How Tuteliq handles your data. Zero content retention on child content. GDPR, COPPA, and CCPA compliant. Read our full privacy policy.

Last updated: August 5, 2026 · Effective: August 5, 2026 · Version 1.0

1. Introduction

Tuteliq AB ("we", "us", "our", or the "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose and otherwise process personal data in connection with our services.

  • Organization: Tuteliq AB
  • Swedish organization number: 5594811217
  • Registered address: Sweden
  • UK establishment: Tuteliq AB, UK establishment number BR028608, 3rd Floor, Elite House, 60 Rodney Street, Liverpool, L1 9AD, United Kingdom
  • Data Protection Officer: dpo@tuteliq.ai
  • Support: support@tuteliq.ai

This Privacy Policy applies to our website and services at tuteliq.ai, our child safety API and detection services, and all interactions with our platform.

2. Definitions

  • "Personal Data" means any information relating to an identified or identifiable natural person.
  • "Processing" means any operation performed on personal data, such as collection, recording, storage, retrieval, use, disclosure or erasure.
  • "Data Controller" means the person who determines the purposes and means of processing.
  • "Data Processor" means a person who processes personal data on behalf of a controller.
  • "Child" means any individual under 18 years of age (under 16 for GDPR purposes, under 13 for COPPA purposes, depending on applicable law).

3. Legal Basis for Processing

We process personal data on the following legal bases under GDPR Articles 6 and 9.

3.1 Contract performance (Art. 6(1)(b))

  • Processing necessary to provide you with our services
  • Processing necessary to establish and maintain a customer relationship
  • Processing to execute service agreements

3.2 Legal obligations (Art. 6(1)(c))

  • Swedish Data Protection Act (Dataskyddslagen 2018:218)
  • EU Digital Services Act requirements
  • UK Online Safety Act
  • COPPA for US-based services
  • KOSA for US operations
  • Law enforcement cooperation obligations regarding illegal content (CSAM, grooming)

3.3 Legitimate interests (Art. 6(1)(f))

  • Child safety and protection
  • Platform security and fraud prevention
  • Improvement of our detection algorithms and service quality
  • Compliance monitoring and audit trails

3.4 Consent (Art. 6(1)(a))

  • Where required, we obtain explicit consent for specific processing activities
  • For children under 16 (GDPR) or 13 (COPPA), parental or guardian consent is required

3.5 Special categories of data (Art. 9)

  • Processing of data revealing child protection information under Art. 9(2)(e) – vital interests
  • Processing for law enforcement purposes under Art. 9(2)(f)
  • Processing based on substantial public interest under Art. 9(2)(g)

4. What We Process and What We Don't Store

4.1 We do not store customer content

Tuteliq does not store, retain or back up any customer content:

  • We do NOT store original content (text, images, audio, video, documents)
  • We do NOT retain customer content for any purpose
  • We do NOT back up customer content
  • We do NOT use customer content for model training
  • We do NOT share customer content with third parties

Processing model

  • You submit content via the API, encrypted in transit.
  • Tuteliq processes the content in real time for threat detection.
  • Tuteliq returns only an incident report with the detection result and details.
  • Tuteliq immediately deletes the original content after processing.
  • The incident report is encrypted with your own public key.
  • You control decryption with your private key, which never leaves your device.

4.2 Data we process, then delete

  • Original content: text messages, audio, images, video, documents. Processed in real time and deleted immediately after analysis. Never backed up, never archived.

4.3 Incident reports (returned to you, encrypted)

  • Incident report: detection results (flagged or safe, confidence score, severity).
  • Incident details: type of threat, patterns detected, risk assessment.
  • Mirroring payload: the identifiers you supplied (timestamp, message ID, user ID) so you can match the incident to content in your own systems.
  • Encryption: incidents are encrypted end-to-end using a key pair you generate in your own browser during account setup. Tuteliq never receives your private key.

Important: you hold the private key, so you have full control over incident decryption. Tuteliq cannot read or decrypt the incident content we return.

4.4 Account information (stored to operate the service)

  • Account information: your name, email, company name
  • Billing information: payment method reference and billing address
  • API keys and credentials, stored as hashes for authentication and access control
  • Account settings: preferences, configuration, threshold settings
  • Support communications: your tickets and conversations

Duration: retained for the duration of your subscription plus 30 days after termination, except billing records required by Swedish law.

4.5 Automatically collected data

  • Technical data: IP address and device type, for security and abuse prevention
  • API metadata: call timestamps, endpoints accessed, response status, for debugging
  • Usage analytics: number of API calls and feature usage, for service improvement
  • Cookies: session authentication only (see section 10)

Duration: API logs are retained for a maximum of 30 days; analytics data is aggregated and anonymised.

4.6 Data from third parties

  • Payment processors: billing data only, handled by Stripe. Tuteliq never stores card data.
  • Publicly available sources: company information verification, one-time, not retained

4.7 Website visitors and sales leads

If you contact us, request a demo, or otherwise get in touch as a prospective customer, we act as a data controller (not a processor) for the contact details you give us directly, for example your name, email address and company. This is separate from our processor role, which applies only to content sent through the Services. We use a CRM tool (Zoho CRM) to track these sales conversations and may send you marketing or product emails through Zoho. You can unsubscribe from marketing emails at any time using the link in those emails. We do not sell this information, and we retain it only for as long as reasonably needed to follow up on your enquiry or, if you become a customer, as part of your account relationship.

5. How We Use Your Data

5.1 Primary purposes

  • Service delivery: providing API access and content analysis, detecting harmful content, generating detection results, troubleshooting and maintaining performance.
  • Safety and protection: identifying and reporting illegal content, protecting children from online harm, supporting law enforcement cooperation, preventing abuse of our services.
  • Compliance: GDPR, COPPA, KOSA and UK Online Safety Act obligations, Swedish requirements, processing records and responses to legal requests.
  • Business operations: account management, billing, service updates, customer support.

5.2 Secondary purposes

  • Service enhancement using aggregated and anonymised signals only
  • Safety communications, security alerts and incident notifications
  • Aggregated analytics and performance monitoring

We do not

  • Use customer content for training third-party AI or LLM models
  • Share your data with third-party machine learning companies
  • Use your data for marketing without consent
  • Sell personal data to third parties

5.3 Your responsibility for reporting harmful content

Tuteliq provides detection; you are responsible for reporting. When Tuteliq detects harmful content (including CSAM or child exploitation), we return incident reports to you. You are legally responsible for taking action, including reporting to authorities where required.

  • USA: report to the NCMEC CyberTipline (cybertipline.org), typically within 24–48 hours.
  • EU / UK: report to the Internet Watch Foundation (iwf.org.uk/report) and/or your national authority.
  • Other jurisdictions: report to your local law enforcement agency.

What Tuteliq does

  • Detects harmful content using our AI system
  • Returns incident reports encrypted with your key
  • Helps you identify content requiring action
  • Maintains Internet Watch Foundation membership as part of our child safety commitment

What Tuteliq does not do

  • Store any content you submit
  • Automatically report to authorities
  • Make reporting decisions for you
  • Retain detection history
  • Decrypt your incidents (you control the key)

Your responsibility: as the platform operator, you decide what action to take based on Tuteliq's detection results, and you are responsible for reporting detected harmful content to competent authorities as required by law in your jurisdiction.

6. Data Retention – Zero Storage Policy

6.1 Customer content is not retained

Data category

Retention

Details

Original customer content

Immediate deletion

Text, images, audio and video deleted immediately after processing; never backed up

Incident metadata

Your choice (see 6.6)

Encrypted and returned to you in real time; stored in your account only if incident logging is enabled

Mirroring payload

Identifiers deleted immediately after the incident is generated

6.2 Account and operational data

Reason

Account information

Subscription + 30 days

Account management

Billing and payment data

Subscription + 7 years

Swedish tax law (mandatory)

API authentication keys

Security audit trail

API metadata (logs)

30 days maximum

Debugging and support only

Support tickets

Subscription + 2 years

Customer service, dispute resolution

Account settings

Operational necessity

6.3 Analytics and technical data

Aggregated analytics

90 days

Usage patterns, never linked to individuals

Anonymised metrics

1 year

Service improvement only

Server logs (non-content)

30 days

Security and performance

Error logs

Debugging only

6.4 Children's data – zero retention

  • Original content: deleted immediately after processing
  • Child identifiers: deleted immediately, never retained
  • Detection results: encrypted to you; we do not store them
  • Incident metadata: stored only if you enable incident logging (default 90 days, configurable 7 days to 2 years); otherwise never stored
  • No training use: impossible, because we do not retain the data
  • No backups: child data never enters backup systems

6.5 Deletion process

  • On account termination, all account information is permanently deleted within 30 days
  • Deletion uses cryptographic erasure; backup systems are purged within 60 days
  • Written confirmation of deletion is provided on request
  • Exception: tax records retained for 7 years as required by Swedish law
  • On request before termination, account data is exported in a portable format within 15 days

6.6 Incident logging – customer control

You control whether Tuteliq stores incident metadata for your account. The setting is available in your dashboard under Integrations and can be overridden per request via the API. It affects metadata retention only: original content (text, images, audio, video and documents) is always deleted immediately after processing, regardless of this setting.

6.6.1 What incident metadata is

  • Detection result (flagged or safe) and confidence score
  • Incident type and severity level
  • Detected tactics or patterns
  • Mirroring payload: your own identifiers (message ID, user ID, file name, URL, timestamp)

6.6.2 What is never stored either way

  • Original user-submitted content (text, images, audio, video, documents)
  • Personal information extracted from submitted content
  • Conversation context or surrounding messages
  • User or account data beyond the identifiers you supply

6.6.3 Effect of the setting

Logging enabled

Logging disabled

Original content deleted

Yes, immediately

Incident metadata stored by Tuteliq

Yes (end-to-end encrypted)

No

Incident returned to you

Real time + dashboard

Real time only

Historical query and export

Available

Not available

Default 90 days (7 days–2 years configurable)

Deleted immediately after the API response

6.6.4 Changing the setting and data subject rights

  • Changes propagate to our processing systems within one minute and apply only to API calls received after that point; they are never retroactive
  • Incidents stored before disabling logging remain accessible until they expire or you delete them
  • You may delete incident records manually at any time via the dashboard or API
  • When logging is enabled, Tuteliq processes incident metadata as processor on your behalf and cooperates with verified data subject requests within 30 days
  • When logging is disabled, Tuteliq holds no incident data to access, export or delete

7. Data Recipients and Transfers

7.1 Subprocessors

Service provider

Purpose

Location

Security

Google Cloud Platform

Infrastructure hosting and LLM inference

Frankfurt, Germany (EU)

ISO 27001, SOC 2 Type II

Upstash

Redis caching and rate limiting

EU (GCP Belgium)

SOC 2 Type II, encrypted in transit

Supabase

Database and hosting for the customer account dashboard

Stripe

Payment processing

Ireland (EU), US operations

PCI-DSS Level 1

Zoho CRM

Sales lead tracking and marketing or product emails (prospect contact details only, never Services content)

EU

GDPR-compliant, restricted access

The complete current list is published at tuteliq.ai/legal/subprocessors.

7.2 Legal obligations and law enforcement

We may disclose personal data when required by Swedish courts or authorities, Europol, Interpol or equivalent agencies, law enforcement investigating CSAM or grooming, regulatory authorities such as IMY or the ICO, or a valid court order.

  • We verify the legitimacy of every request
  • We notify you of disclosure when legally permitted
  • We limit disclosure to what is strictly necessary
  • We request confidentiality where possible

7.3 International transfers

  • All data is processed within the EU/EEA as a core commitment
  • We do not transfer data outside the EU/EEA except where required by law
  • Standard Contractual Clauses are used for any necessary transfer
  • We comply with GDPR Chapter 5

8. Data Protection and Security

8.1 Security measures

  • Encryption in transit (TLS 1.2+) and at rest (AES-256)
  • Client-side end-to-end encryption of incident content using keys you generate and hold
  • Role-based access control on the principle of least privilege
  • Multi-factor authentication for administrative access
  • Continuous security monitoring and threat detection
  • Complete audit trails of data access
  • Regular penetration testing and security assessments
  • Documented incident-response procedures
  • Privacy and security training for all staff

8.2 Infrastructure security

  • EU-based infrastructure providers certified to ISO 27001
  • Encrypted backups of operational data with secure recovery procedures
  • Firewalls, DDoS protection and intrusion detection
  • Row-level tenant isolation across all customer data

8.3 Limitations

While we maintain strong security, no system is completely secure. We cannot guarantee absolute protection against unauthorised access, though we employ industry best practices.

9. Your Rights Under GDPR and Swedish Law

9.1 Data subject rights

  • Access (Art. 15): obtain a copy of your personal data and information about our processing.
  • Rectification (Art. 16): correct inaccurate or incomplete data at any time.
  • Erasure (Art. 17): request deletion where data is no longer necessary, subject to legal obligations. Children's data generally qualifies for erasure on request.
  • Restriction (Art. 18): restrict processing while accuracy is contested or during a dispute.
  • Objection (Art. 21): object to processing based on legitimate interest or to automated decision-making.
  • Portability (Art. 20): receive your data in a machine-readable format and transmit it to another controller.
  • Automated decisions (Art. 22): the right not to be subject to solely automated decisions with legal effects, and to obtain human review.
  • Children's rights (Art. 8, COPPA): parents and guardians may exercise all rights on a child's behalf.

9.2 How to exercise your rights

  • Send a request to dpo@tuteliq.ai or support@tuteliq.ai.
  • Include your name, account details and the right you are exercising.
  • We may request verification of your identity.
  • We respond within 30 days, extendable to 90 days for complex requests.
  • Requests are free unless manifestly unfounded or excessive.

10. Cookies and Tracking Technologies

Cookie type

Your control

Session

Authentication, maintaining login

Session duration

Browser delete

Preference

Language, display settings

Settings menu

Analytics

Usage statistics, performance

13 months

Opt-out

CSRF protection, bot detection

Automatic

10.2 Cookie consent

On first visit we present a consent banner where you can accept all cookies, reject non-essential cookies, or customise categories. You can update preferences at any time in your account settings.

10.3 Third-party tracking

  • Google Analytics for aggregated usage statistics, in a GDPR-compliant configuration
  • Cloudflare for security and performance

You can opt out of Google Analytics at tools.google.com/dlpage/gaoptout.

10.4 Do Not Track

If your browser sends a "Do Not Track" signal we respect it and limit tracking to essential functions only.

11. Automated Decision-Making and Profiling

11.1 AI-driven content detection

Our service uses machine learning to detect harmful content.

  • We do not make binding decisions affecting legal rights based solely on automation
  • We do not use automated profiling for customer evaluation or eligibility
  • We do not make marketing or discrimination decisions based on automated processing
  • We do not train models on your customer content

11.2 Algorithm transparency

  • Detection models achieve 97–99% accuracy depending on content type, with a false positive rate of roughly 1–3%
  • AI is not fully effective; human review is recommended for critical decisions
  • Flagged content can be reviewed by your team, and we provide detection reasoning
  • You can request review of incorrect detections

11.3 Your rights

  • Request human review of any automated detection
  • Obtain an explanation of an automated decision
  • Appeal or challenge detection results
  • Object to reliance on automated processing

12. Compliance with Specific Regulations

12.1 GDPR

  • Legal basis established for all processing
  • Privacy by design implemented
  • Data Protection Impact Assessments for high-risk processing
  • Data Processing Agreements available for all customers
  • Breach notification procedures per Article 33
  • Appointed Data Protection Officer

12.2 Swedish Data Protection Act (2018:218)

  • Compliance with Swedish supplementary provisions
  • Swedish tax retention requirements respected
  • Cooperation with the Swedish Authority for Privacy Protection (IMY)

12.3 COPPA (US, children under 13)

  • Verifiable parental consent required before collection
  • No targeted marketing to children
  • Limited use of cookies and tracking
  • Parents can review, delete or prevent further collection

12.4 KOSA

  • Age-appropriate design
  • No dark patterns targeting children
  • Transparency about how data is used
  • Default settings prioritise child safety over engagement

12.5 EU Digital Services Act

  • Transparency regarding algorithmic systems
  • Documentation of moderation decisions
  • Cooperation with regulatory authorities and reporting of illegal content

12.6 UK Online Safety Act

  • Safety by design principles
  • Cooperation with Ofcom and UK authorities
  • Child protection measures and transparency about safety features

12.7 CCPA (California)

  • Right to know what personal information is collected
  • Right to delete personal information
  • Right to opt out of selling or sharing, we do not sell data
  • Non-discrimination for exercising rights

13. Complaints and Legal Recourse

13.1 Supervisory authority

You have the right to lodge a complaint with a supervisory authority. Our lead authority is Integritetsskyddsmyndigheten (IMY), imy.se, +46 8 657 61 00. EU residents may also complain in their own member state, and US residents may contact the FTC for COPPA matters.

13.2 Direct contact

Before making a formal complaint we encourage you to contact dpo@tuteliq.ai. We respond within 30 days.

13.3 Legal remedy

You have the right to a judicial remedy if you believe your rights have been violated. Disputes are governed by Swedish law and subject to Swedish jurisdiction.

14. Accountability and Governance

  • Privacy by design in all new services, with data minimisation applied from inception
  • Data Protection Impact Assessments for children's data, large-scale monitoring and AI systems
  • Records of processing activities, audit logs, breach documentation and staff training records
  • An appointed Data Protection Officer providing independent oversight, dpo@tuteliq.ai

15. Changes to This Privacy Policy

  • We may update this policy to reflect changes in law, improve clarity, adapt to new technologies or respond to regulatory guidance
  • Material changes: registered users are notified by email with 30 days' notice
  • Non-material changes take effect immediately
  • Previous versions are available on request

16. Contact Information

  • Data Protection Officer: dpo@tuteliq.ai , response within 30 days
  • Customer support: support@tuteliq.ai
  • Postal: Tuteliq AB, Sweden, organization number 5594811217

17. Additional Privacy Resources

  • Data Processing Agreement (DPA)
  • Subprocessor list
  • AI Transparency
  • Trust Center
  • Terms of Service

Document version 1.0 · Last updated August 5, 2026 · Next review August 5, 2027

Get Started Free · Read Documentation · View Pricing