Privacy policy

1. Data controller

2. Introduction

Protecting your personal data matters to us. This policy explains what we collect, how we use it and how we keep it safe when you use Tabbl.

3. Data we collect

We collect the following:

• Identification: first name, last name, email address
• Account data: login credentials, sign-in history
• Event data: details of your events and your guests
• Preferences: dietary requirements, seating constraints

4. How we use your data

Your data is used to:

• Provide and improve our event planning service
• Generate personalised seating plans
• Send invitations to your guests
• Contact you about your account or our services
• Keep our platform secure

5. Legal basis for processing

We process your data on the following grounds:

• Performance of a contract: to provide the service
• Your consent: for marketing communications
• Our legitimate interest: to improve the service and keep it secure

6. Sharing your data

We never sell your personal data. We may share it with:

• Hosting: Vercel Inc. (United States)
• Authentication: Clerk (United States)
• Payments: Stripe (United States) — billing data
• Email delivery: Resend (United States) — invitations and notifications
• AI seating: OpenAI (United States) — guest profiles (first name, age, occupation, interests) are sent to compute affinities
• Audience measurement: Microsoft (United States) — Clarity, only if you have consented
• Advertising: Google (United States) — Tag Manager and Google Ads, only if you have consented. When you buy, your email address is sent in hashed form (SHA-256) so the sale can be attributed to a campaign
• Authorities: where required by law

These providers are located outside the European Union. Transfers are covered by the European Commission's standard contractual clauses.

7. Cookies and trackers

No non-essential cookie or tracker is stored before you consent. On your first visit, a banner lets you accept everything, refuse everything, or choose by category. Refusing is as easy as accepting.

• Strictly necessary: login session, security, and remembering your choice. Required for the service to work, they do not need consent.
• Audience measurement: Microsoft Clarity, to understand how the site is used and improve it.
• Advertising: Google Tag Manager and Google Ads, to measure how our campaigns perform.

You can change or withdraw your consent at any time through the "Cookie preferences" link in the footer, or from your account menu when signed in.

8. Data retention

Your data is kept for as long as you use the service, then archived for 3 years after the last activity on your account. You may request deletion at any time.

9. Your rights

Under the GDPR, you have the following rights:

• Access: obtain a copy of your data
• Rectification: correct inaccurate data
• Erasure: request deletion of your data
• Portability: receive your data in a structured format
• Objection: object to the processing of your data
• Restriction: restrict the processing of your data

To exercise these rights, contact us at contact@tabbl.fr.

10. Security

We apply technical and organisational measures to protect your data against unauthorised access, alteration, disclosure or destruction. This includes encryption in transit (HTTPS) and at rest.

11. Contact

For any question about this policy or your personal data, contact us at contact@tabbl.fr.