Privacy policy

Who is responsible

Tabiz is operated by […], established in Quebec. The person responsible for the protection of personal information, as required by Law 25, is […] and can be reached at privacy@tabiz.ca.

This policy covers app.tabiz.ca and the email sent and received by the service.

What we collect

From you: your email address (the only login identifier — there is no password), your business name and address, your province and your tax numbers.

From your clients, because you enter them: name, email, phone, notes, and the documents you send them. They remain your responsibility; we process them on your behalf.

Automatically: email received at your alias, the technical logs needed for security, and a count of your sends and AI actions for billing.

We use no advertising cookies and do no cross-site tracking. The only cookies we set keep your session open and remember your language.

Where your data lives

The database is hosted by Supabase in the ca-central-1 region (Montreal). The application runs on Vercel in the yul1 region (Montreal). Data and compute therefore stay in Canada.

Email passes through Cloudflare (Email Routing and Email Sending). Message content crosses their network to be delivered; that is inherent to how email works.

Disclosure outside Quebec

Law 25 requires us to tell you what leaves Quebec. This is the complete list, and nothing else leaves:

Cloudflare, Inc. (United States) — routing of incoming and outgoing email. Anthropic, PBC (United States) — only the text you submit to an AI action (drafting a reply, structuring a dictation). Google LLC (United States) — only dictation audio and images submitted for automatic reading. Stripe, Inc. (United States) — only payment data, which we never see; we store no card numbers.

None of these companies is permitted to use your data to train models or for any purpose other than delivering the service. If you use neither the AI nor our email service, nothing leaves Canada.

How long

For as long as your account exists. When you delete your business from Settings, everything is erased immediately and permanently: clients, documents, email, consents.

Two exceptions, and why: payment records required by tax law are kept without any link to your account, and dictation audio is never stored — it is transcribed and discarded.

Your rights

Access and portability: Settings → Export your data hands you everything, as JSON, without asking us.

Deletion: Settings → Delete the company. It is immediate and there is no undo.

Correction, withdrawal of consent, or any complaint: privacy@tabiz.ca. We respond within 30 days, as the law requires. You may also contact the Commission d’accès à l’information du Québec.

Privacy incident

If an incident presenting a risk of serious injury occurs, we notify you and the Commission d’accès à l’information, and we keep the register Law 25 requires.