Privacy Policy & Data Protection

1. Introduction

Tabula ("we", "us", "our") is committed to protecting your personal data and financial information. This Privacy Policy explains how we collect, use, store, and protect your data in compliance with the EU General Data Protection Regulation (GDPR), the People's Republic of China Personal Information Protection Law (PIPL), and other applicable data protection laws.

2. Data We Collect

We collect and process the following categories of personal data:

• Account Information: Name, email address, and encrypted password
• Financial Data: Transaction records, savings goals, investment data, and budget information that you voluntarily enter
• Payment Information: Processed securely by Stripe; we never store your card numbers
• Usage Data: Login times and feature usage for improving the service

3. How We Use Your Data

• To provide and maintain the Tabula budget tracking service
• To process your subscription payments via Stripe
• To display your financial summaries and reports
• To send important service notifications
• We do not sell, rent, or share your personal data with third parties for marketing

4. Data Security

All data is encrypted in transit using TLS/SSL. Passwords are hashed using bcrypt with a high cost factor. Payment information is handled exclusively by Stripe, a PCI DSS Level 1 certified payment processor. Database access is restricted and monitored. Each user's financial data is strictly isolated and accessible only with their authenticated session.

5. GDPR Compliance (EU Users)

Under the GDPR, you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate personal data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Data Portability: Export your data in a machine-readable format (CSV export is available)
• Right to Restrict Processing: Limit how we use your data
• Right to Object: Object to processing of your personal data

Legal basis for processing: Contract performance (providing the service you subscribed to) and legitimate interest (improving the service).

6. PIPL Compliance (China Users)

In accordance with the Personal Information Protection Law of the People's Republic of China, we:

• Collect only the minimum personal information necessary to provide our service
• Obtain your informed consent before processing personal information
• Provide clear notice of data processing purposes and methods
• Allow you to withdraw consent, access, correct, or delete your personal information
• Implement appropriate security measures to protect personal information

7. UK Data Protection (UK Users)

For users in the United Kingdom, we comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Your rights under UK law mirror those described in Section 5 (GDPR), including the right to access, rectification, erasure, data portability, and the right to object. These rights apply regardless of the UK's post-Brexit status. If you have concerns about how we handle your data, you may contact the Information Commissioner's Office (ICO).

8. US Privacy Compliance (US Users)

For users in the United States, we respect your privacy rights under applicable state privacy laws, including the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). Under these laws, you have the right to:

• Know: What personal information we collect and how it is used
• Delete: Request deletion of your personal information
• Opt-out: Opt out of the sale of personal information (we do not sell your data)
• Non-discrimination: Not be discriminated against for exercising your privacy rights

We do not sell, rent, or share your personal information with third parties for their marketing purposes. Tabula does not use your financial data for any purpose other than providing you with budget tracking services.

9. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you services. If you cancel your subscription and delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal, tax, or regulatory purposes.

10. Cookies

We use only essential cookies required for authentication and session management. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

11. Contact Us

For any questions about this Privacy Policy, to exercise your data rights, or to submit a complaint, please contact us at: [email protected]