Privacy Notice

1. Who we are

Tabby is operated by G. Ochoa LLC (“Tabby”, “we”, “us”). We act as the data controller for personal data collected through tabbysplit.xyz and the Tabby app. Contact: privacy@tabbysplit.xyz.

2. Personal data we collect

• Account data: email address, display name, and authentication identifiers when you sign up (email/password or Google sign-in).
• Tab data you create: tab names, expense descriptions, amounts, dates, participant display names, and settlement notes.
• Receipt images you choose to upload, processed to extract merchant, total, and date.
• Usage & device data: IP address, browser type, referrer, and product events (e.g. tab created, expense added, upgrade viewed) used for security and product improvement.
• Support messages you send us.
• Payment metadata (subscription status, plan, customer ID) received from our payment processor. We do not store card numbers.

3. How and why we use it

• Provide the Tabby service — creating tabs, splitting expenses, showing balances (contract).
• Authenticate you and secure the service against fraud and abuse (legitimate interests).
• Process receipt images through an AI vendor to extract expense fields (contract).
• Provide customer support (legitimate interests).
• Improve the product using aggregated usage events (legitimate interests).
• Comply with legal obligations (legal obligation).

4. Who we share it with

• Hosting & database: Supabase and Cloudflare, which host the app and store tab data.
• AI processing: Google (Gemini) receives receipt images you upload, solely to extract line-item data.
• Merchant of Record: Paddle.com Market Ltd acts as reseller and processes all payments, subscription management, tax compliance, and invoicing.
• Email delivery: transactional email providers used to send account and receipt emails.
• Professional advisers (legal, accounting) as needed.
• Authorities where required by law.

5. Retention

We keep account and tab data while your account is active. If you delete your account or request deletion, we remove your personal data within 30 days, except records we must keep for legal, tax, or fraud-prevention purposes.

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. To exercise any right, email privacy@tabbysplit.xyz. You may also lodge a complaint with your local data protection authority.

7. Security

We apply appropriate technical and organisational measures — encryption in transit, row-level access controls, and least-privilege access to production systems.

8. Cookies

Tabby uses only essential cookies and local storage required to keep you signed in and to remember your seat in a tab. We do not use advertising cookies.

9. International transfers

Personal data may be processed in the United States and other countries where our providers operate. Where required, transfers rely on Standard Contractual Clauses or an equivalent safeguard.

10. Changes

We may update this notice; material changes will be announced in-app or by email.