1. Who we are
Tidepool is owned and operated by Vinayak Rao and Dominick Namis (the "Owners"). This Privacy Policy explains what data we collect, how we use it, and your rights.
2. What we collect
- Account data, email, name, and organization information from Supabase Auth.
- Workspace data, deals, invoices, contracts, expenses, partners, posts, and other content you create.
- Payment data, Stripe Connect account identifiers and payment-link metadata. We never see or store raw card numbers; all payment processing is handled by Stripe.
- Usage data, feature usage counts (e.g. AI call counts) used to enforce plan tiers.
- Operational logs, server logs, error reports, and webhook deliveries retained for diagnostics.
3. How we use your data
- To operate and improve the Service;
- To authenticate you and enforce workspace access controls;
- To process payments via Stripe to your connected account;
- To send you transactional email (account events, invoice notifications);
- To respond to support requests.
We do not sell your data. We do not use your workspace content to train third-party AI models.
4. Subprocessors
The Service relies on the following third parties to function:
- Supabase, database, authentication, file storage.
- Vercel, application hosting and edge compute.
- Stripe, payment processing via Stripe Connect.
- Anthropic, AI features (vision extraction, generation). Inputs are not used to train Anthropic\'s models.
- Resend, transactional email delivery.
5. Security
Data is stored in Supabase Postgres with row-level security that scopes every row to your organization. Contract files are stored in a private bucket and accessed only through server-side signed URLs. We use HTTPS everywhere and store API keys and tokens in encrypted environment variables.
6. Retention & deletion
We retain your data for as long as your account is active. You may request export or deletion of your workspace at any time by emailing dom@tdpl.ai. We respond within thirty (30) days.
7. Your rights
Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict processing. To exercise those rights, contact us at dom@tdpl.ai.
8. Children
The Service is not directed at children under 13. We do not knowingly collect data from children. If you believe we have, contact us and we will delete it.
9. Changes
We may update this policy as the Service evolves. Material changes will be communicated through the Service or via email.
10. Contact
Questions about this policy or your data should go to dom@tdpl.ai.