Privacy, stated plainly.

Scope and our role

Taormina provides Madds, an AI teammate for distributors’ sales teams. This policy applies to madds.ai, public product demonstrations, pilot enquiries, business outreach, authorized testing, and the WhatsApp, Messenger, email, payment-link and SAP data handled for an agreed supervised pilot. See Your data for the short overview.

Taormina is responsible for personal data we collect directly for our website, demonstrations, sales, security, and authorized testing. For a distributor’s customer records and sales reps’ order messages, the distributor normally decides why and how the data is used. Taormina processes that data under the distributor’s instructions and the written data agreement; the distributor’s own privacy notice also applies.

Taormina is the product and business name used at madds.ai. The legal entity behind it is Taormina OPC, a One Person Corporation registered in the Republic of the Philippines. Taormina OPC is the operator of the Taormina service and of its Meta integration, and is the controller for the data it collects for its own purposes described above. Questions about this notice, about website data, or about authorized test data can be sent to the public contact above.

This policy does not replace the privacy policies of Meta, a connected business, a payment provider, or another service you choose to use.

Personal data we handle

Depending on how you interact with Taormina, we may handle:

Website demo requests are stored using Netlify Blobs so Taormina can review and respond to your enquiry. Optional preferred demo times are stored with the request. Netlify Forms supports internal request notifications to our team. The form asks for business contact details and optional workflow context; please do not include private customer details.

Business outreach. We may email people in decision-making roles at Philippine distributors to introduce Madds, using business contact details that they or their company have published, such as company websites, job advertisements and business directories. We do not buy or scrape lists. Our basis is legitimate interest. If you ask us to stop, we stop the same business day and keep only your address and the date, so we never write again. We delete the details of people who do not reply after 12 months. You may object at any time by emailing patrick@madds.ai, or complain to the National Privacy Commission.

• Contact and business information. Your name, work email, company, industry, number of locations, role, and the information you include in an enquiry, pilot request, support message, or account setup.
• Meta connection data. WhatsApp business-account, phone-number and app identifiers; sender and recipient identifiers; message and event identifiers; administrator-granted permissions; connection status; and access tokens or similar server credentials needed to communicate with Meta. We receive only data made available through permissions granted to the app.
• Customer-channel data. Sender and recipient identifiers, message text, supported attachments, replies and postbacks, timestamps, message identifiers, and delivery or read status supplied through WhatsApp. Authorized Meta app tests may also create identifiers and messages for the channel being tested.
• Operational and transaction data. Information needed to prepare or complete an order, including SAP item and customer codes, products, units, packs, prices, tax groups, stock, delivery addresses, payment terms, assigned sales reps, approvals and order results. This may include consent status, operator actions and relevant payment-status or transaction references. Taormina does not need your complete card number, online-banking password, or mobile-wallet PIN.
• Website, device, and security data. IP address, browser and device information, requested pages, time, error and security events, and similar network logs generated when the service is used.

We receive data from you, the business whose channel you contacted, Meta or another connected provider, systems the business authorizes, and the device or network used to reach the service. Taormina does not currently use advertising cookies, the Meta Pixel, or cross-site ad trackers on madds.ai.

How we use personal data

We use personal data only where relevant to:

• connect and operate an authorized business channel;
• receive, understand, route, and respond to customer requests;
• match order lines to business records, apply customer prices, prepare orders, record approvals and SAP results, or hand work to a person;
• maintain consent, channel-window, permission, and safety controls;
• provide the website, customer support, and pilot setup;
• authenticate users, prevent abuse, investigate incidents, and debug failures;
• measure and improve reliability using minimized, aggregated, or de-identified information where reasonably possible; and
• comply with law, enforce agreements, and protect people or the service.

Legal bases and automated assistance

The legal basis depends on the relationship and purpose. It may include your consent; steps requested before or necessary to perform a contract; compliance with a legal obligation; and legitimate interests in providing, securing, supporting, and improving the service where those interests are not overridden by your rights. A customer business may rely on a different lawful basis for the data it asks Taormina to process.

Taormina may use AI to interpret a request, prepare a response, recommend a next step, or carry out an action the connected business has authorized. Consequential actions are designed around permissions, source checks, confirmations, and human handover. Taormina is not intended to make a decision with legal or similarly significant effects about a person based solely on automated processing without an appropriate lawful basis and safeguards.

When data is shared

We may disclose the minimum relevant data to:

• The connected business and its authorized staff so they can see, approve, take over, or complete customer work.
• Channel and system providers such as Meta when needed to receive or send a message, and SAP or another expressly agreed business system when needed to complete an authorized request.
• Service providers that supply hosting, infrastructure, security, communications, and AI processing. An AI processing provider may receive relevant conversation content, business instructions and retrieved records needed to prepare a response or order. The applicable providers and processing arrangements are identified for the pilot before activation.
• Professional advisers, authorities, or another entity in a lawful corporate transaction where disclosure is required or reasonably necessary and subject to appropriate safeguards.

Some providers may process data outside the Philippines. Before a pilot connection is activated, Taormina and the connected business must document the relevant providers, processing locations, lawful basis, contractual allocation, and safeguards required by applicable law. Current website and authorized app-testing providers process data under their own terms and privacy notices. We do not give another business independent rights to use Meta platform data for its own unrelated purposes.

How long we keep data

Website hosting, security, and email providers may keep limited operational or enquiry records under their own controlled schedules. Taormina uses those records only for the purpose for which they were received, service security, or a documented legal requirement.

Authorized Meta app testing may create test messages, identifiers, and technical logs. Requests concerning that test data are handled using the instructions below. Before a pilot processes customer-channel or SAP personal data, Taormina and the connected business must document data-class retention periods, lawful-hold exceptions, subject lookup and verification, deletion execution, and processor deletion responsibilities.

Messages delivered to a sales rep’s WhatsApp or Messenger conversation also remain subject to that app’s own history and deletion controls. Removing a sales rep’s access to Madds does not erase copies already delivered to their phone.

Your choices and rights

Subject to applicable law, including the Philippine Data Privacy Act of 2012, you may ask to be informed about processing; access your data; correct inaccurate data; object to or restrict processing; withdraw consent; request erasure or blocking; receive portable data where applicable; and seek damages or lodge a complaint.

Email patrick@madds.ai. We may ask for limited information to verify the request and protect the person whose data is involved. If a connected business controls the relevant record, we will identify or assist that business so the request reaches the correct decision-maker. You may also complain to the Philippine National Privacy Commission.

Facebook and Meta data deletion

Disconnecting Taormina in the applicable Facebook or Meta business integration settings stops future access through that authorization. A distributor can also contact us to stop its pilot connection. To request deletion of data already received by Taormina:

1. Email patrick@madds.ai with the subject Meta data deletion request.
2. Include your name, the connected business or Page name, and the WhatsApp number, Page, business or app-scoped identifier relevant to your request. Do not send a password, access token, wallet PIN, or full payment credential.
3. For applicable personal data in Taormina's possession or control, we will verify the request, locate the data, manually delete or de-identify it, and instruct any processor holding a Taormina-controlled copy to do the same. A specific documented legal-retention obligation may limit deletion, in which case we will explain the limitation.
4. If a connected business controls a separate record, we will promptly coordinate with that business while still deleting every applicable copy in Taormina's or its processors' possession or control. Routing a request does not replace that obligation.
5. We will acknowledge the request, act promptly, and confirm the outcome or explain any lawful limitation or additional verification needed.

This section is Taormina's public user-data deletion instruction page for Meta app settings. It is available without signing in. It is not an automated Meta data-deletion callback or confirmation-status endpoint.

Security, children, and policy changes

We use measures intended to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction. These include access controls, scoped credentials, encryption in transit, separation between tenants and environments, authenticated provider events, audit records, and data-minimization controls in Taormina's application design. These statements do not claim that a production Meta service is active or independently certified. No service can guarantee absolute security.

Taormina's website and business service are not directed to children. Public demonstrations are intended for adults. A connected business must apply any additional notice, consent, and age rules relevant to its customers and services.

We may update this policy when our service or legal obligations change. We will publish the revised policy here, change the effective date, and provide additional notice when a change materially affects how we use personal data.

Contact Taormina

For a privacy question, rights request, or deletion request, contact:

Taormina OPC operates Taormina, based in the Philippines. Contact patrick@madds.ai for privacy questions, rights requests and objections to business outreach. Our founder is our data protection officer and answers at the same address. A postal address will be published before pilot activation.