Privacy policy

Effective September 23, 2026 · Tata's Faces Corp ("we", "us")

What we collect

Usage data. When you visit tata1000faces.com we collect standard analytics: pages viewed, approximate location (country/region, derived from IP), device and browser type, referring page, and interaction events such as which Tata you opened. We use Google Analytics 4 and PostHog for this, and Sentry to capture error reports (which may include your browser type and the page where an error occurred). IP addresses are truncated or anonymised where the provider supports it.

Order data. Purchases are processed by Shopify, Etsy, Printful (fulfilment) and Kickstarter (pre-sale campaigns). Those platforms collect your name, shipping address, email and payment details under their own privacy policies; we receive what is needed to make and ship your order. We never see your full card number.

Account and ownership data. If you claim ownership of a Tata (for example by tapping an NFC-tagged item) or sign up for updates, we store your email address (or wallet address, if you choose to connect one), the Tata you own, and the date of the claim. This is kept in our database (hosted on Supabase) so that your ownership and any perks attached to it can be honoured.

Messages. If you write to us, we keep the message and our reply.

Cookies

We use first-party cookies and similar storage for analytics and to remember your settings (such as whether you have seen the opening sequence). We do not run advertising networks and we do not sell your data.

Why we use it

To run the site, fulfil orders, honour ownership perks, fix bugs, understand which parts of the site people use, and send updates you asked for. Our legal basis under GDPR is performance of a contract (orders, ownership), consent (email updates, analytics where consent is required), and legitimate interest (security, error reporting).

Who we share it with

Only service providers that we need to operate: Vercel (hosting), Supabase (database), Google Analytics, PostHog, Sentry, Shopify, Etsy, Printful, Kickstarter, and our email provider. Each acts under its own terms and only for the purpose we engaged it for. We share data with authorities only if legally required.

Social accounts

Our Instagram, TikTok, Facebook, Pinterest and YouTube accounts are operated through each platform's official tools. Interacting with us there is governed by that platform's privacy policy. We do not pull your social profile data into our systems beyond what those platforms show us in their own dashboards.

Tata Companion (browser extension and desktop app)

The Tata Companion is a small animated Tata that lives in your browser or on your desktop. It collects no personal data and sends nothing to us or to anyone else: it has no analytics, no tracking and makes no network requests of its own. To choose what the Tata does, the browser extension looks, on your own device only, at whether media is playing on the current tab, the site's domain name and a rough word count of the page; none of this is stored or transmitted. The desktop app, if you connect it to an AI coding assistant, receives only the names of the tools your assistant uses (for example "email" or "search") from your own computer, never your prompts, files or messages. On Windows, its optional playful features read window positions, program names (never window titles) and the speaker output level on your device so the Tata can perch on windows or cover its ears; it never uses a microphone, and these features can be switched off. Your settings are kept locally on your device. Uninstalling the extension or app removes everything it stored.

Retention

Analytics data is retained for up to 14 months. Order records are kept as long as tax and accounting rules require. Ownership records are kept for as long as the ownership exists or until you ask us to remove them.

Your rights

You can ask us what we hold about you, ask us to correct or delete it, or object to how we use it. Residents of the EU/EEA, UK, California and other jurisdictions with privacy laws have the rights those laws provide. See Data deletion for how to ask.

Children

The site and shops are not directed at children under 13, and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.

Contact

For privacy questions, data access requests, or anything else about this policy, email privacy@tata1000faces.com. We are Tata's Faces Corp, a corporation registered in Florida, USA. For deletion requests see Data deletion.

Changes

We will post any changes here with a new effective date.

TATA 1000 FACES is a brand of Tata's Faces Corp, Florida, USA. Contact: privacy@tata1000faces.com — we answer within a few days. You can also message us on the platform you purchased from.