Privacy Policy

1. Information we collect

• Account information, your name, email address, and workspace details when you sign up.
• Content you add, clients, projects, invoices, contracts, and files you create or upload.
• Payment information, handled by Paddle, our merchant-of-record payment provider. We do not store your full card details.
• Usage and device data, basic technical information such as log data, IP address, and how you interact with the Service, used to keep it secure and improve it. Optional analytics (see below) is only collected with your consent.

2. How we use your information

• To provide, maintain, and improve the Service.
• To process payments and manage your subscription.
• To provide the Contract Scanner and other AI-assisted features.
• To respond to your support requests.
• To send you product updates and tips, which you can opt out of at any time.
• To keep the Service secure and comply with legal obligations.

3. AI processing

When you use the Contract Scanner, the document you upload is processed by automated systems, which may include third-party AI providers, to generate a summary and highlight risks. We share only what is needed to perform that processing and do not permit it to be used to train third-party models.

4. Cookies & analytics

Tabrio uses strictly necessary cookies to keep you signed in and remember your active workspace. With your consent, we also use Vercel Web Analytics and Speed Insights, a cookieless analytics service that receives only generic, non-identifying event data (we scrub URLs and routes before sending), and PostHog, product analytics used both client-side in your browser, where it sets its own cookie and local storage, captures page views (including the visited URL), and identifies signed-in users by their account ID and email, and server-side for a small number of product events, which set no cookie of their own. Client-side and server-side product events are both off by default and start only after you accept; you can change or withdraw your choice at any time from the cookie banner or the “Cookie settings” link in the footer. Billing-provider webhook events, which have no browser request to read a cookie from, are sent with a de-identified id regardless of your analytics choice. For the full list of cookies and how to manage them, see our Cookie Policy.

Session replay. With the same Analytics consent, we use PostHog to record a masked, visual replay of how you use the app — what you clicked and navigated to — so we can spot confusing screens and fix bugs. Form inputs and other typed content are always masked; entire screens that carry financial or contract details (invoices, contract reports, workspace and billing settings) are excluded from recording altogether, not merely masked. Recordings are retained for up to 30 days and then deleted. This is materially broader processing than the page-view and event data above — it captures what a screen looked like, not just that you visited it. It runs only under the same Analytics consent described above; withdrawing that consent stops both.

Referral attribution. If you follow a Tabrio referral link, we record the referral link and its click total. If you later sign up through that link, we may record the first referral source associated with your account. Referral links never expose your invoice or workspace content.

5. Legal bases for processing

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Contract, to provide the Service you sign up for and manage your account and subscription.
• Consent, for optional analytics cookies. You can withdraw consent at any time.
• Legitimate interests, to send product updates and tips to our users, balanced against your rights; you can opt out at any time.
• Legitimate interests, to keep the Service secure, prevent fraud, and improve our product, balanced against your rights.
• Legal obligation, to meet accounting, tax, and other legal requirements.

6. How we share information & sub-processors

We share information only with service providers who help us operate Tabrio, under agreements that protect your data. We do not sell your personal data. Our main sub-processors are:

• Vercel, hosting and, with consent, cookieless web analytics.
• Supabase, database, authentication, and file storage.
• Paddle, payment processing as merchant of record.
• Resend, transactional and, if you opt in, marketing email.
• Third-party AI providers, automated processing for the Contract Scanner.
• PostHog (EU), product analytics hosted in the EU, used both server-side and, with your consent, client-side in your browser, including masked session recordings.

We may also disclose information where required by law. Paddle processes purchase and subscription information as the merchant of record.

7. Marketing communications

We send product updates and tips to our users by default. You can opt out at any time by toggling it off in Settings → Account or by using the unsubscribe link in any marketing email. Opting out does not affect essential service emails (such as billing or security notices).

8. Data retention

We keep your information for as long as your account is active or as needed to provide the Service. When you delete your account, we delete or anonymise your data within a reasonable period, except where we must retain it for legal or accounting reasons.

9. Security

We use technical and organisational measures to protect your data. No method of transmission or storage is completely secure, but we work to protect your information and to notify you of any material breach as required by law.

10. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data; to object to or restrict certain processing; and to withdraw consent at any time (including for analytics and marketing). You can delete your account and associated data yourself at any time from Settings → Account. You also have the right to lodge a complaint with a supervisory authority. To exercise these rights, contact us at help@tabrio.app or through our Help center.

11. Client data you enter (our role as processor)

For your own account and use of Tabrio, we act as the controller. For the personal data you enter about your clients and contacts, you are the controller and we act as a processor on your behalf, processing that data only to provide the Service. You are responsible for having a lawful basis to provide us that data. A data-processing agreement (DPA) is available on request at help@tabrio.app.

12. International transfers

Your data may be processed in countries other than your own. Where we transfer data internationally, we take steps to ensure it remains protected in line with applicable law.

13. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you and update the date above.

14. Contact

CD CREATIVE SOLUTIONS S.R.L., Republic of Moldova, mun. Chișinău, MD-2014, Studenților, 9/11. Tax ID: 1023606000273. Questions about your privacy can be sent to help@tabrio.app.