Privacy Policy

1. Introduction

TribeBlend ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our data analytics desktop application.

Data Controller: BIANALYTICS CONCEPT S.R.L., CUI: 43663635, Str. MUNTENIEI Nr. 11D, Otopeni, jud. ILFOV, Romania. Contact: legal@tribeblend.com

Important: TribeBlend is designed with privacy in mind. Your data warehouse queries, query results, and connection credentials are processed and stored locally on your machine. We do not have access to your data or queries.

2. Information We Collect

Account Information

When you create an account to activate your license, we collect:

• Email address
• Name and company name
• Payment information (processed by Stripe)
• License activation records

Data We Do NOT Collect

TribeBlend processes data locally using DuckDB. We do not collect or have access to:

• Your SQL queries
• Query results or data from your data warehouse
• Your Databricks credentials
• Contents of your local files

Optional Telemetry (Disabled by Default)

With your explicit consent, we collect anonymized telemetry to improve the application. Telemetry is disabled by default and must be manually enabled in Settings → Privacy → Telemetry. We collect two categories of anonymized data:

Usage Analytics

Anonymized events about feature usage, limited to a fixed set of 16 event types (e.g., app_start, query_run, file_upload, feature_use). All event properties pass through a server-side sanitizer that strips email addresses, file paths, IP addresses, authentication tokens, and other personally identifiable information before storage.

AI Feedback (Ask TribeBlend Improvement)

To improve our natural-language-to-SQL feature, we collect anonymized interaction data including:

• Question hash (HMAC-SHA256 with a per-installation key — not reversible to the original question)
• Question length bucket ("short", "medium", or "long" — never the actual question text)
• SQL structural pattern (e.g., "SELECT+JOIN+WHERE" — no table names, column names, or literal values)
• Execution success/failure, number of agent turns, difficulty level, error category
• Optional user rating (1-5) if voluntarily provided
• Schema hash (non-reversible hash of column list — no actual schema details)

Anonymization Techniques

We use HMAC-SHA256 hashing (per-installation key, never transmitted), statistical bucketing for all numeric values, AST-level SQL fingerprinting (strips all identifiers and literals), random installation UUIDs with no link to your identity, and server-side PII pattern redaction as defense-in-depth.

You can disable telemetry at any time in Settings → Privacy → Telemetry. Each installation is identified only by a random UUID — there is no link between telemetry data and your account, email, or identity. Rate limited to 100 events per day per installation.

3. Legal Basis for Processing (GDPR Art. 6)

Under the General Data Protection Regulation, we process your personal data based on the following legal grounds:

4. How We Use Your Information

We use the account information we collect to:

• Provide and manage your software license
• Process subscription payments
• Send important product updates and security notices
• Respond to your support requests
• Improve the application based on aggregated telemetry

5. Data Sharing and Disclosure

We share your personal data with the following third-party service providers, each of which processes data in accordance with their own privacy policies and GDPR obligations:

• Stripe (payment processing) — USA, Standard Contractual Clauses (SCCs)
• Keygen.sh (license management) — USA, Standard Contractual Clauses (SCCs)
• Cloudflare (CDN, hosting, DDoS protection) — Global, SCCs + EU data processing
• Google Analytics (website analytics, consent-based only) — USA, Standard Contractual Clauses (SCCs)
• HubSpot (CRM for enterprise leads) — USA, Standard Contractual Clauses (SCCs)
• Resend (transactional email delivery) — USA, Standard Contractual Clauses (SCCs)
• Slack (internal sales team notifications) — USA, Standard Contractual Clauses (SCCs)
• Doodle (demo scheduling for enterprise leads) — Switzerland, GDPR Compliant

We may also disclose your information when required by law, to enforce our terms, or to protect our rights and the safety of others.

We never sell your personal information to third parties.

6. Data Storage and Security

Local Data

The following data is stored locally on your machine and never transmitted to our servers:

• Data warehouse connection configurations (encrypted)
• Saved SQL queries and query history
• Cached query results
• Application preferences

Cloud Data

Account and license information is stored on secure servers hosted in the EU via Turso (libSQL). Payment information is processed and stored by Stripe.

Security Measures

We implement appropriate technical and organizational security measures including:

• HTTPS encryption for all data in transit
• Encryption at rest for stored data
• PBKDF2 password hashing with cryptographically secure salts
• Multi-factor authentication (MFA/TOTP) support
• httpOnly, secure cookies for session management
• CSRF protection via double-submit cookie pattern
• Comprehensive security audit logging
• Local encryption of sensitive data (credentials, tokens)

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected. Specific retention periods are as follows:

Local data stored by the application remains on your machine until you uninstall the application or manually delete it.

8. Your Privacy Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you and information about how it is processed.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data we hold about you.
• Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten") when there is no compelling reason for continued processing.
• Right to Restriction of Processing (Art. 18): Request that we limit how we use your data in certain circumstances. When restriction is active, we will continue only essential processing (authentication, security logging, billing) and stop all non-essential processing (marketing emails, product updates, optional analytics). You can activate and lift this restriction at any time from your GDPR dashboard.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Right to Object (Art. 21): Object to processing of your personal data based on legitimate interests, including direct marketing. To exercise this right, email legal@tribeblend.com. Upon objection, we will cease processing based on legitimate interest unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to Withdraw Consent (Art. 7(3)): Withdraw your consent at any time for processing activities based on consent (e.g., marketing emails, telemetry, Google Analytics). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right Not to Be Subject to Automated Decision-Making (Art. 22): Not be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects you.

To exercise these rights, you can use the GDPR Data Management section in your dashboard or contact us at legal@tribeblend.com. We will respond to your request within 30 days. This period may be extended by a further 2 months for complex requests, in which case we will inform you of the extension and the reasons for the delay within the initial 30-day period.

9. Automated Decision-Making

Our service employs limited automated decision-making in the following context:

• Account Lockout: After 5 consecutive failed login attempts, your account is temporarily locked for 15 minutes. This is an automated security measure designed to protect your account from unauthorized access.

This automated processing does not constitute profiling and does not produce legal effects. It is based on our legitimate interest in preventing unauthorized access and protecting user accounts.

If you believe your account has been locked in error, please contact legal@tribeblend.com for manual review.

10. International Data Transfers

Your account data is primarily stored on servers located in the European Union. However, some of our sub-processors are based outside the EU. For all international data transfers, we ensure adequate protection through Standard Contractual Clauses (SCCs) approved by the European Commission.

Our sub-processors and their locations:

Supplementary Measures (Schrems II Compliance)

Following the Court of Justice of the European Union's ruling in Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems (C-311/18, "Schrems II"), we implement the following supplementary measures alongside Standard Contractual Clauses to ensure an essentially equivalent level of protection for personal data transferred to third countries:

• Technical measures: All data in transit is encrypted using TLS 1.2 or higher. Data at rest is encrypted using AES-256 or equivalent. MFA secrets are encrypted with AES-256-GCM before storage.
• Data minimization: We transfer only the minimum data necessary for each sub-processor to perform its function. For example, Slack notifications contain only company name, team size, and demo request status — no personal contact information.
• Access controls: Sub-processor access to personal data is limited to authorized personnel on a need-to-know basis. API keys and credentials are rotated regularly.
• Transfer impact assessment: We have conducted a transfer impact assessment (TIA) for each sub-processor, evaluating the legal framework of the recipient country, the nature of the data transferred, and the effectiveness of the supplementary measures applied.
• Contractual measures: All sub-processors are contractually obligated to notify us of any government access requests and to challenge disproportionate requests where legally permissible.

11. Data Protection Officer

As a small enterprise that does not carry out large-scale systematic monitoring of individuals or large-scale processing of special categories of data, we are not required to appoint a Data Protection Officer under GDPR Article 37. However, we take data protection seriously and have designated a data protection point of contact to handle all privacy-related inquiries:

Data Protection Contact: legal@tribeblend.com

We will reassess the need to formally appoint a DPO as our processing activities evolve.

12. Supervisory Authority

If you are not satisfied with our response to your privacy concern, you have the right to lodge a complaint with your local data protection supervisory authority. Our lead supervisory authority is:

13. Data Breach Notification

In the event of a personal data breach, we will notify the ANSPDCP within 72 hours of becoming aware of the breach, as required by GDPR Article 33, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

If the breach is likely to result in a high risk to your rights and freedoms, we will notify you promptly via email, as required by GDPR Article 34, describing the nature of the breach, the likely consequences, and the measures taken or proposed to address it.

14. Data Processing Agreement

Enterprise customers may request a Data Processing Agreement (DPA) that outlines our obligations as a data processor under GDPR. Contact legal@tribeblend.com to request a DPA.

15. Children's Privacy

Our service is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without verification of parental consent, we will take steps to delete that information promptly. If you believe we have collected data from a child under 16, please contact us at legal@tribeblend.com.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by sending an email to the address associated with your account or by placing a prominent notice on our website. We encourage you to review this Privacy Policy periodically for the latest information on our privacy practices.

17. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

• Privacy inquiries: legal@tribeblend.com
• Data Processing Agreements: legal@tribeblend.com