statistics.
• Portability: receive the data you gave us in a structured, commonly used, machine-readable format, or have us send it directly to another provider where technically feasible.
• Withdraw consent: withdraw consent you previously gave, at any time, without affecting processing already carried out lawfully beforehand.
• Not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. We do not make such decisions.

To exercise these rights, contact hello@tiama.page. We may first verify your identity and will respond within the period applicable law requires — under the GDPR, within one month of the request, extendable by up to two further months for complex or numerous requests, in which case we tell you why. Exercising these rights is free unless a request is manifestly unfounded or excessive.

If you believe we handle your personal data unlawfully, you have the right to lodge a complaint with a supervisory authority. In the EU or the UK, that is the data protection authority where you live or work, or where the alleged infringement took place; in Taiwan, it is the competent authority for the relevant sector. You are also welcome to contact us first — most issues we can resolve directly.

If you decline to provide account, payment, or business data that is necessary for a feature, we may be unable to create an account, complete a transaction, or provide that feature.

If you are a California resident, the California Consumer Privacy Act (CCPA, as amended by the CPRA) gives you these additional rights:

• To know what categories of personal information we collect, use, and disclose, and to receive a copy of the specific pieces. The categories are listed under “Data We Collect” above.
• To correct inaccurate personal information.
• To delete the personal information we hold, except where we are permitted or required to keep it.
• To opt out of the “sale” or “sharing” of personal information.
• To limit the use and disclosure of sensitive personal information.
• Not to be discriminated against for exercising these rights, including by being denied service, charged a different price, or given a lower quality of service.

We do not sell personal information and do not share it for cross-context behavioural advertising, and we have not done so in the twelve months before the date of this policy. We do not use sensitive personal information to infer characteristics about you, so there is no such processing for you to limit.

To exercise these rights, write to hello@tiama.page. We verify your identity through the email address on your account — or, where the account has none, through the contact address you entered or the sign-in provider linked to it — and respond within 45 days of a verifiable request, extendable once by a further 45 days with notice to you. You may also act through an authorised agent, in which case we ask the agent for your written permission.

Our sign-in, payment, AI, data-source, analytics, error-monitoring, live-chat, email, hosting, and storage providers may process data outside Taiwan, including outside the European Economic Area. Privacy rules may differ from those where you live.

When personal data moves from the European Economic Area or the UK to a third country, we rely on one of these mechanisms: an adequacy decision from the European Commission (or the UK authority) covering that country, or Standard Contractual Clauses agreed with the recipient — together with the UK International Data Transfer Addendum where it applies — plus additional technical and organisational safeguards where they are needed.

Write to hello@tiama.page if you would like to know which mechanism covers a particular transfer.

We use technical and organisational measures proportionate to risk, such as encryption in transit in production, access controls, sign-in and request protections, third-party credential management, and error monitoring. No internet transmission or storage system can be guaranteed completely secure.

If a personal-data incident requires notification by law, we will notify affected people in an appropriate manner and take containment, investigation, and remediation measures.

The service is for people aged 18 or over who operate, or are authorised to represent, a business and who can enter into a contract. We do not direct it at children or anyone under 18, and we do not knowingly collect their personal data. If you believe we have obtained personal data from someone under 18, write to hello@tiama.page and we will delete it and close the account.

This policy takes effect on the date shown on this page and replaces every earlier version. It applies whenever you use the service, wherever you are, including users inside and outside the European Union, the United Kingdom, and Taiwan. Write to hello@tiama.page if you would like a copy of an earlier version.

We may update this policy when features, providers, or laws change and will show the effective date on this page. For material changes, we will provide notice by email, in-app message, or website announcement where reasonably practicable.

If you have any questions about this Privacy Policy or the handling of your personal data, please contact us at hello@tiama.page.