Privacy policy

Who we are

Tabreel (tabreel.com, the Tabreel Chrome extension and the Tabreel API) is run by Tabreel, an independent software business based in the European Union. We are the controller of the personal data described here. For anything about your data, write to s.kouider@kouidev.com. We have not appointed a data protection officer; that address reaches the person responsible for privacy at Tabreel.

Tabreel turns a sentence into a narrated demo video of your own web app: an AI agent clicks through your app in your own browser tab, a voice reads the script, and we render the video.

What we collect and why

• Your account. Your name, email address and profile picture, and the teams (workspaces) you belong to, through our sign-in provider Clerk. We use them to sign you in and keep each workspace's videos apart. Legal basis: our contract with you.
• What you make. Your prompt, the address of the page you start on, the plan the agent follows (its steps, the parts of the video and their titles), the script, your voice and style choices, and your brand kit (name, colour, logo, closing title and link). We need them to make and edit your videos. Legal basis: contract.
• Recordings. While a video is made, a recording of your tab (the raw take) and a log of the cursor and of each step (where it clicked, what it typed). We need them to render the video. Legal basis: contract.
• Voice and videos. The voiced lines, and the finished files: the MP4, captions, the vertical version, the GIF and a poster frame. Legal basis: contract.
• Billing. Your plan, your subscription's status and how many videos you made this month. Payments go through Stripe: we never see or store card numbers. Legal basis: contract, and our legal duty to keep invoices.
• Logs and limits. Technical logs (request IDs, workspace IDs, errors, which page address a step ran on, the AI model used and its token count and cost) and usage counters for rate limits and budgets. We use them to keep the service running, secure and affordable, and to stop abuse. Legal basis: our legitimate interest in a working, secure service.

We don't sell your data, show ads, or use advertising or analytics trackers. The only cookies are the ones that keep you signed in (Clerk) and remember your language.

What the AI sees

To decide each next step, to plan the video and to write its script, we send our AI provider, OpenAI: your prompt, a snapshot of the page you are on (its address, its title, a text outline of what is on screen and a screenshot of the visible page), the steps taken so far, and your script when you ask for changes. We don't keep these snapshots: they exist only for the request. OpenAI processes them under its API terms, which do not allow it to train its models on them.

Before any snapshot or recording is taken, the extension blurs email addresses and phone numbers on the page, and anything you mark with Blur this; the text outline is redacted the same way. Blurring catches common formats but can't catch everything, so make videos in a demo workspace with sample data whenever you can.

What the extension does in your browser

• It works only on the tab you start a video in, and only while that video is being made. Chrome shows its "started debugging this browser" bar the whole time.
• It records the tab only after you press Make video (or Send, in One take), and stops when the video is done.
• It keeps your settings, the sites you chose to blur, and the current video's progress in your browser's extension storage. That data stays on your device.
• It uses your existing sign-in to your own app inside your tab. Your passwords and that app's session never leave your browser.

Who processes it

These companies process data for us, under contracts that limit them to what we ask. Voices are made on our own servers, so your script isn't sent to a voice provider.

Transfers outside the EU

Some of these providers process data in the United States. Where they do, the transfer is covered by the EU Standard Contractual Clauses or the EU-US Data Privacy Framework, depending on the provider.

How long we keep it

Deleting a video or your account removes the data from Tabreel within minutes. Copies in database backups are overwritten within 7 days.

Share links

A video's share link and embed are public: anyone who has the link can watch the video. Links are long and random, so they can't be guessed. Deleting the video makes them stop working.

Your rights

Under the GDPR (and similar laws) you have the right to:

• Access and take your data with you: Settings → Download your data gives you everything we keep for your workspace as a file.
• Delete it: delete a video on its page, or your whole account in Settings. Any paid plan ends at once. Stripe keeps past invoices, as tax law requires.
• Correct it: edit your videos and brand kit, and your name and email in your account settings.
• Object to or restrict how we use your data, and withdraw consent where we rely on it.
• Complain to a data protection authority. Ours is the data protection authority of the EU country where Tabreel is established, but you can go to the one where you live.

For anything you can't do yourself, write to s.kouider@kouidev.com. We answer within one month.

Security

Everything travels over HTTPS. Files are stored privately and only reach your browser through links that expire, except share links you choose to publish. Each workspace sees only its own videos. Our databases and internal services aren't reachable from the internet.

Children

Tabreel is a tool for businesses and isn't meant for anyone under 16.

Changes to this policy

When we change this policy we update the date at the top. If a change matters, we tell you by email or in the app before it applies. This policy is governed by the GDPR and the law of the EU country where Tabreel is established.

Contact

Tabreel, an independent software business based in the European Union. Email: s.kouider@kouidev.com.