Privacy Policy

Last updated: June 2026

Who we are

Taca is a research demonstrator built by FoxxeLabs Limited (Letterkenny, Co. Donegal, Ireland) in connection with MSc Cyberpsychology research at Atlantic Technological University (ATU) Donegal. The data controller is FoxxeLabs Limited. Contact: todd@foxxelabs.ie.

What Taca collects

Scale responses: Two anonymised 1–5 scores per session (your responses to the two online-situation questions), together with a count of how many messages you exchanged with the AI. These are stored in aggregate with no identifying information — no name, email address, IP address, or device identifier is stored alongside them.
Chat messages: The text you type in the conversation screen is sent to the Anthropic API for processing and a reply is returned to your browser. Taca does not store your chat messages. They are not written to any database or log. See below for Anthropic's role as a data processor.
Theme preference: If you choose a display theme, it is saved in your browser's localStorage. It stays on your device and is never sent to our servers.

Taca does not use cookies, does not require registration, and collects no personal data.

Legal basis for processing

Scale response data is processed on the basis of legitimate interests in academic research (Article 6(1)(f) GDPR), carried out under ATU ethical guidelines. Chat messages are processed transiently on the basis of your implied consent when you choose to type and send a message — they are not retained after the API response is returned.

Anthropic as data processor

Chat messages are processed by Anthropic PBC (San Francisco, CA, USA) acting as a data processor under Taca's use of the Anthropic API. Anthropic does not use API conversations to train its models by default, and is bound by its Privacy Policy and applicable data processing terms. Standard Contractual Clauses apply for transfers outside the EEA.

Security and abuse prevention

To protect the service from automated abuse and to keep the AI interaction available for genuine participants, our server briefly processes the IP address of each incoming request using FoxxeLabs Sentinel, an in-house threat-intelligence service. Suspicious requests (for example, automated scanning or rate-limit breaches) are recorded as security events and may be reported to AbuseIPDB, a shared abuse database. This processing is carried out on the basis of our legitimate interest in network and information security (Article 6(1)(f) GDPR, Recital 49). IP addresses processed for security are not linked to your scale responses and are not used to identify you as a research participant.

Retention

Chat messages: not retained (processed in-flight, discarded on response).
Aggregate scale scores and message counts: stored in an access-controlled database and retained as anonymised research data for the duration of the study and any subsequent analysis or publication.
Security events (IP address, request path, timestamp): retained by Sentinel for abuse prevention, and where reported, by AbuseIPDB under its own policies.
Fly.io access logs (HTTP request logs, no body content): retained for up to 7 days by the hosting provider.

Your rights

Under GDPR you have the right to access, correct, or request erasure of personal data we hold about you. Because your research responses are stored without any name, email, or identifier linking them to you, we cannot single out or retrieve an individual participant's record. IP addresses processed for security are not linked to research responses. If you have any concern, contact us at todd@foxxelabs.ie.

You also have the right to lodge a complaint with the Data Protection Commission (Ireland).

Changes to this policy

If this policy changes materially, the "last updated" date above will be updated. Continued use of Taca after a change constitutes acceptance of the revised policy.