Privacy Policy

• We collect what we need to run Tarkle, keep it secure, and support you.
• We never sell your personal data.
• We do not use your files to train AI models.
• We do not use advertising cookies.
• You choose where your workspace files are stored.
• You can access, correct, export, or delete your data.

This Privacy Policy explains how Cloudbrand Technologies, Inc., doing business as Tarkle (“Tarkle,” “we,” “us”), handles personal data when you use tarkle.com, our apps, our API, and related services (the “Service”).

Cloudbrand Technologies, Inc.1309 Coffeen AvenueSuite 15023Sheridan, Wyoming 82801United Statesprivacy@tarkle.com

If you received files from a business that uses Tarkle, that business decides how it uses your data. Contact it first. We will help it respond.

Account data. Name, email, company, workspace name, job title and phone number (if you add them), password hash, and sign-in methods such as Google Sign-in, passkeys, or two-factor settings.

Content and metadata. Files, folders, file names, sizes, types, dates, versions, previews, sharing settings, permissions, messages, comments, file request responses, and Brand page and Event page content.

Recipient data. When files are shared or requested, we may collect the recipient's name, email, IP address, browser, device, and viewing, download, or upload activity. Senders and workspace administrators can see this activity. That is how file tracking works.

Billing data. Plan, invoices, billing address, tax details, and payment status. Stripe processes card payments. We never see or store full card numbers.

Device and usage data. IP address, approximate location derived from IP, browser, device, operating system, referring pages, pages viewed, features used, errors, and performance data.

Support data. Messages, attachments, and contact details you send us.

Integration data. When you connect services such as Google Drive, Dropbox, or Slack, we collect the account identifiers and access tokens the integration needs, and data you choose to send through it.

Marketing data. Waitlist signups, newsletter preferences, and replies to our emails.

We do not intentionally collect special categories of personal data. Do not upload them unless you have a lawful basis to do so. Special categories include health, biometric, and religious data.

AI. We do not use your files to train AI models. When you use an AI feature, we send only the Content or metadata it needs to our AI provider, under terms that prohibit training on it.

Automated decisions. We do not make decisions with legal or similarly significant effects about you based solely on automated processing. Automated abuse detection can flag content, and serious actions are reviewed by a person.

We never sell personal data. We do not share it for cross-context behavioral advertising.

We share data only:

• With service providers who process it for us under contract. See Section 7.
• With people you share with. Recipients see what you send. Senders and administrators see recipient activity.
• With your workspace. Owners and administrators can see members' activity and content in the workspace.
• With services you connect, at your direction
• With advisers, auditors, and insurers, under confidentiality
• With authorities, when the law requires it, to protect someone from serious harm, or to fight fraud and abuse. This includes mandatory reports to NCMEC.
• In a business transaction, such as a merger, acquisition, financing, or sale of assets. We will notify you before your data becomes subject to a different privacy policy.

Each processes personal data only on our instructions and under a written agreement. Payment providers receive only what they need to process a payment. We do not store full card numbers. AI providers process data only when you use an AI feature, and they may not use it to train their models.

We will update this list before adding a provider that processes Content. Business customers with a DPA get advance notice.

We use:

• Strictly necessary cookies for sign-in, security, load balancing, and preferences. They cannot be turned off.
• Privacy-friendly analytics that do not use cookies to track you across websites.

We do not use advertising or cross-site tracking cookies. If we add non-essential cookies, we will ask for consent first where the law requires it. We honor Global Privacy Control signals.

Storage regions. We store Workspace files in four regions:

Choosing a region. You choose the region when you create a Workspace. Files stay in that region.

Changing a region. You can change a Workspace's region one time. A change has a fee, shown on the Billing page before you confirm. A move takes 3 to 5 business days, depending on the size of the files and data. Files stay available during the move. We delete the copies in the old region after the move is complete and verified.

Other data. Account, billing, support, and operational data may be processed in the United States and other countries where we and our providers operate.

Safeguards. For transfers out of the EEA, UK, or Switzerland, we use Standard Contractual Clauses, the UK Addendum, or another approved mechanism.

We protect data with:

• Encryption in transit (TLS) and at rest (AES)
• Access controls and least-privilege staff access
• Two-factor authentication and passkeys for users
• Audit logging and monitoring
• Redundancy and backups
• Regular updates and dependency patching
• Automated malware and abuse scanning

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires. Report vulnerabilities to legal@tarkle.com, subject line “Security.”

Depending on where you live, you may have the right to:

• Access your personal data and get a copy of it
• Correct inaccurate data
• Delete your data
• Export your data in a portable format
• Restrict or object to certain processing
• Withdraw consent at any time
• Opt out of marketing
• Appeal our decision on your request
• Not be discriminated against for using these rights

You can manage most of these in your account settings. You can also email privacy@tarkle.com. We will verify your identity and respond within 30 days, or sooner where the law requires. An authorized agent may make a request for you with proof of authority.

If your data sits in an organization's workspace, we will send your request to that organization and help it respond.

California residents have the rights to know, access, correct, and delete personal information, to limit the use of sensitive personal information, and to opt out of sale or sharing.

We do not sell or share personal information as California law defines those terms. We do not use sensitive personal information to infer characteristics about you.

In the last 12 months, we collected these categories of personal information:

• Identifiers
• Commercial information
• Internet or network activity
• Approximate geolocation
• Professional information
• Any personal information you choose to upload

We collected them for the purposes in Section 5 and disclosed them only as described in Section 6.

You have the rights in Section 12 under the GDPR, UK GDPR, or Swiss law. You may complain to your local data protection authority. We would appreciate the chance to resolve your concern first at privacy@tarkle.com.

Tarkle is for people 18 and older. We do not knowingly collect data from children. If we learn that we have, we will delete it.

We may update this policy. For material changes, we will notify you by email or in the Service before they take effect. The date at the top shows the latest version.

Privacy questions and requests: privacy@tarkle.com

Cloudbrand Technologies, Inc.1309 Coffeen AvenueSuite 15023Sheridan, Wyoming 82801United States