Privacy Policy
Version 2026-10-01. Operated by Teb, an online service operated from Israel by its individual owner; paid purchases are sold and invoiced by Freemius, Inc. as merchant of record.
This policy explains how Teb (“Teb”, “we”) processes personal data when you use the Teb website, connector and API (the “Service”). We are the data controller for this processing. Contact: support@tebhq.com, Online-only service. Our postal address in Israel is provided on request by email and appears on every invoice.
1. What we collect
| Data | Source | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Account: user id, email, name, sign-in method, sign-in timestamps | You, via our identity provider (WorkOS AuthKit; optionally Google) | Create and secure your account, tie Handoffs to you | Contract (art. 6(1)(b)) |
| Handoffs: goal, decisions, where you stopped, open items, style notes, materials; optionally a full conversation transcript | Your AI tool, when you ask it to save to Teb | Provide the Service (store and return Handoffs) | Contract |
| Connections: identifier of each AI tool client you connect, first and last use | Your AI tool’s OAuth client | Show and let you disconnect connected tools; security | Contract; legitimate interest (security) |
| Usage events: which operation (save, resume, list, view), when, which tool; no content | Generated by the Service | Quotas, abuse prevention, service statistics | Contract; legitimate interest |
| Billing: token purchases and spends, Freemius license and payment identifiers | You, Freemius | Provide paid features, accounting, fraud prevention | Contract; legal obligation (accounting) |
| Technical: IP address, user agent, request logs, error logs | Your browser or AI tool | Operate, secure and debug the Service, rate limiting | Legitimate interest (security and operation) |
| Support correspondence | You | Answer your requests | Legitimate interest; contract |
Payment card details are collected and processed by Freemius, our merchant of record; we never see full card numbers. We do not knowingly collect data from children under 16.
2. What we do not do
- We do not run AI models on your Handoffs. The summary is produced by the AI tool you use.
- We do not sell personal data, use it for advertising, or train models on it.
- We do not use tracking or advertising cookies. See the Cookie Policy.
- We do not read your Handoffs except when you ask for support and give permission, or where required to investigate abuse or comply with law.
3. Retention
- Free-plan Handoffs: deleted 30 days after saving; full transcripts after 7 days.
- Handoffs paid with tokens: kept until you delete them or your account.
- Usage events: 90 days.
- Billing records: as long as accounting law requires (typically 7 years).
- Account data: until you delete your account, then removed from live systems immediately and from backups within 30 days.
- Request and error logs at our hosting provider: up to 30 days.
4. Security
- Data is stored in the European Union (Frankfurt) with encryption at rest; full transcripts are additionally encrypted by Teb with a key held outside the database.
- All traffic uses HTTPS. Sign-in uses OAuth 2.1. Share links carry a secret key; only holders of the full link can read that Handoff on the web.
- Access to production systems is limited to the operator and protected by multi-factor authentication.
- If we become aware of a personal-data breach that is likely to risk your rights, we will notify the competent authority within 72 hours and affected users without undue delay. See the Security page.
5. Who we share data with
We use the following processors, each bound by a data-processing agreement and processing data only on our instructions. The current list is maintained at /legal/subprocessors.
- Vercel Inc.: Application hosting, serverless functions, edge network, logs (USA (functions pinned to Frankfurt, EU)).
- Supabase Inc.: PostgreSQL database and storage (EU (Frankfurt, Germany)).
- WorkOS Inc.: Authentication (AuthKit), OAuth for AI tool connectors, session management (USA).
- Google LLC: Optional sign-in provider (Google account) (USA / global).
- Freemius Inc.: Payments, invoicing, tax handling (merchant of record) (USA).
- Cloudflare Inc.: Domain registration and DNS (USA / global).
We may also disclose data when required by law, to protect our rights or users, or as part of a merger or acquisition (with notice to you).
6. International transfers
Your Handoffs are stored in the EU. Some processors (hosting edge, authentication, payments) operate in the United States. Transfers from the EU/UK rely on the EU-U.S. Data Privacy Framework where the processor is certified, and otherwise on Standard Contractual Clauses with supplementary measures. Israel is recognized by the European Commission as providing adequate protection.
7. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your data, to data portability, and to withdraw consent. You can exercise most rights yourself:
- Export all your data as JSON from the dashboard (Account → Download export).
- Delete individual Handoffs, disconnect tools, or delete your entire account from the dashboard.
- For anything else, email support@tebhq.com. We answer within 30 days and may need to verify your identity.
You may lodge a complaint with your supervisory authority. In the EU, find yours at edpb.europa.eu; in the UK, the ICO; in Israel, the Privacy Protection Authority.
8. California and other US state privacy laws
We do not sell or share personal information for cross-context behavioral advertising and do not use sensitive personal information to infer characteristics. California residents have rights to know, delete, correct and to non-discrimination; exercise them as described in section 7. We do not respond to “Do Not Track” signals because we do not track users across sites.
9. Israel
Under the Israeli Protection of Privacy Law, 5741-1981, you are not legally required to provide us with data; providing it is your choice, and without it the Service cannot be delivered. You have rights of access and correction, which you can exercise as described above.
10. Automated decisions
We make no decisions with legal or similarly significant effects on you by automated means.
11. Changes
We will post changes here with a new version date and, for material changes, notify you by email or in the dashboard before they take effect.