Privacy Policy · سياسة الخصوصية

Your data, explained clearly.

This bilingual notice explains what Tubali collects, why it is processed, who receives it, how long it is kept, and the choices available to you.

Effective and last updated: 17 August 2026.

Identity and processing roles

Tubali is a digital software service operated from Cairo, Egypt. Tubali is the data user or controller for the website, accounts, billing, and product operations. When a subscribing studio adds its own client or project data, that studio decides why the data is used and is responsible for having authority to process it; Tubali provides the technical service on its behalf.

Contact details: ahmed.hamdy121@gmail.com, with the public business phone and address on the Contact Us page. Tubali has not publicly appointed a separate data-protection officer; privacy requests are handled through the same email.

Personal data and where it comes from

Data may include account, identity, studio, and team information; client, supplier, and project records; proposals, BOQs, schedules, expenses, transfers, and invoices; documents, images, receipts, and messages; AI prompts and outputs; payment and transaction data; support communications; and device, security, and first-party analytics data.

We receive data directly from you; from a studio owner or team member; from files, contacts, and records users add; from clients answering a shared link; from Paymob or another payment provider as transaction status and reference data; and automatically from product, security, and reliability logs.

Purposes and lawful bases

We use data to create accounts and deliver subscriptions; operate requested project and financial workflows; secure accounts and prevent fraud; process payments and meet accounting or legal duties; answer support and privacy requests; and improve product reliability and understand feature use.

Depending on the activity, processing is based on performing a contract or taking requested steps before a contract, complying with a legal duty, our legitimate interest in safely operating and improving the service, or consent where applicable law requires it, such as for certain marketing or optional uses.

Payment data and Paymob

When card checkout uses Paymob, card credentials are entered into a payment experience managed by Paymob or its payment partners. Tubali does not normally receive the complete card number or security code. We receive details such as amount, currency, payment status, method, transaction reference, and data needed to match the payment, provide access, issue records, prevent fraud, and handle support. Paymob’s own notices and terms also apply to its processing.

AI processing

AI features may send the context needed for a requested task to OpenRouter and an underlying model provider, including Anthropic, Google, or DeepSeek depending on the task and configuration. Context may include client or project details, BOQs and financial information, messages, documents, receipt images, or site photos.

Tubali does not make a universal promise that every provider uses zero retention, never uses data to improve its services, or always processes it in one fixed country. If a client contract requires a specific retention period, processing country, or deletion procedure, contact Tubali before using AI with that data.

Recipients and international transfers

We share the minimum needed with service-provider categories that operate Tubali: Supabase for hosting, database, authentication, and storage in the EU Central region in Frankfurt; Vercel for web hosting and content delivery; Paymob and payment partners for transactions; email and communication providers; and AI providers when those features are requested. We may also disclose data when legally required or needed to protect the service, users, or others.

Processing may occur outside Egypt, including in the European Union, the United States, or other provider and model locations. Transfers are limited to providing the requested service and rely on provider contracts and transfer measures required by applicable law. Do not use AI for data requiring a fixed residency location until Tubali confirms the applicable setup.

Public or token-based client links expose the client-facing information attached to that link. Anyone with a valid link may be able to open it until it expires or is revoked, so studios must share those links carefully.

How long data is kept

Account, studio, and project content is retained while the account is active and as needed to provide the service, then deleted or anonymized after a valid deletion request, subject to backup, security, dispute, and legal requirements. Payment and invoice records are kept for the period needed by accounting, tax, fraud-prevention, and dispute obligations. Security, support, and analytics records are kept for as long as reasonably needed to operate, investigate, and improve the service.

External providers may apply their own retention schedules. Deleting data from Tubali does not necessarily remove it immediately from every backup or external provider system, but we process deletion requests according to our role and applicable obligations.

Your rights and choices

Subject to applicable law, you may ask whether we process your data and request access, correction, updating, export, erasure, objection or restriction, and withdrawal of consent where consent is the basis. Account owners can export account data and start deletion from Security settings. Users can also revoke client-share links and choose not to use AI features with particular content.

We may need to verify identity and authority before acting, especially where a request concerns another studio’s or client’s data.

Security, cookies, and children

We use access controls, studio-level data separation, private file storage, short-lived file links, security logging, and appropriate backups. No transmission or storage method can guarantee complete security.

We do not use third-party advertising cookies. We use session mechanisms needed to keep users signed in and first-party product analytics. Tubali is a business service and is not directed to children under 18.

Contact, changes, and complaints

For a privacy request, email ahmed.hamdy121@gmail.com from the account email where possible and state the type of request. If a concern is not resolved, you may contact Egypt’s Personal Data Protection Center.

We may update this policy when the product, law, or providers change. We will publish the new version and effective date here and provide additional notice for a material change when appropriate.