This Privacy Policy explains how Tamable, a service operated by Sparkling Opinions, Lda (“Tamable”, “we”, “us”, or “our”), collects, uses, stores, and shares information when you use our website and application (the “Service”). Tamable is a content back office for writers: it keeps your ideas, your blog posts and your X posts in one place, lets the AI assistant you already use draft from your own words, and publishes only what you approve, to your own website and to X.
By using the Service you agree to this Privacy Policy. If you do not agree, please do not use the Service.
Who we are
The Service is operated by Sparkling Opinions, Lda, a company registered in Portugal (VAT PT517454483) with its registered office at Travessa Fonte do Bispo 17, 3030-243 Coimbra, Portugal. Sparkling Opinions, Lda is the data controller responsible for your personal data under the EU General Data Protection Regulation (GDPR). For any privacy matter you can reach us at privacy@tamable.app.
Information we collect
Account information
You sign in with a one-time link we email you, or with your Google account. There are no passwords. We keep your email address, your name and your avatar. When you sign in with Google, we receive your name, email address and profile picture from Google, and use the picture as your starting avatar unless you have chosen one. Sign-in links expire after 15 minutes and are deleted once they have expired.
Your workspace and its content
Everything you or your assistant put into a workspace is stored so the Service can work:
- Ideas: the words you capture, exactly as you gave them, and the link they came from, if any.
- Posts: blog posts and X posts with their titles, bodies, threads, tags, series, schedule, status, and the notes and replies exchanged about them.
- Media: images, GIFs and videos added to posts, with their descriptions (alt text). So that your website and X can show them, media files are served from web addresses that anyone holding the address can open, as with any image on a published page.
- Activity: each post’s history, recording who did what and when (for example, “Claude wrote the first draft”, “you approved it”, “posted to X”), so you can see how a post got where it is and undo a decision.
- Workspace settings: the workspace’s name, logo, time zone and writing guidelines, its members and their roles, and the email addresses of people invited to join.
- Sites: your website’s address and post address patterns, its deploy webhook address, its read keys and webhook secret, and a log of recent webhook deliveries (when they were sent, the response code and a short excerpt of the response).
- X accounts: for each account you connect, its handle, name and X user ID, whether it allows long posts, and the access and refresh tokens X issues to Tamable, which we store encrypted.
- Assistant connections and personal keys: which assistant you connected, the workspace it acts in, who connected it, when, and when it was last used; and for personal keys, their name, when they were created and when they were last used. A key is shown to you once and cannot be shown again.
When a post contains a link, Tamable fetches that page’s title, description and image (or, for a link to a post on X, its author and text) to show the link the way readers will see it.
Usage information
We collect limited technical and usage information to operate, secure, and improve the Service:
- Website analytics: the pages you visit, how you arrived (the referring site and any campaign tags in the link), how long you stay, your browser, device type, and approximate location derived from your IP address. Addresses are stripped of everything else in their query string, such as sign-in tokens, before they are recorded.
- Product analytics: which features you use and when, such as creating a post, connecting an assistant or a site, or your assistant calling Tamable over MCP (which assistant, which tool, how long it took and whether it failed). These events identify you by your account, your email address and your workspace’s name. They never include the content of your ideas or posts, or what your assistant sent or received.
- Log data: technical logs and error reports used to keep the Service running.
How we use information
- To provide the Service: keep your ideas and posts, run the review and scheduling workflow, and show you what needs you.
- To let the assistants you connect work in your workspace, within the limits described on our Assistants and X access page.
- To publish what you approve: serve your published blog posts to your website and post your approved X posts to X.
- To send you sign-in links and workspace invitations.
- To secure the Service, prevent abuse, fix problems, and understand how the Service is used so we can improve it.
Tamable is human in the loop by design: an assistant can draft and suggest, but only a person in your workspace approves or publishes.
Your AI assistant
Tamable does not run an AI model on your content. The assistant you connect, such as Claude, ChatGPT or Claude Code, is your own, under your account with its provider. When it reads your ideas or posts through Tamable, or sends drafts back, that exchange is handled by the assistant’s provider under your agreement with them, and their privacy policy applies to it. We do not send your content to any AI provider ourselves.
Your website, the read API and webhooks
Your website reads your published blog posts from Tamable’s read API with a read key you create. A read key only sees its own site’s published blog posts: drafts, X posts and other sites are never returned. When published content changes, Tamable calls your site’s deploy webhook with a signed message that names the event, the site and the time, and carries no content. Preview links, which show a draft on your website before it is published, expire after 24 hours. What your website then does with your posts is up to you and your hosting provider.
How we store and retain data
We keep your account and workspace data for as long as your account is active, and delete it as follows, except where we are required to retain limited records to comply with legal obligations:
- Posts, ideas, media, series and sites you delete leave the Service straight away. Their records may remain in our database for a period before they are permanently erased.
- Deleting a workspace permanently erases everything in it: its ideas, posts, activity, media files, series, sites and keys, invitations, members, assistant connections and X accounts.
- Deleting your account removes you from every workspace, revokes your personal keys and assistant connections, deletes your avatar, and removes your email address from our records. Your name stays attached to the activity you took part in, so the workspace’s history remains readable. Content you wrote in a workspace belongs to that workspace and stays there for its other members. If you are the last member or only owner of a workspace, you need to hand it over or delete it first.
- Disconnecting an X account erases its tokens and removes it from the workspace.
Service providers
We rely on a small number of service providers (subprocessors) to operate the Service. Each processes data only on our instructions and under appropriate confidentiality and data protection obligations:
- DigitalOcean: hosting for the Service and its database, and storage for media files (Spaces).
- Resend: delivery of the emails we send you, such as sign-in links and invitations.
- Stripe: payment processing for paid subscriptions, once paid plans are available.
- PostHog: website and product analytics (described under “Usage information”), and error tracking for the web app, used to understand how the Service is used, to detect and fix problems, and to improve it. Error reports include the error message and where in our code it happened, with email addresses removed. We run PostHog in a cookieless configuration, do not record sessions, do not capture the text of what you click, and do not use it for advertising.
- Laravel Nightwatch: application monitoring, so we can see errors, slow requests and failed background jobs. It receives technical records such as timings, database queries and error details.
Some services are involved only because you choose to use them, and their own terms and policies apply:
- Google, if you sign in with Google.
- X, if you connect an X account: we send X the posts you approved, with their media, when they are due.
- Your AI assistant’s provider, as described under “Your AI assistant”.
- Your website and its host, through the read API and deploy webhook.
Some of these providers may process data outside the European Economic Area. Where they do, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses.
Cookies
We use only strictly necessary cookies, to keep you signed in and to protect against cross-site request forgery. These are required for the Service to function and do not track you across other sites. Our analytics (PostHog) run cookieless, and we do not use advertising or cross-site tracking cookies. For details, see our Cookie Policy.
How we share information
We do not sell your personal information or your content. We share information only with the service providers described above, with the services you choose to connect, with the other members of your workspace, or when required by law or to protect the rights, property, or safety of Tamable and its users.
Your rights and choices
Under the GDPR you have the right to access, correct, export, or delete your personal data, to restrict or object to certain processing, and to withdraw consent at any time. You also have the right to lodge a complaint with your supervisory authority; in Portugal this is the Comissão Nacional de Proteção de Dados (CNPD). You can exercise the following directly in the app:
- Edit your name and avatar in Settings › Profile.
- Disconnect an assistant or revoke a personal key in Settings › Assistants, and disconnect an X account in Settings › X accounts.
- Delete a workspace you own in Settings › General, or delete your account in Settings › Profile.
- To make any other request about your data, including a copy of it, email us at privacy@tamable.app.
Security
We use industry standard measures to protect your information, including encryption in transit, encryption of stored X tokens, keys that are shown only once, and access controls. No method of transmission or storage is completely secure, but we work to protect your data and to limit what we collect in the first place.
Children’s privacy
The Service is not directed to children and is intended for users aged 18 and over.
Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last updated” date above and, where appropriate, notify you.
Contact us
Sparkling Opinions, Lda, Travessa Fonte do Bispo 17, 3030-243 Coimbra, Portugal. If you have questions about this Privacy Policy or our data practices, contact us at privacy@tamable.app.