Privacy Policy

Last updated: 7 July 2026

1. Who we are

Tafany (“we”, “us”) provides a browser-based org-design, workforce-planning and compensation tool. This policy explains what data we process and how. For any privacy question, contact privacy@tafany.app.

2. Data you keep on your device (we don’t collect it)

Your organization data — employee records, salaries, pay bands, positions, scenarios, comments — is processed entirely in your browser. By default it is saved only to a local .tafany file that you control and never leaves your device; we neither store nor have access to it. If you explicitly choose “Save to Tafany Cloud” for a project, that project is stored in your company’s account so your team can open it — see §3 below.

3. Data we do process

• Account & licensing data. If you sign in, we process your email address, company/organization name, and authentication tokens to verify your access and licence. Authentication is handled by our provider, Supabase.
• Cloud projects (optional, only if you use “Save to Tafany Cloud”). When you choose to store a project in the cloud, its contents — including the employee and pay data in that project — are saved to our database, scoped by strict row-level security so that only members of your company can access it. Projects you keep local (the default) are never uploaded. You can delete a cloud project at any time.
• Share links (optional, only if you use them). When you create a read-only share link, a snapshot of the selected data is encrypted in your browser before it leaves your device. Only that ciphertext is stored on our servers; the decryption key lives solely in the link you share and is never sent to us — so we cannot read a shared project. You choose its scope, whether to include compensation, and an expiry, and you can revoke it at any time.
• Technical & security data. Our hosting provider (Vercel) automatically logs standard request data such as IP address, browser type and timestamps, used to operate and secure the service.
• Essential cookies. We use only cookies necessary for authentication and security. We do not use advertising or cross-site tracking cookies.

4. How we use data

We use the limited data above only to: provide and secure the service, authenticate you and enforce licensing, operate share links you create, and comply with legal obligations. We do not sell your data or use it for advertising.

5. Data location & residency

Because Tafany is local-first, your organization data stays in your country and on your device by default. Account and share-link data are stored with our infrastructure providers (see §6). For public-sector or regulated customers with in-country data-residency requirements, in-country deployment options are available on request. We follow the principles of the Saudi Personal Data Protection Law (PDPL) and comparable regional regulations.

6. Service providers

• Supabase — authentication and licensing records.
• Vercel — application hosting and request logging.

These providers process data only on our behalf and under their own security and privacy commitments.

7. Retention

Account data is kept for as long as your account is active. Share-link ciphertext is kept until the link expires or you revoke it, then deleted. Your local project files are retained by you, on your device, for as long as you keep them.

8. Your rights

Subject to applicable law, you may request access to, correction of, or deletion of the personal data we hold about you (account data), and you may withdraw consent. You can delete your organization data yourself at any time by deleting the local file, and revoke any share link from within the app. To exercise these rights, contact privacy@tafany.app.

9. Security

Share snapshots are encrypted in your browser (AES-GCM) before transmission; traffic is protected in transit with TLS. No method of transmission or storage is perfectly secure, but local-first design means the most sensitive data typically never leaves your device.

10. Children

Tafany is a workplace tool intended for business use and is not directed at children under 18.

11. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above.

This document is provided for general information and is not legal advice. Please have it reviewed by qualified counsel and complete the placeholders (entity name, contact address) before relying on it commercially.