Privacy Policy.

1. What we collect

• Account information: name, email address, Google sign-in identifiers, account type (personal or professional), and a company name for professional accounts. Sign-in is via Google; we do not receive or store your Google password.
• Connected mail, calendar and contacts: when you connect an account, we retrieve message content and headers, calendar events, and contacts, going back up to two years, together with the tokens for that connection, which are stored encrypted (AES-256-GCM). If you connect Slack, the messages its read access allows.
• What Tabla produces from it: summaries of threads and people, meeting briefs, prepared draft replies, priority scores, proposed to-dos and alerts, and links between records that describe the same person or company, each tied to its source.
• What you add: notes on people, corrections, drafts, feedback, and applications you build and the results they save.
• Booking submissions: where a Tabla user publishes a booking link, the name, email address, and any note an invitee provides to schedule a meeting, and the calendar event created from it. Invitees are told who they are booking with before they submit, and are shown this policy.
• Usage events: a fixed set of product events with account identifiers and counts, never message content, sent to our analytics provider.
• Technical logs: request logs, with email addresses, identifiers and credentials removed from free text.
• Communications: messages you send us, including support requests.

2. What we deliberately do not do

• We do not sell personal data, and we do not use it for advertising.
• We do not use your data to train machine-learning models, and our model provider may not either.
• To keep the workspace fast, Tabla stores some of what it works out from your records, such as summaries, scores and briefs. Each is deleted when you disconnect the source it came from or delete your workspace.
• The Service acts in your connected accounts only as you direct it: something you do in the product, a standing instruction (such as an away responder you turn on, or calendar buffers around your meetings, which you can turn off), or a booking link you publish. Each action is recorded in your action log.

3. How we use information

To provide, secure, support, and improve the Service; to operate the website; to communicate about the Service; to comply with law. AI features send the relevant content (for example a thread you ask to summarize or reply to) to our model provider, Anthropic, which processes it to return a result under terms that do not permit training on your data.

4. Google user data

Tabla's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: we use Gmail and Google Calendar data only to provide and improve the features you use in Tabla, we never sell it or use it for advertising, and neither we nor our AI providers use it to train generalized AI or machine-learning models. People at Tabla read it only with your permission, for security purposes, or as the law requires.

5. Sharing

We share personal data only with the service providers below, each bound by contract to protect it, and where required by law. If Tabla is involved in a merger or acquisition, data may transfer as part of that transaction with notice.

When you direct it, Tabla also contacts others: the people you email or invite, a sender's unsubscribe address when you unsubscribe, and public web pages and news feeds your applications read. Weather lookups send only a city name.

6. Retention

Retention periods are stated in the Data Retention Policy. In brief: connected data is kept while the source is connected; disconnecting a source deletes its synced records and what was derived from them right away; deleting your workspace ends access immediately and deletes its data within 30 days; deleted data leaves encrypted backups within 7 days.

7. Security

Encryption in transit; encryption of connection credentials at rest; per-account isolation enforced at the database layer; least-privilege internal access; secrets kept in a managed vault, never in code. No method is perfectly secure; we will notify affected users of a breach as the law requires.

8. Your rights and choices

You can disconnect any source at any time in the product, and delete your workspace yourself in Settings, which ends access at once. Export your data first: export is not available after deletion. You may also access, correct, export, or delete your data by contacting privacy@worktabla.com. Where you use Tabla through an organization, requests about records we process on its behalf are fulfilled through that organization. Rights available under the law of your state apply as provided by that law.

9. Cookies and analytics

The Tabla app uses strictly necessary cookies for sign-in and security, and your browser's storage for a few conveniences, such as remembering your details on a booking page. Product analytics are sent from our servers, not from tracking scripts in your browser. The worktabla.com website sets no cookies and runs no analytics.

10. Children

The Service is not for anyone under 18, and we do not knowingly collect their data.

11. Changes and contact

Material changes will be announced on this page and to users by email or in the product, with the effective date updated above. Contact: privacy@worktabla.com. Security reports: security@worktabla.com.