Draft — have a solicitor check this before taking on customers.
Last updated: 27 September 2026
Who we are
Tabwheel is run by [Your name / company]. We are the “controller” of the personal data described here. You can contact us at [contact email].
The short version
- We keep your information with Supabase in the EU (Ireland).
- Only people in your workspace can see your cards and files.
- We don't sell your data, show ads, or use analytics or tracking scripts.
- You can export your data at any time, and ask us to delete it.
What we collect
If you join the waiting list
Your name, email address, the kind of business, the size of your team and what you'd use Tabwheel for. We use it to decide who to invite next and to email you an invite. We keep it until you ask us to remove it, or until early access ends and we no longer need it.
If you sign in
You sign in with Google. Google tells us your name, email address and profile picture link. We never see your Google password. We use these to create your account and show your name in the app.
What you put in Tabwheel
Your cards, notes, files, photos and settings. This may include details about other people, such as your customers. You decide what goes in, and you're responsible for having a good reason to keep it. We only process it to run the service for you.
Technical information
Like any website, our servers and our providers see your IP address and browser details when you connect, and may keep them in short-lived logs for security. The app stores your sign-in session and a few preferences (such as which view you last used) in your browser. These are needed for the app to work; we don't use advertising or analytics cookies.
Why we're allowed to use it
- To provide the service you asked for (contract): your account, workspace and everything in it.
- Legitimate interests: running the waiting list, keeping the service secure, and backups.
- Legal obligations: if the law requires us to keep or share something.
Where it's kept, and who helps us
- Supabase hosts the database, sign-in and file storage, in the EU (Ireland, eu-west-1).
- Google handles sign-in when you choose “Sign in with Google”.
- GitHub stores the nightly database backup (see below).
- Our web server serves the pages. [Hosting provider and location]
- Google Fonts supplies the typefaces on our pages, so your browser fetches them from Google, which sees your IP address.
Some of these providers are based in the United States. Where data leaves the UK or EU, we rely on the safeguards the law requires, such as the EU–US Data Privacy Framework or standard contractual clauses. [Confirm for each provider]
Keeping it safe
- Every workspace is private. The database itself checks that you belong to a workspace before showing anything from it.
- Files are private too. A link to an image works only for a limited time.
- Connections are encrypted (HTTPS).
Backups and how long we keep things
We copy the database every night and keep each copy for 30 days. The copy holds cards, notes and settings, not uploaded files. When you delete a card it goes to Trash for 30 days, then it's deleted for good. Deleted data can stay in a backup copy until that copy expires.
If you ask us to close your account, we delete your workspace and account within [30] days, apart from backup copies, which expire on their own.
We don't
- sell or rent your data;
- show ads;
- use analytics, tracking pixels or other tracking scripts;
- read your cards, except when you ask us for help or the law requires it.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to limit how we use it, or to object to how we use it. You can also export your whole workspace yourself from the workspace menu. To ask, email [contact email]. We'll reply within a month.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ico.org.uk) in the UK, or your local data protection authority in the EU. We'd appreciate the chance to put it right first.
Changes
If we change this notice in a way that matters, we'll tell you by email or in the app before it takes effect.