Privacy Policy

1. Information We Collect

Account information: When you create an account, we collect your email address and any profile information you choose to provide (name, username, bio, avatar).

Payment information: When you subscribe to a paid plan, payment is processed by LemonSqueezy. We do not store your full payment card details. We receive confirmation of payment and subscription status only.

Communications: If you contact our support team, we collect the content of your messages and your contact details.

Templates: If you publish templates, we store the canvas layout data (tile positions, URLs, board configurations) and any metadata you provide (title, description, thumbnail).

Usage data: We collect information about how you use Tabula, including features used, scenes created, tiles opened, and session duration. This helps us improve the product.

Device information: We collect your operating system, app version, and general device type.

Log data: Our servers automatically record information including your IP address, browser type (if using the website), pages visited, and timestamps.

What we do NOT collect

• We do not collect, transmit, or store the content of websites you view inside Tabula tiles.
• We do not read the contents of your webviews, emails, documents, or any page you have open.
• We do not track your browsing activity outside of the Tabula application.
• We do not sell your personal data to any third party.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Tabula Service
• Process subscriptions and payments
• Sync your scenes and settings across devices (cloud sync feature)
• Send you important account and service notifications
• Respond to your support requests
• Detect and prevent fraud, abuse, and security issues
• Comply with legal obligations
• Enforce our Terms of Service

We do not use your information for:

• Selling to advertisers
• Targeted advertising
• Training AI models on your personal data

3. How We Share Your Information

We do not sell, rent, or trade your personal information. We share your information only in these limited cases:

Service providers

We use trusted third-party services to operate Tabula:

• Supabase — database and authentication
• LemonSqueezy — payment processing
• Vercel — website hosting
• Resend — transactional email
• Anthropic — AI assistant features (only the canvas context you explicitly send to the AI assistant is transmitted)

Each provider is bound by their own privacy policy and data processing agreements.

Legal requirements

We may disclose your information if required by law, court order, or government request, or to protect the rights and safety of Tabula and its users.

Business transfers

If Tabula is acquired or merges with another company, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different policy.

Public profile

If you enable a public profile, your username, bio, avatar, and published templates are visible to anyone. You can make your profile private at any time in Settings → Account.

4. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service.

• Account data: Retained until you delete your account
• Canvas snapshots (Memory Mode): Retained for 7 days (Solo plan) or 90 days (Pro/Studio plan)
• Support messages: Retained for 3 years (potential legal claims)
• Payment records: Retained for 7 years as required by tax law
• Analytics: Retained up to 26 months, then aggregated/anonymized
• Security & audit logs: Retained for 12 months
• Backups: Purged within 30 days after account deletion

When you delete your account, we delete your personal data within 30 days, except where retention is required by law.

5. Your Rights (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of access: Request a copy of your personal data
• Right to rectification: Correct inaccurate data
• Right to erasure: Request deletion of your data
• Right to restrict processing: Limit how we use your data
• Right to data portability: Receive your data in a machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, email [LEGAL_EMAIL]. We respond to all requests within 30 days.

Legal basis for processing

• Account provision: Contract performance
• Analytics: Legitimate interests
• Marketing emails: Consent (you can unsubscribe anytime)
• Legal compliance: Legal obligation

Data Controller

[COMPANY_NAME]
[COMPANY_ADDRESS]
[LEGAL_EMAIL]

6. Cookies

The Tabula website uses essential cookies to maintain your session and authentication state. We do not use advertising cookies or third-party tracking cookies.

Types of cookies we use:

• Authentication cookies: Keep you logged in
• Preference cookies: Remember your settings

You can disable cookies in your browser settings, but this may affect functionality. See our Cookie Policy for full details.

7. Children's Privacy

Tabula is not directed at children under 16 years of age. We do not knowingly collect personal information from children under 16. If we discover we have collected information from a child under 16, we will delete it promptly. If you believe we have collected information from a child under 16, contact us at [LEGAL_EMAIL].

8. Security

We implement industry-standard security measures to protect your information, including:

• Encryption in transit (TLS/HTTPS)
• Encryption at rest in our database
• Row-level security on all database tables
• Regular security audits

No method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

9. International Transfers

Tabula is operated from [COMPANY_ADDRESS]. Your information may be transferred to and processed in countries other than your country of residence, including the United States, where our service providers operate.

For transfers from the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) where required.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) provides you with additional rights:

• Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you in the preceding 12 months.
• Right to delete: Request deletion of personal information we collected from you, subject to legal exceptions.
• Right to correct: Request correction of inaccurate personal information.
• Right to opt out of sale/sharing: We do not sell or share your personal information as those terms are defined under the CCPA/CPRA. If this ever changes, we will provide a “Do Not Sell or Share My Personal Information” link.
• Right to non-discrimination: We will not discriminate against you for exercising your rights.

To exercise these rights, contact [LEGAL_EMAIL]. We will verify your request and respond within 45 days (extendable once by an additional 45 days where permitted).

11. Data Breach Notification

In the event of a data breach affecting your personal information, we will notify affected users and the relevant supervisory authorities as required by applicable law. Where the GDPR applies, we will notify the competent supervisory authority within 72 hours of becoming aware of a qualifying breach, and affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. We also comply with applicable U.S. state breach-notification laws.

12. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects concerning you, within the meaning of Article 22 of the GDPR. We may use automated systems for security and fraud-prevention purposes (for example, to flag suspicious activity), but such systems do not make final decisions with legal effects without human review.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email and by posting the new policy at tabula.com/privacy with an updated effective date. Your continued use of Tabula after changes constitutes acceptance of the new policy.

14. Contact Us

For privacy-related questions or to exercise your rights:
Email: [LEGAL_EMAIL]
Subject line: “Privacy Request — [your request type]”