Tabby Privacy Policy

Thank you for trusting Tabby with your financial data. Your privacy is important to us, and we’re committed to protecting it and being transparent about how we collect, use, and share it.

Last updated: October 9, 2026 · Spensibly, Inc. DBA Tabby

Jump to a section

01 Introduction

Welcome to Tabby! We understand that your privacy is important, and we’re committed to protecting your personal information and being transparent about how we collect, use, and share it.

This Privacy Policy explains how Spensibly, Inc., doing business as Tabby (“Tabby,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal data when you:

Visit our website at www.usetabby.com
Use our mobile applications
Access our AI-powered bookkeeping and financial management services
Interact with us through customer support, events, or other communications

By using our Services, you agree to the collection, use, and sharing of your personal data as described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not use our Services. We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors — we encourage you to review it periodically.

02 Who we are

Company name: Spensibly, Inc. · Operating name: Tabby · State of incorporation: Delaware
Principal office: 118-21 Queens Blvd, Suite 606, Forest Hills, NY 11375, United States

Tabby provides AI-powered bookkeeping and financial automation software designed for freelancers, solopreneurs, gig workers, 1099 contractors, real estate agents, small business owners, and accounting professionals. Our mission is to simplify bookkeeping and make financial management effortless through cutting-edge artificial intelligence.

For purposes of data protection laws:

Spensibly, Inc. is the data controller for personal data we collect about our users (subscribers and invited users).
We act as a data processor (or “service provider”) for personal data that our subscribers enter into our Services about their customers, suppliers, employees, and other third parties.

03 Scope of this Privacy Policy

3.1 What this policy covers

This Privacy Policy applies to personal data we collect and process when you create an account and subscribe to our Services, use our website, mobile apps, or Services, communicate with our customer support team, attend our events, webinars, or training sessions, participate in surveys, competitions, or promotional programs, interact with our marketing materials, or connect third-party services to your Tabby account.

3.2 What this policy does not cover

Personal data controlled by our subscribers. When you (as a subscriber) enter personal data about your customers, suppliers, employees, or other third parties into our Services, you are the data controller of that information. We process it only as a service provider on your behalf, in accordance with our Terms of Use and applicable data protection agreements. If you’re an individual whose information was entered into Tabby by a subscriber, contact that subscriber directly with questions about your data.

Third-party services. This policy doesn’t cover the privacy practices of third-party services you connect to Tabby — those have their own privacy policies, which we encourage you to review.

3.3 Your responsibility

If you provide us with personal data about other individuals, you represent that you have the authority to share it, have obtained all necessary consents, have provided appropriate privacy notices, and that your sharing complies with applicable laws.

04 Personal data we collect

The personal data we collect depends on how you interact with our Services.

4.1 Identity & contact information

Full name, email address, phone number, business name and address, profile photograph (if uploaded).

4.2 Account & authentication data

Username and password, account settings and preferences, subscription type and plan details, user role, multi-factor authentication information, security questions, account activity logs.

4.3 Financial & payment data

Bank account information (via secure third-party integrations), credit or debit card details (last four digits only), payment method information, billing address, transaction history, invoicing and payment records.

4.4 Business & transaction data

Income and expense records, financial transactions, receipts and supporting documentation, invoice data, vendor and customer information you enter.

4.5 Communications data

Customer support inquiries, chat logs and messages, email communications, survey responses, event registration and webinar participation data.

4.6 Marketing & preference data

Communication preferences (email, SMS, push notifications), marketing consent status, SMS opt-in status, interests, service preferences, referral information.

4.7 Technical & device data

IP address, browser type and version, operating system, device type and identifiers, mobile device information, time zone and location data (based on IP address).

4.8 Usage & analytics data

Pages visited, features used, time spent on pages, click data, navigation paths, search queries, error logs, crash reports, AI categorization acceptance rates.

4.9 – 4.11 Location, user-generated content & sensitive data

Approximate location based on IP address and location metadata in uploaded documents; profile information, forum comments, documents and receipts you upload. We generally do not request or require sensitive personal data to provide our Services.

05 How we collect personal data

5.1 Information you provide directly

We collect personal data when you create an account, subscribe to services, connect bank accounts, upload receipts or documents, submit support requests, participate in surveys or events, or sign up for marketing communications.

5.2 Information collected automatically

When you use our Services, we automatically collect technical data about your device and connection, usage data, location data based on your IP address, and cookies and similar tracking technologies. We use analytics tools, including Google Analytics, to analyze usage data.

5.3 Information from third-party sources

Financial institutions & data aggregators: bank transaction data via Plaid or similar services, account balance, and transaction categorization data.
Payment processors: payment confirmation, transaction details, and billing information.
Identity verification services: identity verification results.
Marketing & analytics partners: demographic data, interest data, and campaign performance.
Social media platforms: public profile information if you connect social accounts.
Business partners & affiliates: referral information and co-marketing data.
Publicly available sources: business registration data, public records, industry databases.

5.4 Information from other users

If you’re invited to use our Services by a subscriber, that subscriber may provide us with your name, email address, and role information.

06 How we use your personal data

6.1 To provide and deliver our Services

Create and manage your account, authenticate your identity, process subscriptions and payments, connect to financial institutions, automatically categorize expenses and income using AI, generate invoices and financial reports, and sync data across your devices.

6.2 To communicate with you

Account-related notifications, customer support, transaction alerts, policy change notices, feedback requests, and billing and security communications.

6.3 For quality assurance and training

We monitor and improve support quality, train our support team and learning systems, and maintain records of our interactions. If we record support calls, we’ll notify you and obtain consent where required by law.

6.4 To improve and develop our Services

Analyze how users interact with the Services, identify and fix bugs, develop new features, conduct research and analytics, and improve our categorization algorithms.

6.5 For security and fraud prevention

Detect and prevent fraud, monitor suspicious activity, verify user identity, protect against cyberattacks, and investigate security incidents.

6.6 For marketing and promotional activities

With your consent or where permitted by law, we send promotional emails, newsletters, SMS messages, and information about new features, events, and educational content.

6.7 To personalize your experience

Customize content and features, recommend relevant insights, tailor dashboards to your business type, and remember your preferences and settings.

6.8 For advertising and retargeting

Display relevant advertisements, show Tabby ads on third-party platforms, measure advertising effectiveness, create lookalike audiences, and retarget website visitors.

6.9 For legal and regulatory compliance

Comply with applicable laws, respond to legal requests and court orders, enforce our Terms of Use, meet tax reporting requirements, and fulfill record-keeping obligations.

6.10 To manage legal claims and disputes

Establish, exercise, and defend legal claims, investigate potential violations of our Terms, resolve disputes, and protect our rights, property, and safety.

07 Legal bases for processing (EEA/UK users)

If you’re located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, we’re required to inform you of the legal bases for processing your personal data.

7.1 Contractual necessity

We process your personal data to fulfill our contractual obligations under our Terms of Use — providing Services, communicating about Services, payment processing.

We process your personal data based on your explicit consent, which you can withdraw at any time — marketing communications (email and SMS), certain cookies, optional features.

7.3 Legitimate interests

We process personal data for legitimate business interests — operating and improving our business, protecting our Services from fraud, understanding usage, and marketing to existing customers — provided these don’t override your fundamental rights and freedoms.

7.4 Legal obligation

We process personal data to comply with legal obligations such as tax laws, financial regulations, and data protection laws — tax reporting, regulatory compliance, responding to legal requests.

08 Cookies and tracking technologies

8.1 What are cookies?

Cookies are small text files stored on your device when you visit websites or use applications. They help us recognize your device, remember your preferences, and improve your experience.

8.2 Types of cookies we use

Strictly necessary cookies: essential for core functionality — account authentication, session management, load balancing, security features. Cannot be disabled.
Functional cookies: remembering preferences, language selection, login state, dashboard customization.
Analytics & performance cookies: Google Analytics, usage statistics, error tracking, A/B testing.

8.3 Similar tracking technologies

We also use web beacons (pixels) in emails and web pages, local storage for caching and performance, and SDKs/APIs in our mobile apps for analytics and functionality.

8.4 Third-party cookies

Some cookies are placed by third-party services including Google Analytics, Google Ads, Facebook Pixel, LinkedIn Insight Tag, Intercom, Stripe, and Plaid. These third parties may track you across multiple websites.

Control cookies through your browser settings (view, delete, or block cookies) or mobile device settings (iOS: Settings > Privacy > Advertising; Android: Settings > Google > Ads). Disabling certain cookies may affect functionality.

8.6 Do Not Track signals

There’s currently no industry standard for responding to DNT signals. Our Services do not respond to DNT signals, but you can use the cookie controls above.

We share your personal data only in the circumstances described below.

9.1 Service providers and partners

Financial services: Plaid (bank connections), Stripe (payment processing)
Infrastructure & hosting: cloud hosting providers (AWS, Google Cloud), CDNs, database providers
Customer support: Crisp (support platform and messaging)
Analytics & marketing: Google Analytics, Mailchimp, Google Ads, Facebook Ads, LinkedIn Ads

All service providers are contractually obligated to protect your data, may only use it to provide services to us, and are not permitted to use your data for their own purposes.

9.2 Third-party integrations you connect

When you connect third-party services to your Tabby account (payroll systems, invoicing tools, etc.), we share data as necessary to enable the integration. Those services have their own privacy policies; review them before connecting.

9.3 Subscribers and invited users

If you’re an invited user, your usage data and activity within the Services may be shared with the subscriber who invited you. Subscribers can see which invited users access their subscription and how the Services are used.

9.4 Business transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, your personal data may be transferred to the successor entity. We’ll notify you of any such change and your rights regarding your personal data.

9.5 Legal requirements and protection of rights

We may disclose your personal data if required by law or in good faith to comply with legal obligations, enforce our Terms of Use, protect our rights or safety, or respond to lawful requests from public authorities.

We may share your personal data with third parties when you give us explicit consent to do so.

9.7 Aggregated and anonymized data

We may share aggregated, de-identified data that doesn’t identify you personally with research partners, business intelligence providers, and industry analysts. This data is not considered personal data.

10 International data transfers

10.1 Where we process data

Tabby is based in the United States. Your personal data may be transferred to, stored, and processed in the United States and other countries where we, our affiliates, or our service providers operate. These countries may have data protection laws that differ from the laws of your country.

10.2 Safeguards for international transfers

For EEA/UK users: we implement Standard Contractual Clauses (SCCs), rely on Adequacy Decisions from the European Commission where applicable, use Binding Corporate Rules for intra-group transfers, and may obtain your explicit consent for specific transfers.

For other users: we use contractual protections with service providers, comply with applicable data transfer laws, and utilize certified service providers.

10.3 Your rights regarding international transfers

If you’re in the EEA or UK, you have the right to request information about the safeguards we use for international transfers. Contact us at support@usetabby.com.

11 Data security

11.1 Our security measures

Technical: encryption in transit (TLS/SSL) and at rest (AES-256), multi-factor authentication, role-based access controls, firewalls, intrusion detection, regular penetration testing.
Physical: secure data centers with restricted access, environmental controls, backup power and redundancy systems.
Organizational: employee security training, background checks, confidentiality agreements, incident response procedures, regular security audits.

See our full Security & Encryption page for details.

11.2 Third-party security

Our service providers are required to implement appropriate security measures and comply with applicable data protection laws. We assess their security practices before engagement.

11.3 Your responsibility

Use strong, unique passwords and enable multi-factor authentication; keep your login credentials confidential and log out on shared devices; report suspicious activity immediately and keep your software updated.

11.4 Security limitations

While we strive to protect your personal data, no security system is completely impenetrable. We cannot guarantee absolute security, and internet transmissions are never entirely secure.

11.5 Security incidents

In the event of a data breach, we will investigate and contain the incident, notify you as required by applicable law, provide information about the breach, and notify relevant authorities as required. Report vulnerabilities immediately to support@usetabby.com.

12 Data retention

12.1 How long we retain data

We retain your personal data for as long as necessary to provide our Services, maintain your account, comply with legal obligations, resolve disputes, enforce our agreements, and support business operations.

12.2 Retention periods by data type

Account & identity data	Retained while account is active, plus up to 90 days after termination. May be retained longer if required for legal compliance (typically 7 years for financial records).
Financial & transaction data	Retained for at least 7 years to comply with tax and accounting regulations.
Communications data	Customer support records: 3–5 years. Marketing communications: until opt-out or up to 2 years of inactivity.
Usage & analytics data	Typically 2–3 years. Aggregated/anonymized data may be retained indefinitely.
Cookies & tracking data	Varies by cookie type; typically 1–24 months.

For the full breakdown by category, see our dedicated Data Retention Policy.

12.3 Data deletion

After the applicable retention period, personal data is securely deleted or anonymized in a manner that makes recovery impossible. Anonymized data may be retained for research and analytics purposes.

12.4 Exceptions

We may retain personal data longer when required by law or regulation, for ongoing legal proceedings, to protect our legal rights, or for legitimate business purposes such as fraud prevention.

12.5 Backup data

Deleted data may remain in backup systems for up to 90 days before being permanently removed.

13 Your privacy rights

13.1 Rights available to all users

Right to access: request confirmation of whether we process your data and obtain a copy.
Right to correction: correct inaccurate or incomplete personal data we hold about you.
Right to deletion: request deletion when data is no longer necessary, you withdraw consent, or data was unlawfully processed (we may retain data for legal obligations).
Right to opt out of marketing: click “unsubscribe” in emails, update preferences in account settings, or contact us.
Right to manage cookie preferences: control cookies through browser settings (see Section 8).

Right to restrict processing: limit how we use your data while verifying accuracy, or when processing is unlawful.
Right to data portability: receive your data in a structured, machine-readable format and transfer it to another provider.
Right to object: object to processing based on legitimate interests or for direct marketing.
Right not to be subject to automated decision-making: our AI categorization is not fully automated decision-making with legal effects — you can review and override all AI-generated categorizations.
Right to withdraw consent: at any time, without affecting prior lawful processing.
Right to lodge a complaint: UK — Information Commissioner’s Office (ICO). EU — your local supervisory authority.

13.4 How to exercise your rights

Update your information directly in your account settings, contact us at support@usetabby.com, or send a written request to: Spensibly, Inc. DBA Tabby, Attn: Privacy Team, 118-21 Queens Blvd, Suite 606, Forest Hills, NY 11375, United States.

We respond within 30 days for most requests, or 45 days for complex requests (we'll notify you of any extension). We will not discriminate against you for exercising your privacy rights.

14 Children's privacy

14.1 Age restrictions

Our Services are not intended for children under the age of 18. We do not knowingly collect personal data from children under 18. If you’re under 18, you may not create an account, use our Services, or provide any personal data to us.

14.2 Parental notice

If we become aware that we’ve collected personal data from a child under 18 without parental consent, we’ll take steps to delete that information as quickly as possible. If you’re a parent or guardian and believe your child has provided us with personal data, contact us immediately at support@usetabby.com.

15 AI and machine learning

15.1 How we use AI

Tabby uses artificial intelligence and machine learning to automatically categorize transactions and expenses, extract data from receipts and documents, provide financial insights and recommendations, detect anomalies and potential errors, personalize your experience, and improve our Services.

15.2 AI training

We may use your data to train and improve our machine learning models but we don’t share, send or use your data to train third-party AI models. We use anonymized and aggregated data for training — personal identifiers are removed before data is used. User feedback and corrections also help improve categorization accuracy.

15.3 Human review

While our AI automates many tasks, you remain in control. You can review and modify AI-generated categorizations, provide feedback to improve accuracy, and critical decisions require human review.

15.4 AI accuracy

Our AI systems strive for high accuracy, but are not perfect. Always review AI-generated categorizations before relying on them, verify financial reports before using them for tax or compliance purposes, and do not rely solely on AI for important financial decisions.

16 SMS and text messaging

16.1 SMS program description

Tabby offers an SMS text messaging program that sends account notifications, transaction alerts, security warnings, service updates, promotional offers (with consent), appointment reminders, and educational tips.

By providing your mobile phone number and opting in, you expressly consent to receive text messages including recurring automated marketing messages and transactional messages. You can opt in by checking the SMS opt-in box during registration, texting “START” or “JOIN” to our short code, or updating your communication preferences in account settings. Opt-in is not required to purchase or use Tabby’s Services.

16.3 Message types and frequency

Transactional messages: security alerts, verification codes, fraud warnings, critical service updates, 2FA codes — these cannot be opted out of without closing your account.
Marketing messages: special offers, feature announcements, event invitations, tips, seasonal promotions — up to 4 messages per month if you opt in.

16.4 Message and data rates

Standard text messaging rates from your wireless carrier apply to all messages sent and received. Contact your wireless carrier for details about your messaging plan.

16.5 Supported carriers

Our SMS program is supported by major U.S. wireless carriers including AT&T, Verizon, T-Mobile, Sprint, Boost Mobile, Cricket Wireless, MetroPCS, U.S. Cellular, Virgin Mobile, and others. Carrier support may change without notice.

16.6 How to opt out (STOP)

Reply STOP, END, CANCEL, UNSUBSCRIBE, or QUIT to any SMS message from Tabby, update your preferences in account settings, or contact support@usetabby.com. You’ll receive one confirmation message after opting out. To re-subscribe, text START, UNSTOP, or JOIN.

16.7 Help and support

Reply HELP to any SMS message, contact support@usetabby.com, or visit our help center.

16.8 SMS terms and conditions

To participate, you must be 18 or older, be the account holder of the phone number provided, have a U.S. mobile phone number, and use a supported wireless carrier. We are not liable for delays, failures to deliver, or errors in SMS messages.

16.9 International users

Our SMS program is designed primarily for U.S. phone numbers. International delivery may be limited — we recommend email or in-app notifications for users outside the United States.

16.10 Privacy and data use

We collect your mobile phone number, opt-in/opt-out status, message delivery and open status, and device and carrier information. We share SMS data with SMS service providers (e.g., Twilio, AWS SNS) and analytics providers. We do not sell your mobile phone number to third parties.

16.11 Changes to SMS program

We reserve the right to modify message frequency, change message types, update SMS terms, or suspend the program. We’ll notify you of material changes via SMS, by updating this Privacy Policy, or by posting a notice on our website.

16.13 SMS disclaimer. SMS messages are provided "as is" without warranty of any kind. We disclaim all warranties, express or implied. We are not liable for failures or delays in message delivery, messages sent to the wrong number due to your error, charges from your wireless carrier, or damages arising from your participation in the SMS program.

16.14 SMS program contact information

Spensibly, Inc. DBA Tabby · 2153 Westchester Ave Suite 200, Bronx, NY 10462, United States
Email: support@usetabby.com · SMS Help: reply HELP to any message · Opt-out: reply STOP

17 Third-party services and links

17.1 Third-party integrations

Our Services integrate with financial institutions (via Plaid), payment processors (Stripe), payroll systems (Gusto, ADP), accounting software, and business applications. When you connect these services, you authorize data sharing with the third party, their privacy policy applies to their use of your data, and we’re not responsible for third-party privacy practices.

17.2 Links to third-party websites

Our website and Services may contain links to third-party websites, apps, or services. We do not control these third parties and are not responsible for their privacy practices or content. Review the privacy policies of any third-party services before providing personal data.

Our website may include social media features (e.g., Facebook “Like” button, Twitter “Tweet” button). These features may collect your IP address, page visits, and set cookies. Your interactions with them are governed by the privacy policies of the companies providing them.

18 California privacy rights (CCPA/CPRA)

18.1 Applicability

This section applies to California residents under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).

18.2 California consumer rights

Right to know: request the categories and specific pieces of personal information we collect, our sources, purposes for collection, and categories of third parties with whom we share it.
Right to delete: request deletion of your personal information, subject to certain exceptions.
Right to correct: request correction of inaccurate personal information.
Right to opt out of sale or sharing: Tabby does not sell personal information for monetary consideration. Certain advertising and analytics practices may constitute “sharing” under the CPRA.
Right to limit use of sensitive personal information: limit our use of sensitive personal information to what’s necessary to provide our Services.
Right to non-discrimination: we will not discriminate against you for exercising your CCPA/CPRA rights.

18.3 Categories of personal information collected (past 12 months)

Identifiers (name, email, address, IP address); financial information (bank account data, payment information); commercial information (transaction history, purchase records); internet or network activity (browsing history, usage data); geolocation data (approximate location); professional or employment-related information (business information); inferences (preferences, behavior predictions).

Sale: we do not sell personal information for money. Sharing: we may use personal information with third-party advertising tools for cross-context behavioral advertising.

18.9 Authorized agents

You may designate an authorized agent to make CCPA/CPRA requests on your behalf. The agent must provide written authorization from you, verify their identity and authority, and comply with our verification procedures.

18.10 How to exercise your rights

Email: support@usetabby.com · Mail: Spensibly, Inc. DBA Tabby, Attn: Privacy Team, 2153 Westchester Ave Suite 200, Bronx, NY 10462. We’ll respond within 45 days of receiving your request.

18.12 Shine the Light law

California’s “Shine the Light” law permits California residents to request information about disclosure of personal information to third parties for their direct marketing purposes. We do not share personal information with third parties for their own direct marketing purposes.

19 Virginia, Colorado, Connecticut & Utah privacy rights

19.1 Applicability

This section applies to residents of Virginia, Colorado, Connecticut, and Utah under their respective state privacy laws.

19.2 Your rights

Right to know/access: confirm whether we process your personal data and access that data.
Right to correct: correct inaccuracies in your personal data.
Right to delete: request deletion of your personal data.
Right to data portability: obtain a copy of your personal data in a portable format.
Right to opt out: opt out of targeted advertising, sale of personal data, and profiling for decisions with legal or significant effects. We do not engage in activities that constitute “sale” under these laws, though certain advertising may constitute “targeted advertising.”

19.3 Sensitive data

We do not process sensitive data (as defined by applicable state law) without your consent or as permitted by law.

19.4 How to exercise your rights

19.5 Appeals

If we deny your request, you have the right to appeal. Contact us at support@usetabby.com to initiate an appeal. We’ll respond within the timeframe required by applicable law.

20 Updates to this Privacy Policy

20.1 Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our Services or business practices, new legal or regulatory requirements, improvements in data protection, or user feedback.

20.2 Notice of material changes

If we make material changes, we’ll notify you by sending an email to the address associated with your account, posting a prominent notice on our website, displaying a notification when you log into your account, or other appropriate means.

20.3 Effective date of changes

Changes become effective immediately for new users, upon your continued use of the Services after notice for existing users, or as specified in the notice of changes.

20.4 Review

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your privacy. The date at the top of this page indicates when it was last updated.

21 Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Spensibly, Inc. DBA Tabby — Privacy Team
118-21 Queens Blvd, Suite 606, Forest Hills, NY 11375, United States

Email: support@usetabby.com · Help Center: usetabby.com/help · Website: www.usetabby.com

We will respond to your inquiry as promptly as possible, typically within 30 days. By using Tabby’s Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

Questions about how we handle your data?

Our privacy team responds to most requests within 30 days — sooner whenever we can.

WHO IT'S FOR

FEATURES

SECURITY

WATCH A DEMO

Tabby

FREE TOOLS

BLOG

HELP

NEWSLETTER

The Bottom-Line Club

Legal