Privacy policy
Preliminary version, pending legal review.
1. Who we are
Taboza is the controller of the site’s data and the processor of the data subscribing companies record in the system, under the GDPR for EU residents and Brazil’s LGPD.
2. What data we process
On the site: what you enter in forms (name, e-mail, company, phone, message) and your language choice. In the system: the data recorded by the subscribing company, including investors and suppliers, and access logs.
3. Why
To reply to you, create and run the account, bill the subscription, provide support and keep the service secure. We do not sell personal data.
4. Who we share it with
With the providers the service needs: hosting, e-mail delivery and payment processing (outside Brazil, Paddle, which sells the subscription as our reseller; in Brazil, Asaas).
5. Your rights
You may request access, correction, portability or deletion of your data at [email protected]. Data recorded by a subscribing company is handled together with it.
6. How long
While the account is active. When it is suspended (canceled subscription, trial ended or unpaid invoices), the company's data is kept for 90 days, during which it can ask for a full export or reactivate the account; then it is permanently deleted, and it leaves the backups within 90 days after that. We keep only our own billing records (invoices and the account history), for as long as tax law requires.
7. People recorded by a customer
If you are an investor, vendor or user of a builder that uses Taboza, the builder decides about your data: send your request (access, correction, deletion) to the builder. If you write to us, we forward the request to the builder. The system gives the builder the tools to answer it: the report with your data, correction and anonymization.
8. Security
We use encrypted connections, encrypted database and backups, tax IDs (SSN, EIN, CPF, CNPJ) encrypted field by field, isolation of each company's data, two-step verification and monitoring with alerts. If an incident affects personal data, we notify the affected companies within the deadlines the law sets.
9. E-mails
We send the service e-mails (sign-up, password, billing, account notices). News e-mails go only to those who asked for them, and every one has an unsubscribe link and our postal address.
10. "Do Not Track" and GPC
The site does not use advertising cookies or track you on other sites, so it does not change its behavior when the browser sends a "Do Not Track" signal. If we ever use analytics or advertising, we will honor Global Privacy Control (GPC) as a request not to sell or share your data.
11. Children
Taboza is a service for businesses and is not directed to anyone under 16. We do not knowingly collect children's data.
12. Changes to this policy
If we change this policy, we publish the new version here, with its date. Material changes are announced beforehand to the administrator e-mail of each customer company.
13. QuickBooks Online integration
If the company's administrator connects Taboza to QuickBooks Online, Intuit asks them to authorize the access. From then on, Taboza reads and writes only in that company's QuickBooks: the chart of accounts, classes, vendors, customers, service items, and the transactions it sends or reads back (expenses, bills, bill payments, invoices, payments, deposits, transfers, journal entries and their attachments). We use this data only to keep the two systems in step for that company: we do not sell it, use it for advertising, or share it with other companies or third parties. The access tokens Intuit issues are stored encrypted (AES-256-GCM), with the key kept outside the database, and never written to logs; each company's data is kept apart from the others' by row-level security in the database.
14. Disconnecting QuickBooks
The administrator can disconnect at any time, in the system's settings or in QuickBooks. On disconnecting, Taboza revokes the authorization at Intuit and deletes the tokens. What was already sent stays in QuickBooks, and what was read stays in Taboza, both under the company's control. To have the integration data deleted (the account mappings and the sending history), write to [email protected].