Tebelis AI — Privacy Policy

Last updated: 5 October 2026

This Privacy Policy explains how Tebelis AI ("Tebelis AI", "we", "us", or "our") collects, uses, shares, and protects personal data in connection with the Tebelis AI platform, websites at tebelis.ai and its subdomains, the mobile application, and the API (together, the "Service"). It should be read together with our Terms of Service and our Data Processing Agreement ("DPA"), which governs the data our customers put into the Service.

1. Our role: controller vs. processor

The Service is used by organisations and professionals ("Customers") and their authorised users.

  • We are the processor (or sub-processor) of the data that a Customer and its users submit to, or generate within, their workspace — forms, records, projects, attachments, the people they add, and submissions to their public forms ("Customer Data"). We process Customer Data on the Customer's documented instructions and under the DPA. The Customer is the controller and is responsible for the lawful basis and notices for that data, including for any third parties whose personal data it enters into the Service.
  • We are the controller of the data we process for our own purposes — for example, account registration and profile data, authentication and security data, billing data, support communications, and website/usage data described below.

This Policy describes both, and notes which role applies. If you are an individual whose data was entered into a Customer's workspace (for example, you are an employee, contractor, or a public-form respondent of a Customer), the relevant controller is that Customer; please direct your requests to them. We will assist them as their processor (see Section 10).

2. Data we collect

2.1 As controller (our own processing)

  • Account & profile — name, email address, password (stored only as a salted, hashed value — we never store passwords in clear text), profile photo (if you upload one), language preference, and the role/membership assigned to you in a workspace. If you were invited to a workspace, your name and email address were provided by the person who invited you. If you sign in with Microsoft, we receive your name, email address and Microsoft account identifier from Microsoft. If you create a workspace, the sign-up form also asks for the workspace name, your country and a short description of what you want to manage; we use them to set up the workspace and to understand who uses the Service.
  • Authentication & security — login and session records, authentication tokens, failed-login and lockout events, and technical data such as IP address and device/user-agent used to keep accounts secure, detect abuse, and maintain an audit trail of significant actions.
  • Billing — for paid plans, your subscription, plan, seat, and payment status, and the billing details collected at checkout through Stripe (billing contact email, organisation name and, where collected for tax purposes, billing address and VAT number). Payments are processed by our payment processor (Stripe); we do not receive or store full card numbers.
  • Support & communications — messages you send us and the transactional emails we send you (for example, email verification, password reset, and workflow notifications).
  • Website & usage data — service logs and error/diagnostic logs generated as you use the Service, and, on mobile, a push-notification token if you enable notifications.

2.2 As processor (Customer Data, on the Customer's behalf)

  • Form templates, records, projects, locations, tasks, and configuration created in the workspace.
  • Attachments — files, documents, and photos attached to records. We remove embedded image metadata (EXIF), including any GPS coordinates, from images before they are stored. A photo's location is kept, and shown on a read-only map, only where the Customer has turned on photo location capture (off by default). Images added to an assistant conversation are sent to the AI service with the request and are not kept in the stored conversation (see Section 2.3).
  • Device location (mobile app, optional): if you allow location access, the mobile app sends your device's current location when you start a new record or send a message to the assistant, so that the nearest project site can be suggested. It is used only for that suggestion and is not saved to your account or to any record. You can turn location access off in your device settings.
  • People data — the individuals a Customer adds to its workspace and any personal data contained in the records and forms it builds.
  • Public-form submissions — data submitted by respondents through a Customer's public intake forms.

2.3 AI interactions

When you use the AI assistant or other AI features, we process your prompts, the relevant workspace context, and the resulting outputs to provide the feature. These are Customer Data, which we process as the Customer's processor (see Section 1). Conversations with the assistant are stored so the feature can function, for support, and so that authorised Tebelis AI staff can investigate a fault in the assistant (see DPA §3.1); images in stored messages are replaced with a placeholder rather than retained inline. AI usage is metered (token counts and cost) to operate billing and budget controls. See Section 4 (AI providers) and Section 8 (Retention).

2.4 Cookies

We use a small number of strictly necessary cookies — principally a session cookie to keep you signed in. A few preferences (for example, your language choice) are stored locally on your device rather than in a cookie. We do not use advertising or analytics cookies, and we do not use the Service to build advertising profiles.

3. How we use personal data

We use personal data to:

  • provide, operate, secure, and maintain the Service and your account;
  • authenticate users, prevent fraud and abuse, and keep an audit trail;
  • process payments and manage subscriptions and seats;
  • provide AI features you choose to use, and meter their usage for billing and budget controls;
  • send service and transactional messages, and respond to support requests;
  • comply with legal obligations; and
  • maintain and improve the Service, including through aggregated and de-identified data that does not identify you, any individual, or any Customer.

We do not sell personal data. We do not use Customer Data to train our or any third party's foundation/AI models, except as expressly permitted by the Customer in writing or the DPA.

4. AI providers (managed and bring-your-own)

The AI features are powered either by models we provide (managed AI) or, at the Customer's choice, by the Customer's own connected AI provider (bring-your-own key). Where managed AI is used, prompts and context are sent to our managed AI service (see Section 6) only to generate the requested output. When we investigate a fault in the assistant, we may also send the conversation concerned to our managed AI service to analyse it, including where the Customer uses its own AI provider (see DPA §3.1). Where a Customer connects its own provider, that processing is additionally subject to that provider's terms, and we store the connection credentials in encrypted form and use them only to operate the features the Customer enables. AI output may be inaccurate and is not professional advice; it must be reviewed by a human before being relied upon.

5. Legal bases (where the GDPR or equivalent law applies)

We rely on: performance of a contract (to provide the Service and your account); legitimate interests (to secure the Service, prevent abuse, keep audit logs, and improve the Service, balanced against your rights); legal obligation (for example, to keep billing/tax records); and consent where required (for example, certain optional communications), which you may withdraw at any time. For Customer Data we process as processor, the Customer determines the legal basis as controller.

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

You need to provide an email address and, unless you sign in with Microsoft, a password to have an account; without them we cannot provide the Service to you. If you do not give a name, the first part of your email address is used instead. A profile photo is optional.

6. Sharing and sub-processors

We share personal data only as needed to run the Service:

  • Sub-processors that help us operate the Service, including cloud infrastructure/hosting, our payment processor (Stripe), our transactional email provider, and our managed AI service (Amazon Bedrock, in an EU region). A current list of sub-processors and the data-hosting region(s) is maintained on our Sub-processors page.
  • Map and address services from OpenStreetMap. When a user asks for a project's site address to be located in the project's settings, that address is sent to the OpenStreetMap Foundation's address-lookup service. Maps shown in the Service are loaded by your browser directly from OpenStreetMap, which therefore receives your IP address and the location shown. See "Other third-party services" on our Sub-processors page.
  • Applications you or your organisation connect to the Service, such as a third-party application or AI assistant connected through the API or an MCP connection. We send such an application the data you authorise it to access. The application is chosen by you or your organisation, and its use of the data is governed by its own terms.
  • Professional advisers and authorities where required by law or to protect our rights, the Service, or others.
  • In a corporate transaction (merger, acquisition, or asset sale), subject to this Policy.

We require sub-processors to protect personal data under terms consistent with this Policy and the DPA.

7. International transfers

We host Customer Data and the personal data we process in the European Union. Our core infrastructure — application servers, database, file storage, and transactional email — runs in an EU region. Some sub-processors are established outside the EEA or process limited data on a global basis (for example, network/traffic metadata for our CDN, payment data through our payment processor, error reports to our error-monitoring provider, push notifications and app updates for the mobile app, and Microsoft sign-in where it is used); where personal data is transferred outside the EEA/UK, we use an approved transfer mechanism (the EU Standard Contractual Clauses and, where relevant, the UK Addendum) and, where available, the EU-US Data Privacy Framework, together with appropriate safeguards. The current sub-processors and their hosting regions are listed on our Sub-processors page. Data-residency commitments are as set out in the DPA or the applicable Order.

8. Retention

We keep personal data only as long as needed for the purposes above, then delete or anonymise it:

  • Account & profile data — for the life of your account, and for a limited period afterwards as needed for legitimate business and legal purposes. If your account is erased, it is disabled at once and anonymised after a 30-day grace period (see Section 10).
  • Customer Data — for as long as the Customer's workspace is active, and otherwise per the Customer's instructions and the DPA. Records that are deleted go to a recoverable recycle bin and are permanently purged after 14 days; deleting a record also removes its attachments from storage on purge. The record's change history in the audit log, which can include earlier and later values of edited fields, is not removed with the record; it is kept for the audit-log period below. When a workspace is deleted because its only user asked for their account to be deleted, all of its content is permanently deleted on the deletion date, 30 days after we schedule it (see Section 10); its audit-log entries, AI-usage records and billing records are kept as stated in this Section.
  • AI assistant conversations — automatically deleted after 90 days of inactivity. A conversation that continues to be used is retained until it has been idle for that period; an erased user's conversations are deleted when the erasure takes effect, at the end of its 30-day grace period. All the conversations in a workspace deleted at its only user's request are deleted on its deletion date.
  • Audit and security logs — significant actions in a workspace are recorded in an append-only audit log (entries cannot be altered after the fact) for security, integrity, and compliance, and are purged after 180 days (6 months). Technical service and security logs, including IP addresses, failed sign-ins and denied access attempts, are not part of the audit log; they are kept for a limited period for security and troubleshooting.
  • AI-usage records — retained on an append-only basis as needed to operate billing and budget controls, and as required by tax and accounting law.
  • Billing records — retained as required by tax and accounting law.
  • Backups — expire on a rolling cycle; data deleted from the live Service is removed from backups as they age out.

9. Security

We maintain technical and organisational measures designed to protect personal data, including logical isolation between Customer workspaces (enforced at the database with row-level security), encryption of data in transit, encryption at rest of sensitive stored credentials, removal of image (EXIF) metadata before images are stored, access controls and least-privilege roles, and append-only audit logging of significant actions. No system is perfectly secure, but we work to protect your data and to notify the relevant parties of a personal-data breach as required by law.

10. Your rights

Subject to applicable law (including the GDPR/UK GDPR), you may have the right to access, rectify, erase, restrict or object to processing, port your data, and withdraw consent, and to lodge a complaint with a supervisory authority (our lead authority is the CNIL — France's data-protection authority — as we are established in France).

  • For data we control (account, billing, website data), contact us at [email protected]. From your account settings you can also update your profile, download a copy of the data a workspace holds about you, and request deletion of your account. Nothing is deleted when you make the request. It is sent to that workspace's other administrators and managers who can act on it (not to anyone whose account is disabled or whose own deletion is scheduled), and they review it and carry it out. The request comes to us instead, and we carry it out, if you belong to several workspaces, if you are the only administrator of a workspace, or if no one is left in the workspace to review it.

If you are the only administrator of a workspace. If other people have activated their accounts in that workspace, your account cannot be deleted until one of them is made an administrator. If no one else has activated an account in it, deleting your account also deletes the workspace. When we schedule the deletion, your account is disabled and the workspace is locked at once: none of its users can sign in to it or use it, and its API keys, connected applications, public form links and routines stop working. We email you the deletion date, 30 days later. If you contact us before that date, we can cancel the deletion, which re-enables your account and unlocks the workspace (unless we had suspended it for another reason); once the deletion has started on that date, it can no longer be cancelled. On that date, the workspace's content is permanently deleted: its records (including those in the recycle bin), photos, files and attachments, form templates, projects, locations, dashboards, groups, roles, assistant conversations, API keys and connected-application access, public form links, routines and other settings. Copies in our backups are removed as the backups expire (Section 8). The workspace's API service account, and the accounts of people invited to it who never activated them (unless they also belong to another workspace), are deleted too. Your account is then erased as described below. We keep the workspace's audit-log entries, which can include earlier values of its records' fields, for the audit-log period in Section 8; its AI-usage and billing records, as stated in Section 8; and an anonymised placeholder of the workspace, with its name and details removed, to which those records refer. Because the workspace is locked as soon as the deletion is scheduled, export anything you want to keep before you ask.

  • For Customer Data (data in a workspace), the Customer is the controller — please direct your request to that organisation. The Service provides tools that let the Customer export a person's data and erase it. Erasure disables the person's account at once and, after a 30-day grace period during which it can be cancelled, irreversibly anonymises it: the email address, password, profile photo, device tokens, sign-in links and sessions, and the person's assistant conversations are deleted, and the account can never be restored. A person has one account across all the workspaces they belong to, so erasure applies to that account in all of them. For that reason, when a person also belongs to another workspace, a Customer can remove them from its own workspace but cannot erase the account; the person requests erasure from their account settings and we carry it out. Nor can a Customer erase the only administrator of its workspace; that person's own request is handled as described above.

Erasure does not remove the person's name from the records they created. A completed inspection, incident or check is the Customer organisation's business record, and its integrity depends on who carried it out — an inspection whose author could be erased would lose its value as evidence, and the Customer may be legally required to keep it. That retention rests on GDPR Art. 17(3), which limits the erasure right where processing is necessary to establish, exercise or defend legal claims or to comply with a legal obligation. The name therefore remains visible on records, exports, PDFs, the activity feed and the audit trail. The person is removed from people-pickers, assignment lists and seat counts.

Because the Customer — not Tebelis AI — is the controller of those records, a request to remove a name from them is a decision for that organisation, and we act on their instruction.

We will respond within the timeframe required by law and may need to verify your identity.

11. Children

The Service is a business tool for users who meet the age requirements in §3.1 of our Terms of Service, and it is not directed to children. We do not knowingly collect personal data from children below the age required for valid consent in their jurisdiction. If you believe a child has provided us personal data, contact us and we will take appropriate steps.

12. Changes to this Policy

We may update this Policy from time to time. For material changes we will provide reasonable notice (for example, by email or in-product notice). The "Last updated" date above shows when the current version was published.

13. Contact

  • Tebelis AI, SASU with share capital of €1,000, registered with the RCS Paris under number 107 153 819
  • Registered office: 173 rue de Courcelles, 75017 Paris, France
  • Contact (including privacy and data-protection requests): [email protected]