Privacy Policy

Tebstack ("we," "our," or "us") operates a SaaS platform - a connected ecosystem of AI products for Tebex storefronts. This Privacy Policy covers all data processing activities related to the Tebstack platform, including the Tebby support AI and embedded support widget, Tebby Code (our AI coding agent), Tebstack Docs, the optional Discord integration, the staff dashboard, and billing systems.

Tebby Code involves processing of source code and developer data, which has its own specifics. Those are summarized in Section 5 below and described in full in our Tebby Code Policy.

This policy applies to:

• Store operators - individuals or organizations who create a Tebstack account to manage their Tebex storefronts.
• Staff members - individuals invited by a store operator to manage support tickets.
• Visitors - end users who interact with the embedded support widget on a Tebex storefront powered by Tebstack.

Our role (controller vs. processor). For the account and billing data of store operators and staff, and for our own operation of the platform, Tebstack is the data controller. For the personal data that flows through a store's support tickets, chats, and Tebby Code bug reports - including data about that store's visitors - the store operator is the controller and Tebstack acts as a processor on the operator's behalf, handling that data only to provide the Services and on the operator's instructions. Where we act as a processor, a request from a visitor is fulfilled together with the relevant store operator (see Section 10).

Account information. When you register, we collect your name, email address, and password (hashed). If you register via OAuth (e.g. Google, GitHub), we receive your name, email, and profile picture from that provider.

Store configuration data. We store the settings you configure for your Tebstack stores, including store name, custom domain, platform type, currency, Tebby AI system prompt, knowledge base entries, staff permissions, and Tebex API keys (encrypted at rest).

Support ticket data. We store all support ticket content, including messages submitted by visitors, replies from staff or Tebby AI, internal staff notes, and any attachments. This data is associated with your store and is necessary to provide the support management service.

Visitor information. When a visitor opens a support ticket via the embedded widget, we may collect their name, email address, and any other information they voluntarily provide in the support flow. If Tebex transaction verification is enabled, we collect the Tebex Transaction ID they provide.

Usage data. We automatically collect information about how you use the Services, including pages visited, features used, timestamps, IP addresses, browser type, and device information. This data is used for debugging, security, and improving the Services.

Payment information. Billing and payment data is processed directly by Paddle. We store only a reference to your Paddle customer ID, current subscription tier, and credit balance. We do not store full card numbers or other sensitive payment data.

Tebby Code data. If you enable Tebby Code, we store a reference to the GitHub repositories you connect (the GitHub App installation identifier, repository name, and default branch - not a copy of the code), the bug reports submitted for triage, the diagnoses Tebby produces (which can include file paths and short excerpts of code or logs cited as evidence), execution job records and logs (with credentials redacted), the proposed change represented as a diff, and pull-request metadata such as number, URL, and branch. We do not store a copy of your repository. See Section 5 and our Tebby Code Policy for the full details.

Discord data. If you enable the Discord integration, we store the Discord account and server/channel identifiers needed to link accounts, deliver notifications, and route messages between Discord and your support or code workflows. Linking your Discord account happens inside Discord via the /link command - we never ask for your Discord login or password. Connecting a server authorizes our bot to join it; Discord tells us which server you chose, and we read no personal data about your Discord account in the process.

Communications. If you contact us by email or through support channels, we retain those communications to assist with your inquiry.

We use the data we collect to:

• Provide, operate, and maintain the Services.
• Power Tebby AI - your store configuration and ticket content are passed to Anthropic Claude to generate support responses.
• Power Tebby Code - triage bug reports against the repositories you connect and propose staff-reviewed fixes, by reading relevant code in an isolated sandbox and processing it with Anthropic Claude (see Section 5).
• Process payments and manage your subscription and credit balance.
• Authenticate users and manage account security.
• Send transactional emails (account confirmations, password resets, billing receipts) via Resend.
• Monitor and analyze usage to detect fraud, abuse, and security threats.
• Improve the Services by understanding usage patterns and identifying areas for enhancement. We do not sell your data or use it to train AI models without your consent.
• Comply with legal obligations.

Our legal bases for processing personal data under the GDPR include: performance of a contract (to deliver the Services), legitimate interests (security, fraud prevention, service improvement), legal obligation, and - where required - consent.

Tebby AI is powered by Anthropic Claude, a large language model provided by Anthropic, PBC. When Tebby AI is enabled on a store:

• Visitor messages, conversation history, and relevant store context (system prompt, common Q&As, product information you have configured) are sent to Anthropic's API to generate responses.
• Under Anthropic's Commercial Terms of Service, data sent to the API is not used to train Anthropic's models, and the transfer is governed by Anthropic's Data Processing Addendum, which incorporates EU Standard Contractual Clauses. See Anthropic's Privacy Policy for details.
• Store operators are responsible for ensuring that visitor data shared with Tebby AI is covered by appropriate disclosures to their visitors.
• Internal staff notes marked as internal are excluded from AI context sent to visitors and are not shared with visitors through any channel.

We periodically analyze aggregated, anonymized support ticket patterns to improve Tebby's store-specific context. This analysis is performed within our own systems and does not involve sharing individually identifiable ticket data with third parties beyond what is described above.

Automated processing. Tebby uses AI to draft support responses, classify tickets, and triage bug reports, but it is not used to make decisions that produce legal or similarly significant effects on a person without meaningful human involvement. Store staff configure and oversee Tebby, and Tebby Code never changes code or opens a pull request without a staff approval. If you are in the EEA or UK and believe a decision affecting you was based solely on automated processing, you may contact us to request human review.

Tebby Code is our AI coding agent. When you enable it and connect a GitHub repository, it triages bug reports and - only after a member of your staff approves the diagnosis - proposes a fix as a pull request. This section summarizes how code data is handled; our Tebby Code Policy describes it in full.

We do not store your source code. For each job, the relevant repository is cloned into a temporary, isolated sandbox (a Cloudflare Container) using a short-lived access token, the job runs, and the sandbox - including the cloned code - is destroyed afterward. We never keep a copy of your repository.

• What is shared. To diagnose an issue or write a fix, the relevant repository content that the agent reads, together with the bug report and diagnosis, is transmitted to Anthropic for AI processing and is executed on Cloudflare infrastructure, in isolation. Repository access is brokered through a GitHub App installation you authorize. Your code is not sold, is not shared with any third party for their own purposes, and is never used to train any AI model: under Anthropic's Commercial Terms of Service, API inputs are not used to train its models, and the transfer is covered by Anthropic's Data Processing Addendum.
• What is retained, and for how long. We keep the bug report text, the diagnosis (which can cite file paths and short excerpts of code or logs), job records and execution logs (with credentials and tokens redacted), the proposed change as a size-capped diff, and pull-request metadata - stored under the same per-store access controls as the rest of your store's data. This information is kept only temporarily and is deleted automatically within 30 days of the related job completing (see the Tebby Code Policy).
• Access is least-privilege. Triage uses a read-only token; write access (to push a branch and open a pull request) is granted only after a staff approval, is scoped to the single repository involved, and is short-lived. Tebby Code never merges code - your team reviews and merges every pull request.
• Your responsibility. You are responsible for ensuring you have the right to connect a given repository and for reviewing any proposed change before merging it. If a connected repository contains secrets or personal data in its code or history, that content may be read during a job; we recommend not committing secrets to source control.

We share personal data only as described in this policy. Our current sub-processors are:

We do not sell, rent, or trade your personal data to third parties for marketing purposes. We may disclose data if required by law, court order, or to protect the rights, property, or safety of Tebstack, our users, or the public.

If Tebstack is acquired or merged with another company, your data may be transferred as part of that transaction. We will notify you via email and/or prominent notice on the Services before your data is transferred and becomes subject to a different privacy policy.

All payments are processed by Paddle.com Market Limited, who act as the merchant of record for our subscriptions and credit purchases. When you subscribe or buy credits, you submit payment information directly to Paddle. We receive confirmation of successful payments and access to subscription status, but we never see or store your raw card details.

Paddle may collect additional data for fraud prevention, tax handling, and compliance purposes under their own privacy policy. Paddle is PCI-DSS Level 1 certified.

We use cookies and similar technologies for:

• Authentication - session cookies that keep you logged in to your Tebstack account (managed by Supabase Auth).
• Preferences - storing your theme preference (dark/light mode).
• Security - CSRF protection tokens.

We also use your browser's localStorage for functional preferences - for example, remembering your last sign-in method, dashboard sidebar state, and unsent draft text. This data stays on your device and is not used for tracking.

Because we only use cookies that are strictly necessary for the Services to function (authentication, security) or that store preferences you set, no cookie-consent banner is required and none of this data is used for advertising.

We do not use third-party advertising cookies or cross-site tracking. We do not use Google Analytics or similar behavioral analytics services.

The embedded support widget placed on your visitors' browsers uses a minimal session cookie to maintain ticket access. Store operators are responsible for disclosing this cookie use in their own store's cookie or privacy notices.

We retain your data for as long as your account is active or as needed to provide the Services. Specifically:

• Account data - retained while your account is active. You may delete your account at any time from Dashboard → Settings → Account; your account record and associated data are deleted immediately, and residual copies in encrypted backups expire within 30 days.
• Support ticket data - retained for 24 months from the date of ticket creation, or for the duration of your active subscription, whichever is longer. Operators may delete individual tickets at any time.
• Billing records - retained for 7 years to comply with accounting and tax obligations, even after account closure.
• AI credit logs - retained for 12 months for dispute resolution purposes.
• Tebby Code artifacts - bug reports, diagnoses, job logs, diffs, and pull-request metadata are stored only temporarily and deleted automatically within 30 days of the related job completing (sooner if you delete the issue, disconnect the repository, or close your account). The cloned source code itself is never retained - it exists only inside the ephemeral sandbox for a single job, is processed in isolation, and is never used to train any model.
• Usage and security logs - retained for 90 days.

After the applicable retention period, data is securely deleted or anonymized.

Depending on your location, you may have the following rights regarding your personal data. If you are in the European Economic Area, these rights arise under the EU General Data Protection Regulation (GDPR); if you are in the United Kingdom, under the UK GDPR and the Data Protection Act 2018; if you are in California or certain other US states, see Section 11.

• Access - request a copy of the personal data we hold about you.
• Rectification - request correction of inaccurate or incomplete data.
• Erasure - request deletion of your personal data, subject to legal retention requirements.
• Portability - request your data in a machine-readable format.
• Restriction - request that we restrict processing of your data in certain circumstances.
• Objection - object to processing based on legitimate interests.
• Withdraw consent - where processing is based on your consent, withdraw it at any time, without affecting processing already carried out.
• Opt-out of sale - we do not sell your personal data, so this right is satisfied by default.

Self-service tools. Signed-in account holders can exercise the most common rights directly, without contacting us: download a machine-readable copy of your personal data (access and portability) and permanently delete your account and associated data (erasure) from Dashboard → Settings → Account. Email notification preferences, including opting out of all non-essential email, can be changed under Settings → Notifications or via the unsubscribe link in any such email.

To exercise any other right, or if you cannot use the self-service tools, contact us at privacy@tebstack.com. We will respond within 30 days (or within one month, where the GDPR or UK GDPR applies; this can be extended by two further months for complex requests, in which case we will tell you). We may need to verify your identity before fulfilling a request. Exercising these rights is free of charge, and you will not be discriminated against for doing so.

Right to complain. If you are in the European Economic Area, the United Kingdom, or Switzerland, you also have the right to lodge a complaint with your local data protection supervisory authority (for example, your national data protection authority, or the UK Information Commissioner's Office). We would, however, appreciate the chance to address your concern first.

Visitors who have submitted tickets via the embedded widget may request deletion of their data by contacting the store operator or by contacting us directly. We will relay verified deletion requests to the relevant store operator.

This section applies if you are a resident of California (under the California Consumer Privacy Act as amended by the CPRA) or of another US state with a comprehensive privacy law (such as Virginia, Colorado, Connecticut, Utah, or Texas), and supplements the rest of this policy.

Categories of personal information. In the preceding 12 months we have collected the following categories of personal information, as described in Section 2: identifiers (name, email address, account ID, OAuth profile, Discord ID); commercial information (subscription tier, credit purchases, Paddle customer reference); internet or network activity (usage data, log data, IP address, browser and device information); and professional information you choose to provide (store and team details). We collect it directly from you, from your devices, and from the OAuth or integration providers you connect. We do not collect biometric, geolocation (beyond IP-derived region), or other sensitive personal information categories, and we do not use or disclose personal information for purposes that would require a "Limit the Use of My Sensitive Personal Information" option.

No sale or sharing. We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the CCPA/CPRA - and we have not done either in the preceding 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age. Because we do not sell or share personal information, no "Do Not Sell or Share My Personal Information" action is needed; this right is satisfied by default. We disclose personal information only to the service providers listed in Section 6, under contracts restricting their use of it to providing services to us.

Global Privacy Control. Because we do not sell or share personal information or use third-party advertising cookies, there is no opt-out for a Global Privacy Control (GPC) signal to effect; browsing with GPC enabled does not change how the Services work.

Your rights. Subject to applicable law, you have the right to know/access the personal information we hold about you (including the categories collected, the sources, the business purposes, and the categories of recipients), the right to correct inaccurate personal information, the right to delete, the right to data portability, and the right not to receive discriminatory treatment for exercising these rights. You can exercise access, portability, and deletion directly via the self-service tools described in Section 10, or submit any request to privacy@tebstack.com. We will verify requests using the email address associated with your account and respond within 45 days (extendable by a further 45 days where reasonably necessary, with notice).

Authorized agents. You may designate an authorized agent to submit a request on your behalf. We will require proof of the agent's authorization and may ask you to verify your identity directly.

California "Shine the Light". We do not disclose personal information to third parties for their own direct-marketing purposes, so no request under California Civil Code §1798.83 is necessary.

We implement industry-standard security measures to protect your data, including:

• All data in transit is encrypted using TLS 1.2 or higher.
• Sensitive values such as Tebex API keys are encrypted at rest using AES-256.
• Database access is protected by Row-Level Security (RLS) policies enforced at the database level, ensuring users can only access their own data.
• Authentication is managed by Supabase Auth with support for OAuth.
• Tebby Code runs each job in an isolated, single-use sandbox that is destroyed after the job, using short-lived, least-privilege GitHub access tokens scoped to one repository. Tokens and secrets are redacted from stored logs.
• Our infrastructure runs on established cloud providers with SOC 2 compliance.

Despite our efforts, no system is completely secure. In the event of a data breach that affects your personal data, we will notify affected users as required by applicable law.

If you discover a security vulnerability, please disclose it responsibly by emailing privacy@tebstack.com.

The Services are intended for store operators and their staff and are not directed to children. We do not knowingly collect personal data from children under 13 (or, in the European Economic Area and the United Kingdom, under the digital-consent age set by the applicable country, which ranges from 13 to 16). If we learn that we have inadvertently collected such data without the required parental consent, we will delete it promptly.

Because some stores using Tebstack serve gaming communities with younger audiences, store operators are responsible for ensuring that their own collection of visitor data through the support widget complies with the laws protecting minors in their jurisdiction.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@tebstack.com.

Tebstack and its sub-processors operate primarily in the United States. If you are accessing the Services from outside the United States, your data will be transferred to and processed in the United States or other countries where our sub-processors operate.

For transfers of personal data from the European Economic Area (EEA), the United Kingdom, or Switzerland to the United States, we rely on appropriate safeguards under applicable data protection law - principally the Standard Contractual Clauses approved by the European Commission (and the UK Addendum) incorporated into our processors' terms, and, where a processor is certified, the EU-US Data Privacy Framework and its UK extension. We do not rely on your consent as the basis for these routine transfers.

You may request more information about the safeguards applicable to a specific transfer by contacting us at privacy@tebstack.com.

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this page and notify you by email or a prominent notice in the Services at least 15 days before the changes take effect.

We encourage you to review this policy periodically. Your continued use of the Services after changes take effect constitutes your acceptance of the updated policy.

For privacy-related questions, requests, or concerns, please contact our privacy team: