Privacy Policy

1. Controller

Email: info@tamilfunction.com
Further contact details are available in the legal notice.

2. Principles and legal bases

We process only data that is necessary to operate the platform, provide requested services, communicate, maintain security or meet legal obligations. Depending on the process, the legal basis is performance of a contract or steps taken before entering into a contract (Article 6(1)(b) GDPR), compliance with a legal obligation (Article 6(1)(c) GDPR), consent (Article 6(1)(a) GDPR) or our legitimate interests (Article 6(1)(f) GDPR).

Our legitimate interests include secure and reliable operation, prevention of misuse, review of Vendor applications and claims, delivery of inquiries and the establishment, exercise or defence of legal claims.

3. Website access and hosting

When the website is accessed, technically necessary connection and log data is processed. This may include the IP address, date and time, requested address, referrer address, browser and device information, HTTP status, and error and security events. Processing is necessary to deliver the website, maintain stability, analyse errors and defend against attacks. The legal basis is Article 6(1)(f) GDPR.

The website, global delivery network and server-side functions are provided by Vercel Inc., USA. Production server functions are configured for Frankfurt, Germany. Vercel's global delivery network and support, security and operational services provided by Vercel and its subprocessors may nevertheless require processing in other countries. Further information: Vercel Privacy Policy.

Fonts are included by Next.js when the website is built and are served from our own delivery environment. Merely accessing the website therefore does not establish a connection to Google Fonts.

4. Strictly necessary cookies and sessions

TamilFunction uses strictly necessary cookies for login, session management and security. They provide the expressly requested login and protected customer, Vendor and admin areas. The legal bases are section 25(2), no. 2 TDDDG and, depending on the account type and use, Article 6(1)(b) or (f) GDPR.

TamilFunction currently uses no optional advertising or audience-measurement cookies and no embedded social-media or review widgets. External Vendor links open only when you select them yourself.

5. Accounts and private planning features

Registration and login

For an account, we process in particular your name, login email address, account role, internal identifiers, confirmation status and security data. The authentication service processes the password; TamilFunction cannot view it in plain text. Email confirmation, login, password reset and changes to the login email help keep the account secure. The legal bases are Article 6(1)(b) and (f) GDPR. An account cannot be provided without a login email address and a sufficiently secure password.

One login may connect a customer area and a Vendor area. Vendor data is treated separately from private customer data. Admin rights are assigned internally only.

Planning data

In the customer area, users may store the event type and date, country, city, guest count, budgets, notes, checklists, required services and favourites. The assignment of a favourite to an individual customer account remains private and is processed only to provide the selected planning features (Article 6(1)(b) GDPR). For approved public Vendor profiles, TamilFunction may display only the anonymous aggregate number of customer favourites. No customer identity is disclosed and the count does not affect search ranking. This limited public signal supports transparent profile engagement (Article 6(1)(f) GDPR).

Optional AI planning assistant

Signed-in customers may deliberately start the AI planning assistant. The event type and date, country, city, guest count, currency, selected services, a free-text note limited to 600 characters and a pseudonymous account identifier are then sent to the OpenAI API. The login email address and telephone number are not sent to OpenAI for this purpose. Please do not enter sensitive personal data in the free-text field.

Processing provides the requested editable planning draft with a cost range, checklist and matching public Vendor suggestions (Article 6(1)(b) GDPR). The result is neither a binding quote nor a solely automated decision with legal or similarly significant effect. TamilFunction does not automatically save the inputs or result to the customer account. Only when the customer expressly imports the draft into the private planner do the general rules for private planning data apply.

Account deletion

A customer may submit a reviewed deletion request in account settings. TamilFunction aims to complete the permanent account deletion within 48 hours. The deletion removes the customer account, its private planning data and favourites. Inquiries that have already been sent remain as separate communication records and are detached from the deleted customer account. A Vendor profile is handled through the separate, reviewed Vendor deletion process so that an existing customer area is not accidentally deleted with it.

6. Vendors, applications, claims and public profiles

Vendor application and claim

For a Vendor application or a claim to an existing Basic listing, we process in particular the account and business relationship, business name, owner or representative details, category, country, city, optional address and profile information, a required private registration phone number, the application text, and review and decision data. The private registration phone number is not public and is not currently verified by SMS. Public telephone, WhatsApp, business email, website and social-media links are separate, optional profile fields. A Vendor application or claim cannot be reviewed without a login email, the required private registration phone number and the business information marked as required in the form.

Where the Vendor Terms are displayed and accepted in the relevant application or claim process, we also store the confirmed business status and acceptance evidence with the document version, checksum, language and time. We do not store an IP address, user agent or device fingerprint for this purpose. Processing is necessary for the application and contract process, manual authority review, platform security and evidence (Article 6(1)(b), (c) and (f) GDPR).

Basic listings created by TamilFunction

TamilFunction may create a free Basic listing from publicly available business information. Sources may include the business's own website, public business profiles, directories or registers. We process only information needed for discoverability, in particular the business name, category, location and business contact details already made public. Where this information relates to a natural person, processing is based on Article 6(1)(f) GDPR. Our interest is to operate a useful and factually accurate marketplace.

To prepare such a listing, an Admin may use an AI form helper to structure publicly visible business information. Either a public Instagram link or handle, or a screenshot of the public profile area together with the visible business information, is sent once to the OpenAI API for that request. The screenshot is not stored in TamilFunction's database or Storage. Suggestions are reviewed manually; they neither publish a listing nor contact anyone automatically. Processing is based on Article 6(1)(f) GDPR and our interest in recording public business data accurately and with data minimisation. The access, correction and objection rights described below remain unaffected.

Where Article 14 GDPR applies, we provide the required information at the first communication, no later than one month after collection or before the first disclosure, unless a statutory exception applies or the person already has the information.

Affected people may request information about the specific source at any time, have information corrected or object for reasons relating to their particular situation. A disputed listing is reviewed and taken offline where a removal request is justified. Contact us at info@tamilfunction.com.

Publication and moderation

After approval, the business name, profile description, category, city and country, service area, languages, images and optional business contacts may be publicly visible worldwide. Search engines and other third parties may index or cache public content. The private registration phone number, login email, claim notes, review documents, moderation processes and deletion requests are not public.

Changes to approved profiles, claims, owner confirmations, suspensions and deletion requests are reviewed by a person. TamilFunction does not make solely automated decisions that produce legal or similarly significant effects.

Vendor deletion request

A Vendor may submit a reviewed deletion request. The public profile is taken offline; final deletion takes place only after the necessary review of inquiries, images, contractual evidence and statutory retention duties. An optional callback request is based on consent and may be withdrawn at any time with effect for the future. Cancellation of an open deletion request is also documented. The private customer area remains unaffected.

7. Contact, customer inquiries and emails

Depending on the form, a contact or Vendor inquiry may include the name, email address, optional telephone number, WhatsApp preference, event type and date, city, guest count, requested service and message. A Vendor inquiry is made available to the selected Vendor for handling. A general contact inquiry is received by the TamilFunction team. The legal basis is Article 6(1)(b) GDPR and, for reliable delivery, abuse prevention and evidence of legitimate communication, Article 6(1)(f) GDPR.

Transactional emails such as confirmations, password emails and inquiry notifications are sent through Resend, operated by Plus Five Five, Inc., USA. In particular, the sender and recipient address, subject, content, sending time, delivery status and technical log data are processed. Resend states that email data is retained for 30 days on standard plans. Further information: Resend Privacy Policy.

8. Location feature

The search feature accesses the device's current location only after you actively select the feature and grant browser permission. The coordinates are added to the search address and processed on the server to calculate distance. They may therefore appear temporarily in browser history and technically necessary server logs. They are not stored as a permanent part of the customer profile. You can select a country and city instead at any time. The legal basis is the location search you expressly request under Article 6(1)(b) GDPR and section 25(2), no. 2 TDDDG.

Vendors may voluntarily provide location coordinates for more accurate distance calculation. These coordinates are stored internally but are not published as coordinates in the public profile. Without exact coordinates, TamilFunction uses the centre of the selected city.

9. Recipients, processors and international transfers

Personal data is disclosed only where necessary for the relevant purpose to:

• the selected Vendor where a customer sends an inquiry to that Vendor,
• Supabase for authentication, database and image-storage services,
• Vercel for hosting, delivery and server-side functions,
• Resend for sending transactional emails,
• OpenAI for deliberately initiated AI form and planning functions,
• authorities, courts or advisers where this is required by law or necessary for legal defence.

Authentication, database and Storage are provided by Supabase Pte. Ltd., Singapore. The active database is located in the eu-central-1 region in Frankfurt. Supabase and its subprocessors may process limited support, security or operational data in other countries. Further information: Supabase Privacy Policy.

The AI functions use the API provided by OpenAI Ireland Ltd. OpenAI states that API inputs and outputs are not used to train its models by default unless the API customer explicitly opts in to data sharing. TamilFunction disables application-state response storage withstore: false. Independently of that setting, content may generally remain in OpenAI abuse-monitoring logs for up to 30 days under the OpenAI API terms; longer retention is possible where OpenAI considers it necessary for legal or safety reasons. Further information: OpenAI Privacy Policy.

For transfers to countries outside the European Economic Area, we use the contractual safeguards provided for by law, in particular the European Commission's Standard Contractual Clauses and, where applicable, adequacy decisions. Data processing agreements are in place with Supabase, Vercel, Resend and OpenAI. Despite these safeguards, another level of data protection may apply in a third country and access by its authorities cannot be completely ruled out.

10. Retention and deletion

We delete personal data when the relevant purpose no longer applies and no legal duty or legitimate reason requires further, where appropriate restricted, retention. Some deletions are implemented through controlled manual reviews. The following criteria are particularly relevant:

• Accounts and private planning data are generally stored until the user deletes them or account use ends.
• TamilFunction does not store a temporary AI planning-assistant result. Only a draft that the customer expressly imports is treated as private planning data.
• Screenshots used by the Admin AI form helper are not stored in the database or Storage. For both AI functions, OpenAI may generally retain API content for up to 30 days for abuse monitoring.
• An active Vendor profile is stored for the Vendor relationship. After a deletion request, it is taken offline; after the final decision is approved, profile data that is no longer needed is generally deleted within 30 days.
• Rejected or withdrawn Vendor applications and claims are generally deleted or anonymised twelve months after the final decision unless a specific security or legal matter requires longer retention.
• Ordinary platform contact inquiries are generally deleted six months after completion. Vendor inquiries are generally retained for twelve months after completion; necessary parts of a specific legal dispute may be restricted until the applicable limitation period expires.
• Rejected or failed image uploads are marked for technical deletion; published images remain stored only while needed for an active profile.
• Evidence of acceptance of the Vendor Terms is generally retained for six years from the end of the calendar year in which the Vendor relationship ends.
• Resend states that sent email data is retained for 30 days on standard plans.
• Technical logs are retained only for the short operational and security period provided by the relevant service provider.
• Encrypted backups are protected separately and retained only as long as needed for reliable restoration. Deletions already completed must not be put back into productive use after a restoration.

Depending on the document, tax and commercial-law records may have to be retained for six, eight or ten years. This duty does not justify continued active use of the entire account or profile.

11. Your rights

Subject to the legal conditions, you have in particular the right to:

• access your processed data (Article 15 GDPR),
• rectification of inaccurate data (Article 16 GDPR),
• erasure (Article 17 GDPR),
• restriction of processing (Article 18 GDPR),
• data portability (Article 20 GDPR),
• object to processing based on legitimate interests (Article 21 GDPR),
• withdraw consent with effect for the future (Article 7(3) GDPR).

To exercise your rights, email info@tamilfunction.com. We may request additional information to securely identify the request. Rights may be restricted where the rights of other people or statutory retention duties prevent fulfilment.

You may also lodge a complaint with a data protection supervisory authority. The authority responsible for our establishment is in particular the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

12. Security and changes

We use technical and organisational measures to protect personal data against loss, manipulation and unauthorised access. These measures include encrypted transmission, access restrictions, role-based permissions, secured uploads and controlled review and deletion processes. Absolute security cannot be guaranteed.

We update this policy when features, providers or legal requirements change. Where a material change requires participation or new consent, affected people will be informed separately.