Privacy Policy

This Privacy Policy (“Policy”) explains how Tabbio (“we,” “us,” “our”) collects, uses, shares, and protects personal information when you use our website, apps, and services that power SmartCVs, career profiles, employer pages, and collaboration tools (together, the “Platform”).

This Policy is a privacy notice. Our Terms of Service govern your use of the Platform, and optional processing choices remain under your control as described below.

Controller: Tabbio · Abu Dhabi, United Arab Emirates · hello@tabbio.com

We collect only what we need to run Tabbio and provide features you choose to use.

Account & Login

Email address; password or one-time-code authentication records; and identifiers returned by Google, Apple, or UAE PASS when you choose those sign-in methods.

Profile & SmartCV

Name, headline, work/education history, skills, media/files you upload, portfolio links, optional contact details you decide to show.

Preferences

Job interests, visibility settings, notification choices.

Employers (if you create an employer page)

Company name, role, verification info you provide.

Usage & Device

Security and diagnostic logs (e.g., IP, user-agent, timestamps), device/app information, and limited product events such as step names, feature actions, counts, and durations.

Communications

Messages and feedback you send us or exchange on the Platform.

AI Inputs/Outputs

The text and files you choose to send to our AI features (e.g., résumé generation) and the resulting output.

Cookies/Similar tech

Strictly necessary cookies for sign-in and security; with your consent where required, optional analytics cookies.

We process your information to:

• provide the Platform (profiles, SmartCVs, private links, collaboration, messaging);
• enable password, one-time-code, Google, Apple, and UAE PASS authentication;
• generate AI-assisted content (résumés, summaries) only when you request it;
• enforce your visibility choices and sharing controls;
• keep Tabbio secure (fraud/spam prevention, abuse handling);
• communicate service updates and respond to support;
• improve the Platform (quality, reliability, analytics with privacy safeguards);
• comply with law and enforce terms.

We do not sell personal data.

• Contract - to provide you the Platform you sign up for.
• Other permitted grounds : security, fraud prevention, legal claims, public information you deliberately make public, and other processing allowed by applicable law.
• Consent - public profile publication and search indexing, optional marketing, connecting external accounts, and other optional processing where consent is the appropriate basis.
• Legal obligation : records, compliance, responding to lawful requests.

You decide how your profile appears:

• Public - contact details hidden by default.
• Private Link : an unguessable link you can share or revoke.
• Employers-Only : visible to verified employer accounts.
• Private - hidden.

Public is optional and is not required to keep a Tabbio account. If you choose Public and confirm the indexing notice, you direct Tabbio to publish the public parts of your profile and SmartCV on open web URLs, include them in our public profile sitemap, and make them available to search engines such as Google. This is intended to improve your visibility, reach, employer discovery, engagement, and chances of being found for relevant jobs. Contact fields remain hidden unless you choose to expose a supported contact channel.

If you choose Employers only or Private, or you turn off search indexing where available, we do not add your profile or SmartCV to the public profile sitemap and public crawlers should not receive an indexable profile page from Tabbio.

You can withdraw the Public choice at any time by switching to Employers only or Private. This removes the source page and future sitemap eligibility, although third-party search caches can take time to refresh. You can also control individual fields and delete your account at any time (see §10).

When you use AI features, Tabbio sends only the content you choose (e.g., résumé text, profile data, job information, or a prompt) to the configured AI provider needed to generate the output you request. Depending on the feature and availability, providers may include Google Gemini, Anthropic, or OpenAI. Tabbio does not use your private AI inputs or outputs to train a general-purpose Tabbio model.

AI outputs may contain errors: you should review them before use.

The Career agent is an AI assistant. We identify it as AI at the point where you interact with it. Job matching, candidate discovery, and similar features may organize or recommend information, but employers and users remain responsible for their decisions.

Every place AI is used in Tabbio, and what it will never do on your behalf, is listed on the AI disclosure page.

If you sign in with Google, Apple, or UAE PASS, we receive the account or verified identity attributes required for authentication and the feature you requested. We do not post to those accounts. Optional connectors and personal access tokens can be reviewed, revoked, or disconnected from Tabbio settings.

Strictly necessary cookies run the core Platform (login, session, security).

Optional product analytics are disabled until you make a choice on the relevant browser or device. If you allow analytics, PostHog may receive limited usage and performance events. We configure those events to avoid résumé text, contact details, chat content, prompts, and filenames. Session replay is disabled in our current mobile configuration.

Privacy-minimized error diagnostics through Sentry are handled separately from optional product analytics and help us protect the security and reliability of the Platform. Default personal-information collection is disabled in our Sentry configuration.

You can accept, reject, or later withdraw optional analytics through Cookie Preferences on our website or Privacy settings in the app. Withdrawing stops future optional analytics on that browser or device. Blocking necessary cookies may affect sign-in and core functionality.

We share personal information only with:

• Service providers (processors) that host, store, email, analyze, secure, or power AI features for us: under contracts limiting use to our instructions.
• Current service categories include cloud/application hosting and storage (Railway, Vercel, Neon, DigitalOcean, and Upstash), communications and notifications (SendGrid and Expo), analytics and error diagnostics (PostHog, Sentry, and, when enabled, Langfuse), subscriptions (RevenueCat and the applicable app store), connected-account infrastructure (Nango), configured AI and voice providers (Google Gemini, Anthropic, OpenAI, and ElevenLabs), and background-workflow infrastructure (Trigger.dev). A provider is used only when its related feature is enabled, and not every provider receives every category of data.
• Employers or other users when you choose to share (e.g., apply to a job, enable Employers-Only visibility, or share a Private Link).
• Legal/safety recipients where required by law, to protect rights, security, or prevent fraud.
• Business transfers (e.g., merger or acquisition), where the successor is bound by this Policy or an equivalent.

We do not disclose your private contact details publicly by default. We do not sell your personal data.

We keep personal data only as long as needed for the purposes above.

When you request account deletion: we disable account access and revoke active sessions immediately. We then verify erasure of the account and associated personal data from active Tabbio systems and send deletion instructions to applicable processors. We aim to complete verified erasure within 30 days unless a legal retention duty or a technically necessary provider schedule requires longer.

• provider-managed backups expire under their restricted retention schedules and are not restored for ordinary product use,
• minimal records may be retained where required for law, fraud prevention, security, billing, or legal claims,
• content already shared with others (e.g., via Private Link or downloads) which we cannot recall from third parties.

If a Public profile was indexed before deletion or before you changed visibility, search engines may keep cached snippets for a period after we remove or block the Tabbio page. We cannot control those third party caches, but deletion or privacy changes remove the source page from Tabbio and future sitemap submissions.

We use industry-standard safeguards (encryption in transit, hardened hosting, access controls). No method is 100% secure, but we work to protect your data and promptly address issues.

If a data incident posing a risk to you occurs, we will notify you and/or regulators as required by law.

Our providers operate in multiple countries, so data may be processed outside the UAE or your country of residence. Where required, we use contractual and technical safeguards for cross-border processing and limit each provider to the data needed for its service.

Depending on your location, you may have rights to access, correct, delete, restrict, object, port your data, and to withdraw consent (for consent-based processing).

You can exercise many controls in your account settings or by contacting hello@tabbio.com. We will respond within the timelines required by law.

If the GDPR applies to you, you also have the right to lodge a complaint with the data-protection supervisory authority in the EU or EEA country where you live, work, or believe an infringement occurred.

Tabbio is not directed to children under 16 (or higher local age where applicable). If you believe we collected a child's data, contact us to delete it.

The Platform may link to third-party sites or apps. Their privacy practices are their own; review their policies before sharing data with them.

We may update this Policy to reflect changes in our practices or law. We will post the new effective date, and for material changes we will provide notice (e.g., email or in-app). Continued use after the effective date means you accept the updated Policy.

Questions about privacy? Reach us at hello@tabbio.com.