1. Introduction
TABI ("Company", "we", "us", or "our") is committed to protecting the privacy of individuals who visit our website (tabi.gg), use our diagnostic tools, engage us for managed services, or interact with a business that uses our lead capture and messaging automation services, including those offered under our ambar product (ambar.gg). This Privacy Policy describes how we collect, use, disclose, and protect your information.
By using our Services, you agree to the collection and use of information in accordance with this policy.
2. Information We Collect
2.1 Information you provide directly
- Contact information: name, email address, company name, job title, phone number
- Diagnostic data: responses submitted through the TABI Engine Score assessment
- Account information: credentials for accessing client dashboards or portals
- Communications: messages, inquiries, and correspondence sent to us
- Payment information: billing details processed through our payment provider (Stripe)
2.2 Information collected automatically
- Usage data: pages visited, features used, time spent, referring URLs
- Device information: browser type, operating system, device type, screen resolution
- Network data: IP address, approximate geographic location
- Cookies and similar technologies: as described in Section 7
2.3 Information from third parties
- Advertising platforms: campaign performance data, account status, and policy compliance information from Google Ads, Meta, TikTok, and other platforms accessed on behalf of clients
- Analytics providers: aggregated website analytics data
- Business partners: referral information from partner organizations
2.4 Information we process on behalf of clients (lead data)
As part of our lead capture and messaging automation services, we process personal information belonging to individuals who contact our clients. This information is collected by our clients through their own advertising accounts and business messaging channels, and is provided to us by the relevant platform so that we can deliver the contracted service. It includes:
- Contact details submitted voluntarily by the individual through a client's lead form on Meta platforms (Facebook and Instagram), including name, email address, phone number, and the answers given to the questions in that form
- Messaging conversations exchanged between the individual and the client's business account on the WhatsApp Business Platform, including messages handled by an automated assistant operated by us on the client's behalf
- Attribution data: the advertisement, campaign, or channel from which the contact originated
- Derived data: a priority score and a short summary of the interaction, generated by us so that the client's sales team can decide whom to contact first
This information belongs to the client, not to TABI. We process it solely to deliver the service that the client has contracted, as described in Section 4. Depending on the client, the destination CRM may be a third-party system that the client already uses, or a CRM operated by TABI on the client's behalf. In both cases the client remains the owner of the data and the data controller.
3. How We Use Your Information
| Purpose | Legal basis |
|---|---|
| Provide and maintain our Services | Contract performance |
| Process diagnostic assessments and generate Engine Scores | Contract performance |
| Manage client advertising accounts and campaigns | Contract performance |
| Capture leads from client advertising forms and messaging channels, qualify them, and deliver them to the client's CRM | Contract performance (as processor, on the client's instructions) |
| Operate automated assistants that respond to enquiries on behalf of clients | Contract performance (as processor, on the client's instructions) |
| Send service-related communications | Legitimate interest |
| Send marketing communications (with consent) | Consent |
| Analyze and improve our Services | Legitimate interest |
| Detect and prevent fraud or abuse | Legitimate interest |
| Comply with legal obligations | Legal obligation |
4. Our Role: Controller and Processor
Our role differs depending on whose information is involved.
As controller. For information about our own website visitors, prospects, and clients — the categories described in Sections 2.1 and 2.2 — TABI determines the purposes and means of processing and acts as data controller.
As processor. For the lead data described in Section 2.4, TABI acts as a processor (service provider) on behalf of the client. The client is the data controller. We process that information only on the client's documented instructions and only for the purposes of the contracted service: qualifying the enquiry, generating a summary, identifying its origin, and delivering it to the client's CRM.
Platform data obtained from Meta, Google, or any other advertising or messaging platform is used solely to provide the service contracted by the client to whom that data belongs. We do not sell it, license it, or transfer it to any third party for advertising, profiling, resale, or any purpose unrelated to the contracted service. We do not combine one client's data with another client's data.
Individuals whose information is processed under this role should direct requests to the client whose business they contacted. If a request reaches us directly, we will forward it to the relevant client and assist them in responding, as described in Section 8.
5. How We Share Your Information
We do not sell your personal information. We may share your information with:
- Infrastructure and business service providers: hosting (Netlify, DigitalOcean), payment processing (Stripe), analytics (Google Analytics), email services, and scheduling tools (Calendly) that assist in delivering our Services
- CRM platforms: HubSpot and Clienty, where lead data is delivered at the instruction of the client to whom that data belongs
- Database infrastructure: Supabase, which hosts the database supporting the CRM that TABI operates on behalf of certain clients
- AI providers: Anthropic, whose language models we use to interpret enquiries, generate the conversation summary, and assign the priority score described in Section 2.4
- Advertising platforms: Google, Meta, TikTok, and other advertising platforms as necessary to manage campaigns on behalf of clients
- Professional advisors: legal, accounting, and insurance professionals as needed
- Legal requirements: when required by law, regulation, legal process, or governmental request
- Business transfers: in connection with a merger, acquisition, or sale of assets, with notice to affected users
All providers listed above act as sub-processors under contract and are permitted to process the information only to provide their service to us. A current list of sub-processors is available on request at privacy@tabi.gg.
6. Data Retention
We retain your information for as long as necessary to fulfill the purposes outlined in this policy:
- Client data: for the duration of the service engagement plus three (3) years, unless longer retention is required by law
- Lead data processed on behalf of clients: conversation state is held transiently in our systems while an interaction is open and is cleared shortly after it closes. Where the client uses a third-party CRM, the record is delivered to that system and the client's own retention policy governs it from that point. Where the client uses the CRM operated by TABI, the record is retained for the duration of the service relationship; on termination it is returned or deleted at the client's request within thirty (30) days. Operational logs that may contain this information are retained for up to ninety (90) days for troubleshooting and security purposes
- Diagnostic data (Engine Score): for twenty-four (24) months from submission
- Marketing contacts: until you unsubscribe or request deletion
- Website analytics: aggregated and anonymized data may be retained indefinitely
7. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal information:
- Access: request a copy of the personal information we hold about you
- Correction: request correction of inaccurate or incomplete information
- Deletion: request deletion of your personal information, subject to legal retention requirements
- Portability: request your data in a structured, machine-readable format
- Objection: object to processing based on legitimate interest
- Withdraw consent: withdraw previously given consent at any time
To exercise any of these rights, contact us at privacy@tabi.gg. We will respond within thirty (30) days. For deletion requests specifically, see Section 8.
8. Data Deletion Requests
This section explains how to request deletion of personal information held by TABI, including information obtained through Meta platforms.
How to submit a request. Send an email to privacy@tabi.gg with the subject line "Data Deletion Request" and include:
- The email address or phone number you used when you contacted the business
- The name of the business you contacted, if you know it
- The approximate date of the contact or conversation
You do not need an account with us to make a request, and there is no charge.
What happens next. We acknowledge receipt within five (5) business days and complete the request within thirty (30) days. We will confirm in writing once the information has been deleted.
If your information was processed on behalf of one of our clients — for example, because you filled in a lead form on an advertisement or wrote to a business through WhatsApp — that client is the data controller. We will delete the information from our own systems and forward your request to that client so they can action it in their own records. We will tell you which client the request was forwarded to.
We may retain the minimum information necessary to comply with a legal obligation, resolve a dispute, or enforce our agreements. If we do, we will tell you which information was retained and on what basis.
9. Cookies and Tracking Technologies
We use the following types of cookies and similar technologies:
| Type | Purpose | Duration |
|---|---|---|
| Essential | Required for site functionality, security, and session management | Session |
| Analytics | Help us understand how visitors interact with our site | Up to 24 months |
| Functional | Remember your preferences and settings | Up to 12 months |
You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of our Services.
10. International Data Transfers
TABI is based in Uruguay. Your information may be transferred to and processed in countries other than your own, including the United States (where many of our service providers operate). We ensure appropriate safeguards are in place for international transfers, including standard contractual clauses where applicable.
Uruguay has been recognized by the European Commission as providing an adequate level of data protection.
11. Security
We implement appropriate technical and organizational measures to protect your information, including encryption in transit (TLS/SSL), access controls, and regular security assessments. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
12. Children's Privacy
Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child, we will take steps to delete it promptly.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date and, where appropriate, by providing additional notice (such as email notification for active clients).
14. Contact Us
For questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us at:
TABI — Data Protection
Montevideo, Uruguay
privacy@tabi.gg