4 ms·

From the privacy policy: https://tara.ai/privacy/ https://tara.ai/privacy/ "THIS IS A WEBSITE PRIVACY DRAFTED UNDER U.S. LAW. THIS POLICY IS NOT INTENDED TO SA

From the privacy policy: https://tara.ai/privacy/ https://tara.ai/privacy/ "THIS IS A WEBSITE PRIVACY DRAFTED UNDER U.S. LAW. THIS POLICY IS NOT INTENDED TO SATISFY ANY 'FAIR PROCESSING NOTICE' OBLIGATIONS THAT YOU MAY HAVE UNDER GDPR OR OTHER APPLICABLE NON-US LAW." As a European, it's very unfortunate that I'm not legally able to try your product.

ComputerGuru 6y ago
Is there anything that legally (on the user’s side) stops a European user from using an American service that doesn’t collect/operate on address information but bills their service as “for USA only”?
- whimsicalism 6y ago
  It might be problematic if they ever want to charge customers of their AI service in Europe.
hnlmorg 6y ago
Are you routinely putting GDPR sensitive information into your ticket tracking system? I'd suggestion most people shouldn't irrespective of GDPR. And if you don't then those terms aren't an issue.
- robertlagrant 6y ago
  People's names could be in their logins, which means you have a portion of their employment record.
  - hnlmorg 6y ago
    That's a bit of a stretch. Any large organisation would already have a central database of employee names and job titles that are accessible to everyone within the organisation. That data is available to anyone who looks up an email addresses, let alone any web based services such as Sharepoint. Many businesses even advertise their team publicly as part of their marketing, I can't see court in the EU ruling in favour of the employee on this specific topic. More likely the GDPR notice is to remind people about customer data. Which is fine, that's the right thing for Tara to do. However any company using a Tara-like solution for putting customer data on would be in the wrong. That sort of practice would have failed PCI DSS even before GDPR was a thing.
    - robertlagrant 6y ago
      No. I'm saying that Tara would have access to both my employer name and my name if they had my work email address as a login. That's nothing to do with my employer having my name.
      - hnlmorg 6y ago
        Yes, I got that point and you're missing mine: employer databases are seldom treated as confidential. - You can ring the employer up and receptionists will readily hand this information over - Many companies host AD off site - Business cards It trivial to find the names of people who work in a team because it's leaked everywhere and for everything. I guess maybe, just maybe, if you happened to work in a sensitive industry (eg secret services) then there might be a claim here, but no such organisation would host that kind of development content off site in the first place. So it's a moot argument. The reason Tara publish their GDPR statement is very clearly regarding customer data. Arguing about names and email addresses of customer facing project managers massively misses the point of what GDPR exists for.
        robertlagrant 6y ago
        All of your examples are for someone's own employer. I'm not talking about people who work for Tara. I'm talking about their customers.
        hnlmorg 6y ago
        I'm not talking about people working for Tara -- I was only ever talking from the perspective of Tara's customers!!!! The GDPR message is there to stop Tara customers from putting other customers data in there. Like if I'm a customer of Tara and I provide services to you then you are my customer (not Tara's nor an employee of Tara). The GDPR is to tell me not to put your details in there. It's not there to warn me about my own email address being pseudo-public. The reason this needs to be explicit is because sometimes some organisations will put their own customer data into their support system. While this is generally bad practice it can be excused depending on the type of support system it is and how it's hosted. But the type of system Tara is aimed for, it's not intended to be a customer issue tracker ("customer" here meaning "customers of the people who use Tara" -- not Tara's employees nor Tara's direct customers) and Tara are making that point explicit with their GDPR statement.
- curryst 6y ago
  I don't think GDPR differentiates between sensitive info you asked for, and sensitive info that somebody chooses to put in a field not meant for it. It's both great because it prevents loopholes, and shitty because you have to consider GDPR for fields that definitely should never have any PII in them.
  - hnlmorg 6y ago
    > I don't think GDPR differentiates between sensitive info you asked for, and sensitive info that somebody chooses to put in a field not meant for it. I know GDPR doesn't, my point is if, as a business, GDPR is a requirement from your ticket tracking then you might need to rethink the data you, as a business, are putting on there. Something like this is not intended for tracking customer data. It's intended for assigning work and tracking throughput. If you need to log customer data then you need a different type of issue tracking and something that project managers et al don't all have visibility of.
anonytrary 6y ago
> As a European, it's very unfortunate that I'm not legally able to try your product. How is that their fault? They did not have the resources to follow your nation's regulations, so they chose not to support you. Perfectly reasonable business decision. Vote for better laws or move if you want to be able to take advantage of startups that cannot get past your regulation barriers.

ComputerGuru 6y ago

Is there anything that legally (on the user’s side) stops a European user from using an American service that doesn’t collect/operate on address information but bills their service as “for USA only”?

whimsicalism 6y ago
It might be problematic if they ever want to charge customers of their AI service in Europe.

hnlmorg 6y ago

Are you routinely putting GDPR sensitive information into your ticket tracking system? I'd suggestion most people shouldn't irrespective of GDPR. And if you don't then those terms aren't an issue.

robertlagrant 6y ago
People's names could be in their logins, which means you have a portion of their employment record.
- hnlmorg 6y ago
  That's a bit of a stretch. Any large organisation would already have a central database of employee names and job titles that are accessible to everyone within the organisation. That data is available to anyone who looks up an email addresses, let alone any web based services such as Sharepoint. Many businesses even advertise their team publicly as part of their marketing, I can't see court in the EU ruling in favour of the employee on this specific topic. More likely the GDPR notice is to remind people about customer data. Which is fine, that's the right thing for Tara to do. However any company using a Tara-like solution for putting customer data on would be in the wrong. That sort of practice would have failed PCI DSS even before GDPR was a thing.
  - robertlagrant 6y ago
    No. I'm saying that Tara would have access to both my employer name and my name if they had my work email address as a login. That's nothing to do with my employer having my name.
    - hnlmorg 6y ago
      Yes, I got that point and you're missing mine: employer databases are seldom treated as confidential. - You can ring the employer up and receptionists will readily hand this information over - Many companies host AD off site - Business cards It trivial to find the names of people who work in a team because it's leaked everywhere and for everything. I guess maybe, just maybe, if you happened to work in a sensitive industry (eg secret services) then there might be a claim here, but no such organisation would host that kind of development content off site in the first place. So it's a moot argument. The reason Tara publish their GDPR statement is very clearly regarding customer data. Arguing about names and email addresses of customer facing project managers massively misses the point of what GDPR exists for.
      - robertlagrant 6y ago
        All of your examples are for someone's own employer. I'm not talking about people who work for Tara. I'm talking about their customers.
        hnlmorg 6y ago
        I'm not talking about people working for Tara -- I was only ever talking from the perspective of Tara's customers!!!! The GDPR message is there to stop Tara customers from putting other customers data in there. Like if I'm a customer of Tara and I provide services to you then you are my customer (not Tara's nor an employee of Tara). The GDPR is to tell me not to put your details in there. It's not there to warn me about my own email address being pseudo-public. The reason this needs to be explicit is because sometimes some organisations will put their own customer data into their support system. While this is generally bad practice it can be excused depending on the type of support system it is and how it's hosted. But the type of system Tara is aimed for, it's not intended to be a customer issue tracker ("customer" here meaning "customers of the people who use Tara" -- not Tara's employees nor Tara's direct customers) and Tara are making that point explicit with their GDPR statement.
curryst 6y ago
I don't think GDPR differentiates between sensitive info you asked for, and sensitive info that somebody chooses to put in a field not meant for it. It's both great because it prevents loopholes, and shitty because you have to consider GDPR for fields that definitely should never have any PII in them.
- hnlmorg 6y ago
  > I don't think GDPR differentiates between sensitive info you asked for, and sensitive info that somebody chooses to put in a field not meant for it. I know GDPR doesn't, my point is if, as a business, GDPR is a requirement from your ticket tracking then you might need to rethink the data you, as a business, are putting on there. Something like this is not intended for tracking customer data. It's intended for assigning work and tracking throughput. If you need to log customer data then you need a different type of issue tracking and something that project managers et al don't all have visibility of.

anonytrary 6y ago

> As a European, it's very unfortunate that I'm not legally able to try your product. How is that their fault? They did not have the resources to follow your nation's regulations, so they chose not to support you. Perfectly reasonable business decision. Vote for better laws or move if you want to be able to take advantage of startups that cannot get past your regulation barriers.