Privacy Policy

1

Who we are & scope

This Privacy Policy ("Policy") explains how Tabbio ("we," "us," "our") collects, uses, shares, and protects personal information when you use our website, apps, and services that power SmartCVs, career profiles, employer pages, and collaboration tools (together, the "Platform").

By using the Platform, you agree to this Policy.

2

What we collect

We collect only what we need to run Tabbio and provide features you choose to use.

3

How we use personal information

We process your information to:

• provide the Platform (profiles, SmartCVs, private links, collaboration, messaging);
• enable authentication (Magic Login and Google sign-in);
• generate AI-assisted content (résumés, summaries) only when you request it;
• enforce your visibility choices and sharing controls;
• keep Tabbio secure (fraud/spam prevention, abuse handling);
• communicate service updates and respond to support;
• improve the Platform (quality, reliability, analytics with privacy safeguards);
• comply with law and enforce terms.

4

Legal bases (where applicable)

• Contract (to provide you the Platform you sign up for),
• Legitimate interests (security, product improvement, anti-fraud balanced against your rights),
• Consent (optional analytics/marketing, connecting external accounts, and using AI features),
• Legal obligation (records, compliance, responding to lawful requests).

5

Your controls & profile visibility

You decide how your profile appears:

• Public (contact details hidden by default),
• Private Link (an unguessable link you can share/revoke),
• Employers-Only (visible to verified employer accounts),
• Private (hidden).

You can toggle visibility of individual fields (e.g., phone/email). You can delete your account at any time (see §10).

6

AI processing

When you use AI features, Tabbio sends only the content you choose (e.g., résumé text, profile data, job info) to our AI service provider ("Gamni API") to generate outputs you request. We require our provider to use the data solely to deliver the requested service and not to train generalized models on your personal data unless you opt in.

7

Google sign-in and social connections

If you sign in with Google, we receive basic account info necessary for authentication. We do not post to your accounts. Any optional connections you enable can be disconnected in your settings at any time.

8

Cookies & similar technologies

Strictly necessary cookies run the core Platform (login/session/security).

Optional analytics cookies (where used) help us understand usage; we ask for consent where the law requires it. You can manage cookies via your browser settings. Blocking certain cookies may affect sign-in.

9

Sharing of information

We share personal information only with:

• Service providers (processors) that host, store, email, analyze, secure, or power AI features for us—under contracts limiting use to our instructions;
• Employers or other users when you choose to share (e.g., apply to a job, enable Employers-Only visibility, or share a Private Link);
• Legal/safety recipients where required by law, to protect rights, security, or prevent fraud;
• Business transfers (e.g., merger/acquisition), where the successor is bound by this Policy or an equivalent.

10

Retention & deletion

We keep personal data only as long as needed for the purposes above.

When you delete your account: We will permanently delete all your personal data including your profile, SmartCV, messages, files, and account information. However, deletion is subject to:

• a short safety window for recovery if you change your mind,
• your email address temporarily preserved for security purposes to prevent unauthorized account recreation,
• limited records retained as required by law, security, or billing, and
• content already shared with others (e.g., via Private Link or downloads) which we cannot recall from third parties.

11

Security

We use industry-standard safeguards (encryption in transit, hardened hosting, access controls). No method is 100% secure, but we work to protect your data and promptly address issues.

If a data incident posing a risk to you occurs, we will notify you and/or regulators as required by law.

12

International transfers

Your data may be processed outside your country. Where required, we use appropriate transfer safeguards (e.g., contractual protections).

13

Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, object, port your data, and to withdraw consent (for consent-based processing).

You can exercise many controls in your account settings or by contacting ahmed@tabbio.com. We will respond within the timelines required by law.

14

Children

Tabbio is not directed to children under 16 (or higher local age where applicable). If you believe we collected a child's data, contact us to delete it.

15

Third-party links

The Platform may link to third-party sites/apps. Their privacy practices are their own; review their policies before sharing data with them.

16

Changes to this Policy

We may update this Policy to reflect changes in our practices or law. We will post the new effective date, and for material changes we will provide notice (e.g., email or in-app). Continued use after the effective date means you accept the updated Policy.

17

Contact