Privacy Policy — Tabira
Effective date: 29 June 2026
Last updated: 29 June 2026
Tabira (the "app") is provided by D T L INFORMATION TECHNOLOGIES L.L.C (Business Bay, Dubai, UAE) ("we", "us"). We are the data controller. This policy explains what data we collect, why, the legal basis, and your rights. Fortune content in Tabira is for entertainment only and contains no religious or spiritual elements.
1. Data we collect, purposes, and legal basis
| Data | Purpose | Legal basis (GDPR / KVKK) |
|---|---|---|
| Email address | Account creation and authentication (sign-in, code verification, password reset). Stored encrypted. | Performance of a contract |
| Photo (coffee cup) | AI fortune generation; shown in your reading history. | Performance of a contract |
| Purchase history | Token pack and subscription management. | Performance of a contract; legal obligation (accounting/tax) |
| Push token / device identifier | Sending notifications. | Consent (you can disable it anytime) |
| In-app activity (reading history, token balance, preferences) | Providing core app functionality. | Performance of a contract; legitimate interests (security, improvement) |
| Date of birth, gender, relationship status (optional) | Personalizing your reading content and age verification (16+). Age is derived from the date of birth. | Performance of a contract; consent |
Photo content notice: The app is designed to process only your coffee-cup image. Please do not include identifiable faces or other people's personal data in the photo.
2. Data we do NOT collect
We do not collect location, contacts, SMS, or health data. We do not use advertising or analytics SDKs, and we do not track you across other apps or websites.
3. AI processing and sub-processors
To generate readings, your cup photo and the generated text are processed by Anthropic as a sub-processor, strictly on our behalf and under our instructions. This is processing, not sharing with a third party for advertising or sale. Your photo and the generated text are NOT used to train AI models; they are processed solely to fulfill your request.
Our sub-processors:
- Anthropic — AI processing of readings.
- Supabase — hosting of account and content data (EU / Frankfurt).
- Expo, Apple (APNs), Google (FCM) — delivery of push notifications.
We do not sell your data. If we add or change a significant sub-processor, we will notify material changes in the app.
4. Storage, security, and international transfers
Data is encrypted in transit (TLS). Account and content data are stored on our infrastructure (Supabase) in the European Union (Frankfurt) region.
Some processing involves transfers outside the EU: (a) to Anthropic for AI processing, and (b) access by our team and the controller in the United Arab Emirates. Where data is transferred outside the EU or your country, we rely on appropriate safeguards — such as EU Standard Contractual Clauses (SCCs) and a data processing agreement (DPA) with our processors. You may request information about these safeguards at info@tabira.app.
5. Data retention
- Email & in-app activity: retained while your account is active.
- Coffee-cup photos: retained as part of your reading history until you delete the reading or your account.
- Purchase records: retained as required by applicable accounting/tax law, even after account deletion (then limited to what the law requires).
- On account deletion, all other personal data is deleted (cascade) without undue delay.
6. Your rights and account deletion
You can delete your account from within the app; your data is then deleted automatically (cascade). You may also request deletion without installing the app by emailing info@tabira.app (a self-service page at tabira.app/delete may also be provided).
Under GDPR, KVKK, and applicable UAE/Gulf data laws, you have rights of access, rectification, erasure, restriction of processing, data portability, and objection. Where processing is based on consent, you may withdraw consent at any time (this does not affect prior lawful processing). You also have the right to lodge a complaint with a data protection authority — in Türkiye, the Personal Data Protection Authority (KVKK Kurumu); in the EU, your local supervisory authority. Requests: info@tabira.app.
7. Children
Tabira is intended for users aged 16 and over and is not directed to children. We do not knowingly collect data from anyone under 16; if we learn that we have, we delete it.
8. Data breach notification
If a security incident affects your personal data, we will notify the competent authority and affected users without undue delay, as required by applicable law.
9. Representative and registration (where required)
As a controller established in the UAE that offers services to users in the EU and Türkiye, we will appoint a representative and complete any registration to the extent required by applicable law (e.g., GDPR Article 27). For all data protection matters, contact info@tabira.app. (This section is a good-faith draft to be confirmed with legal counsel.)
10. Changes
We may update this policy; we will notify significant changes in the app and update the "Last updated" date above.
11. Contact
D T L INFORMATION TECHNOLOGIES L.L.C — Business Bay, Dubai, UAE — info@tabira.app