Privacy Policy

1. Data We Collect

We collect the following categories of data in connection with the Service:

• Account information: name, work email, password (stored hashed), role, and authentication data, including data received when you sign in through a supported single sign-on provider.
• Organization profile data: your company name, industry, brand colors, logos, and other organization-level settings you configure.
• Brand assets and uploaded content: images, documents, and copy you or your Organization upload for use in content generation, review, or publishing.
• Generated content: captions, images, and other output produced through the Service, together with the prompts and inputs used to produce them.
• Usage analytics: pages visited, features used, timestamps, device and browser information, IP address, and similar diagnostic data collected automatically as you use the Service.
• Third-party account data: where you connect a social media, advertising, or messaging account (e.g. Meta, TikTok, WhatsApp), data returned by that provider's API, such as page/account identifiers, post performance metrics, and message content relevant to lead engagement features.

2. AI Content Generation & Data Processing

When you use the Service's content generation features, relevant inputs — such as your brand profile, uploaded assets, topic and prompt information, and, where applicable, prior generated content used for continuity — are sent to third-party AI and inference providers for processing. These may include large language model providers (such as OpenAI and Anthropic) for text generation, and image or video generation/inference providers (which may include providers such as fal.ai where video generation is enabled for your plan).

These providers process your data solely to return a generation result and are bound by their own data processing and retention terms, which we select and monitor with the goal of limiting retention and preventing use of your data to train models for the benefit of other customers, except where a provider's terms state otherwise and we have disclosed this to you. We do not sell your Organization Data to any AI or inference provider.

3. Data Storage & Security

Organization Data, including uploaded media and generated content, is stored using Google Cloud Platform infrastructure, including Google Cloud Storage (GCS) and Cloud SQL–backed databases. We apply administrative, technical, and physical safeguards designed to protect your data, including encryption in transit, access controls scoped to your Organization, and encryption at rest for particularly sensitive fields such as personally identifiable customer information.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your data, we will notify you in accordance with applicable law.

4. Third-Party Integrations

Meta / Social Platform OAuth Data

When you connect a Meta (Facebook/Instagram), TikTok, or other social platform account, we receive an access token and associated account/page data through that platform's official OAuth authorization flow. We use this solely to publish content, manage paid boosts, and retrieve performance metrics on your behalf, as authorized by you. Access tokens are stored encrypted and are never exposed in API responses.

Bring-Your-Own-App (BYOA) Credentials

Where the Service supports connecting your own Meta App (rather than a shared Tablab Research app), any App ID, App Secret, or related credentials you provide are stored encrypted and scoped strictly to your Organization — they are never accessible to, or usable on behalf of, any other Organization on the platform. You are responsible for the accuracy of credentials you provide and for revoking them (with your platform provider and within the Service) if they are no longer needed or may have been compromised.

5. Cookies & Similar Technologies

We use strictly necessary cookies and similar local storage technologies to maintain your session, remember your organization context, and support core functionality such as sign-in. We also use analytics technologies to understand how the Service is used, so we can improve it. We do not use cookies to serve third-party advertising on the Service. Where required by applicable law, we will present a cookie consent mechanism before setting non-essential cookies.

6. Data Retention

We retain Organization Data for as long as your account is active and as needed to provide the Service. Following account closure, we retain data for a limited period to allow for reactivation, comply with legal obligations, resolve disputes, and enforce our agreements, after which it is deleted or anonymized in accordance with our internal retention schedules. Some records, such as append-only audit logs and billing records, may be retained longer where required by law or legitimate business need.

7. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, export, or delete personal data we hold about you, and to object to or restrict certain processing. To exercise these rights, contact us using the details in the "Contact Us" section below, or use in-app account and data-export tools where available. We will respond to verified requests within the timeframe required by applicable law. If your account is managed by an Organization (e.g. your employer), some requests may need to be directed to, or coordinated with, that Organization's administrator, as they are the data controller for data your Organization submits about its own customers.

8. Children's Privacy

The Service is intended for business use by organizations and their authorized personnel and is not directed to, or knowingly used by, children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.