Privacy Policy

Last updated: July 22, 2026

Tesserat (“we”, “us”) provides a business operations workspace application (“the Service”). This policy explains what information we collect, how we use it, and the choices you have.

1. Information we collect

• Account information — your name, email address, and password (stored as a salted hash, never in plain text), managed via our authentication provider (Supabase Auth).
• Workspace content — whatever you or your workspace members create in the Service: tasks, notes, journal entries, files, CRM contacts, invoices, budgeting data, project data, calendar events, habit logs, and similar records.
• Google Calendar data (optional)— if you choose to connect Google Calendar sync, we access calendar event data via Google’s API on your behalf, and store the resulting OAuth access/refresh tokens encrypted at rest (AES-256-GCM). We only request the access needed to read and write calendar events for the sync feature — nothing else in your Google account. You can disconnect this at any time from within the app, which revokes and deletes the stored tokens.
• Uploaded files — any files you upload are stored via our storage provider (Supabase Storage) and are accessible only to your workspace.
• Usage and log data — standard technical logs (IP address, browser type, request timestamps) generated by our hosting provider (Vercel) for security and reliability purposes.
• Cookies — we use a single essential cookie to keep you signed in (your authentication session). We do not use third-party advertising or analytics cookies.

2. How we use this information

We use the information above only to:

• Provide, operate, and maintain the Service you’ve signed up for;
• Authenticate you and keep your workspace data isolated from other workspaces;
• Sync your calendar, if you’ve opted into that feature;
• Respond to support requests you send us;
• Maintain the security and reliability of the Service.

We do not sell your personal information, and we do not use your data for advertising.

3. Who we share data with

We use a small number of infrastructure providers (“sub-processors”) to run the Service. They process data only on our instructions, to provide their respective service:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting.
• Google — only if you connect Google Calendar sync, solely to read/write your calendar events.

We do not share your data with any other third party, except where required by law.

4. Data retention

We retain your account and workspace data for as long as your account remains active. If you delete your account, or request deletion by contacting us, we delete your data within a reasonable time, except where we’re required to retain limited records by law.

5. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, or to object to certain processing. To exercise any of these rights, contact us at the email below — we’ll respond as soon as we reasonably can.

6. Security

All traffic to the Service is encrypted in transit (HTTPS/TLS). Workspace data is isolated per account using database-level access controls, and OAuth tokens (e.g. for Google Calendar) are encrypted at rest. No method of storage or transmission is 100% secure, but we work to protect your information using industry-standard practices.

7. Children’s privacy

The Service is not directed at children, and we do not knowingly collect personal information from anyone under 16.

8. Changes to this policy

We may update this policy from time to time. If we make material changes, we’ll update the “Last updated” date above.

9. Contact us

Questions about this policy, or requests regarding your data, can be sent to hello@tesserat.com.