Privacy Policy

1. Who we are

Tellis Labs Ltd. ("Tellis", "we", "us", "our") is a company registered in England and Wales (Company No. 16338024). We operate the Tellis product intelligence platform accessible at tellis.ai. If you have any questions about this policy, contact us at hello@tellis.ai.

2. What information we collect

• Contact information: name, email address, company name and role, provided when you book an assessment or sign up.
• Usage data: pages visited, features used, session duration, browser type and IP address, collected automatically via cookies and analytics tools.
• Communications: content of emails or messages you send us.
• Product data: catalogue data you provide or connect to the Tellis platform in order for us to deliver the service.
• Google account data: where you choose to connect a Google account, we access data from Google APIs under the permissions you grant. Section 6 sets out exactly what we access, why, and how to revoke it.

3. How we use your information

• Provide, operate and improve the Tellis platform.
• Send product updates, onboarding materials and service notifications.
• Respond to support requests and enquiries.
• Analyse usage patterns to improve product features.
• Comply with legal obligations.

Use of data obtained from Google APIs is governed exclusively by Section 6, which takes precedence over this section.

4. Legal basis for processing

Where the UK GDPR or EU GDPR applies, we process your personal data on the following bases: performance of a contract (when providing the service), legitimate interests (analytics, product improvement), consent (marketing emails, non-essential cookies, and connecting third-party accounts such as Google), and compliance with legal obligations.

5. Cookies and tracking

We use essential cookies required to operate the site, and optional analytics cookies (e.g. PostHog) to understand how visitors use Tellis. You can accept or reject non-essential cookies using the banner shown on your first visit. You may also update your preferences at any time by clearing your browser cookies and revisiting the site.

6. Google API data and OAuth disclosures

Tellis lets you connect your Google account so we can audit and enrich your product catalogue and show you how it performs in Google's shopping and search surfaces. This section explains exactly what we access, why, and how you can stop it.

What we access, and which feature uses it

With your explicit consent, Tellis requests the following permissions:

Tellis is read-only across all connected Google services. We do not execute insert, update, patch or delete operations against any Google API.

This is worth stating explicitly for Merchant Center. https://www.googleapis.com/auth/content is the permission required by both the Merchant API and the Content API for Shopping, and it supports read and write operations. Tellis uses it only to retrieve catalogue and issue data. We do not call any method that creates, modifies or deletes data in your Merchant Center account. Google does not publish a narrower read-only scope for this functionality.

We request only the permissions required for the Tellis features described above and do not request additional Google API permissions.

How we use it

Data from Google APIs is used only to power features you see in the Tellis interface: catalogue audits, content generation and enrichment, performance reporting, and prioritisation of work. Approved content is published to your own CMS or ecommerce platform through a separate integration you configure. Tellis does not write to any Google service.

We do not use Google user data for advertising, credit or lending decisions, benchmarking against other customers, internal research, or any purpose not described in this policy.

AI processing of Google API data

Tellis uses third-party AI model providers as service providers to generate product content and recommendations displayed to you within the Tellis application. Where Google API data is processed by an AI provider, Tellis sends only the information required to deliver the Tellis feature you have requested, and only after you have authorised the relevant Google connection.

AI models are accessed through Amazon Bedrock, operating within our AWS environment in the United Kingdom, and through the Google Gemini API. Google API data sent for inference is processed only by these service providers, and only for the purpose of producing the Tellis output you requested. They act on Tellis's behalf and may not use the data for their own purposes, for advertising or for profiling.

We configure these services so that data sent for inference is not used to train or improve generalised AI models, and we do not enable optional logging, dataset or data-sharing features that would permit such use. Tellis remains responsible for this data.

Tellis does not use data obtained through Google APIs to develop, train, fine-tune or improve generalised AI or machine-learning models, whether our own or a third party's. We do not build databases of Google user data for model training.

Limited Use

Tellis's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Sharing of Google user data

We never sell Google user data and never transfer it to data brokers, advertising networks or information resellers. It is shared only with the service providers needed to operate the features described above, each bound by a data processing agreement.

Human access to Google user data

Tellis personnel do not access Google API data except where you have affirmatively authorised access to specific data, where access is necessary for security purposes or to investigate abuse, or where required by applicable law.

Storage, retention and deletion of Google user data

What we store. Tellis stores encrypted OAuth credentials for your connection, and caches Google Search Console and Google Analytics performance metrics so that dashboards render quickly without querying Google's APIs on every page load. Cached metrics are retained for a maximum of 30 days, after which they are automatically deleted or replaced with fresh data. All of this is held on encrypted infrastructure hosted with Amazon Web Services in the United Kingdom (AWS London region, eu-west-2).

What happens when you disconnect. Tellis immediately stops calling Google APIs on your behalf, calls Google's token revocation endpoint to invalidate the access token, and permanently deletes all stored credentials and encrypted OAuth tokens from our database. Cached Google API data associated with the connection is deleted within 30 days, except where retention is required by law.

Your own outputs. Content you have generated and saved in Tellis — such as approved product descriptions — is your own Tellis content and remains in your account until you delete it or close your account.

Revoking access

You can disconnect your Google account at any time:

• In the Tellis dashboard, under Settings → Integrations, or
• From your Google Account permissions page at myaccount.google.com/permissions.

To request immediate deletion of Google API data rather than waiting for the standard deletion window, email hello@tellis.ai and we will confirm once complete.

7. Data sharing

We do not sell your personal data. We share data only with trusted sub-processors necessary to deliver our service (e.g. cloud hosting, email delivery, analytics, AI model providers). All sub-processors are bound by data processing agreements and appropriate safeguards. A current list of sub-processors is available on request from hello@tellis.ai.

8. International transfers

Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards such as UK International Data Transfer Agreements, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision.

9. Data retention

We retain personal data for as long as your account is active or as needed to provide services. Contact data from enquiries is retained for up to 24 months unless you ask us to delete it earlier. Retention and deletion of Google user data is governed by Section 6.

10. Your rights

Under UK and EU data protection law you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request erasure of your data ("right to be forgotten").
• Object to or restrict certain processing.
• Data portability where processing is based on consent or contract.
• Withdraw consent at any time without affecting prior lawful processing. This includes disconnecting any third-party account, such as Google, as described in Section 6.

To exercise any of these rights, email hello@tellis.ai. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

11. Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss or disclosure. Data is encrypted in transit (TLS) and at rest. Access to production systems is restricted to authorised personnel, and OAuth tokens, including refresh tokens, are stored encrypted.

12. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email or by posting a notice on our website. Continued use of the service after the effective date constitutes acceptance of the updated policy.

13. Contact

Tellis Labs Ltd. Email: hello@tellis.ai