Privacy Policy

We process the account data you provide, such as your name, email address, and sign-in and session data. When a workspace is used, we process what its users add: clients, opportunities, projects, tasks, notes, comments, files, quotes, invoices, expenses, activity logs and reports. These records may include personal data that workspace users choose to enter. When an agency's client responds to a quote through its link, we keep for the agency the typed name, the decision and note, the time and the quote version. As evidence of the response, Tarteeb also keeps the browser type and a keyed hash of the network address, which does not reveal the address; neither is shown to the agency.

We also collect operational data such as IP address, browser type, request times and errors, and site usage data provided by Vercel Analytics.

We use data to create accounts, verify email addresses and sign you in; to manage workspace membership and permissions; to display and store work records; to produce documents and reports; to send service messages and invoices when users ask us to; and to protect the service, diagnose faults and improve its performance.

We process paid Tarteeb subscriptions through Moyasar and verify the payment result with Moyasar to activate and record the subscription. Payment statuses for an agency’s client invoices are entries made by users, not confirmations from a bank or payment provider.

If you choose to sign in with Google, we receive the identity details you allow, such as your Google account ID, name, email address and profile picture, if any. We use them to create or link your Tarteeb account, sign you in and show who you are in your workspace. Signing in alone does not give Tarteeb access to your Google Calendar or Gmail; each is a separate connection that you choose to make.

Google Calendar sync is an optional feature on plans that include it, and it is offered to users only after Google approves it. Each user connects their own Google account, then chooses one calendar to sync for each workspace, or leaves a workspace unsynced. When you connect, Tarteeb asks to see your Google email address and your list of calendars, and for permission to manage calendar events. Google grants the events permission across all your calendars, but Tarteeb reads and writes only in the calendar you choose to sync.

We use these permissions for three purposes only: to show the calendars you can edit, so you can choose one; to add the workspace dates you are allowed to see to the chosen calendar, and to update and remove them (all-day events carrying an item's title and date, such as a task's due date or a project's start); and to read the events in the chosen calendar, from 30 days ago to one year ahead, to show them to you in Tarteeb's calendar beside your work dates.

From your Google events, Tarteeb keeps only each event's title, start and end dates, and its link in Google; it does not keep the event's time, description, location or guests. These events are shown only to you in the workspace's calendar; other members cannot see them. Tarteeb also keeps the connected Google account's email address, an encrypted refresh token, the chosen calendar's name and ID, and links between each Tarteeb date and its copy in your calendar, so it can update the copy without duplicating it.

You can stop syncing a workspace from the Calendar page: its copies are removed from your Google Calendar, and its imported events and links are deleted from Tarteeb. When you disconnect, syncing stops in all your workspaces, Tarteeb's copies are removed from Google, and Tarteeb deletes the token, the connection details and the imported events. If you leave or are removed from a workspace, its copies are removed from your calendar and its imported events are deleted. Your own events in Google are not changed. To revoke Tarteeb's access at Google itself, use your Google Account settings.

The agency's Gmail inbox is an optional feature on plans that include it, and it is offered to users only after Google approves it. A workspace admin connects one mailbox for the workspace, and Tarteeb asks for permission to read and to send Gmail messages. We use these permissions to show the latest Inbox conversations, and a message's content and attachments when you open it, and to send a reply that you write yourself from the connected account. The workspace's current and future admins and members can read the connected Inbox and reply from it, so connect a mailbox that is suitable to share with them.

Messages and attachments stay in Gmail. Tarteeb does not keep lasting copies of their text, subjects or attachments, and does not build a search index of them; message content is fetched when requested and is not stored in Tarteeb's database. Tarteeb keeps the mailbox address, an encrypted refresh token, the links users choose to make between a conversation and a client or a member of the workspace, and a limited log of send requests to avoid sending twice.

When Gmail is disconnected, Tarteeb deletes the connection details, the token and the conversation links, and also revokes its access at Google; the messages stay in your Google account. If the admin who connected the mailbox leaves the workspace, the mailbox is disconnected the same way and the other admins are notified.

Tarteeb's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Accordingly:

• We use Google user data only to provide and improve the Tarteeb features described in this policy for the people who use them.
• We do not sell Google user data, and we do not use or transfer it to serve advertisements, including personalized or interest-based advertising, or to determine creditworthiness or for lending purposes.
• We do not transfer it to anyone else except as needed to provide these features (for example, hosting with the service providers listed below), for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets with your explicit prior consent.
• No one on our team reads Google user data unless you give explicit consent for specific content, it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or it is for internal operations after the data has been aggregated and anonymized.
• Google user data is not sent to Tarteeb's AI features, and we do not use it to develop, improve or train AI or machine-learning models.

You can review or revoke the access you gave Tarteeb at any time in your Google Account settings.

Workspace data is visible to the people authorized in that workspace, according to their roles. We rely on Vercel to run the site and analytics, on AWS services to host the database and private files, and on Resend to send verification, account recovery, invitation and invoice emails that an authorized user asks to send. We also use Moyasar for Tarteeb subscription payments and Google Analytics and Google Ads for optional site and ad measurement as described below. These providers process the data they need to deliver their services, and data may be transferred across borders depending on where they operate and on applicable law. We may disclose data where the law requires us to. We do not sell user data or Google user data.

Files uploaded to client and project records, and expense receipts, are kept in private storage and served through routes that check access. Logos and copies of issued quotes and invoices are stored in the service database. Resend processes the recipient's address, the message content and the attachment when an invoice or a service email is sent. Tarteeb keeps a log of sending and delivery statuses; delivery does not mean that the recipient has read the message or paid the invoice.

We use essential cookies to keep you signed in and to hold a workspace invitation during sign-up. The site uses Vercel Analytics to measure visits and usage. We do not use data received from Google sign-in, Gmail or Google Calendar for ad measurement or targeting.

With your optional consent, we load Google Analytics and Google Ads to measure public page visits and navigation clicks, time spent on those pages, subscription checkout starts, verified signups and first paid subscriptions. Payment and signup pages use fixed labels without URL parameters. We preserve advertising click identifiers and allowlisted campaign tags for attribution; referring URLs are reduced to their origin, without paths or queries. Google Analytics purchase revenue covers first paid subscriptions only, not renewals or a complete accounting ledger. The tag may use cookies, click identifiers, and browser and network information. We send the event type, a pseudonymous identifier to prevent duplicates, and the subscription value before VAT in SAR. We do not send names, email addresses, card details, workspace content or private client links, and we do not enable personalized advertising or enhanced conversions. The site works if you decline. You can decline or withdraw consent at any time through “Measurement preferences” in the site footer. Your choice is saved in this browser for six months. A previous Ads-only grant requires a new choice before Analytics starts; a previous refusal remains respected. Withdrawal removes first-party Google measurement cookies and stops future measurement and does not delete data already sent.

We limit access to work data by membership and role, encrypt data in transit, and keep files in private storage. Access tokens for Google Calendar and Gmail, when a connection is used, are stored encrypted in the database. No technical measure guarantees absolute protection.

We keep account and work data for as long as needed to provide the service and manage the workspace, and may keep operational logs or documents longer where needed for legal obligations or to protect rights. Deleting a record that may be deleted removes it from the app through the available delete function; temporary copies may remain in backups until their retention cycle ends. Removing your membership from a shared workspace ends your access to it but does not delete the team's records. Disconnecting Google Calendar or Gmail deletes the connection data as described above.

You can edit your profile, manage workspace records according to your permissions, and manage membership from the workspace settings if you are an admin. We may update this policy when the service's features or the way it processes data change, and we will publish the new version and its date here. If our use of Google user data changes materially, we will update this disclosure before applying the change.

For any question about your privacy or this policy, email support@tarteeb.ai. To ask us to delete your account, or a workspace you own together with its data, write to us from your account's email address; we confirm the request and complete the deletion within 30 days, except data the law requires us to keep, such as payment and invoice records, and copies in backups until their retention cycle ends. You can also disconnect Gmail or Google Calendar inside Tarteeb at any time, or revoke Tarteeb's access in your Google Account settings.