Privacy

Last updated: October 21, 2026

1. Who we are

hellotamarind.com is owned and operated by Highly Performant Limited, a limited liability company in the Masdar City Free Zone, Abu Dhabi, United Arab Emirates (license MC 13910). Address: Smart Station, First Floor, Incubator Building, Masdar City, Abu Dhabi, UAE. Contact: hello@hellotamarind.com.

This policy covers hellotamarind.com and the Tamarind app at app.hellotamarind.com, which is invite only during early access.

Highly Performant Limited is the controller of the personal data described here, except data about your own product's visitors, your newsletter readers and the people who comment on your posts (section 2), which we process for you.

2. What we collect

On the website

Server access logs: the time of a request, the page asked for, the referring page, the IP address and the browser's user agent.

The emails you send us.

Early list: if you enter your email on the Join page, we store your address and when you asked and confirmed, on our server. Resend sends the confirmation email. To limit abuse, we keep keyed hashes of the address and of the network address you send from for 24 hours, never the address itself in that record.

In the app

• Account: your email address and name, and your Google profile photo if you sign in with Google. There are no passwords: you sign in with a single-use emailed link or with Google.
• Sign-in sessions: the IP address and browser user agent of each session.
• Workspace content: what you add or create, such as brand details, voice, rules, chats, posts, replies and uploaded files (logos, video clips).
• Connected accounts: when you connect a channel or a Google service (such as Google Ads or Search Console), the access tokens and the permissions you grant.
• Team and settings: the email addresses of people you invite, your time zone and notification settings, and your Telegram chat if you connect it.
• Activity: a log of actions in each workspace, including sign-ins.
• Comments on your posts: when a connected channel allows it, the comments and mentions people leave, with the author's display name. The text and name are deleted after 48 hours; a keyed hash of the author's account ID is kept.
• Your product's visitors: only if you install the Tamarind connector on your own site. Visits, sign-ups and payments (product, amount and transaction ID), with a random visitor ID, a hashed user ID if your site sends one, country, referrer, device type, landing page, the ad click ID (such as gclid) of the link they arrived by, their consent choices and, if your site asks, their answer to "How did you hear about us?". A hashed email is kept only when the visitor consented to ads, and only those visitors' sign-ups and payments can be sent to your Google Ads account. Our database stores no names or email addresses of your visitors. You are the controller of this data and must tell your visitors about it.
• Your newsletter readers: only if you connect a newsletter. The email address of each reader who signs up on your site. We send them a confirmation email, and the address is kept as a contact at Resend. You are the controller of this data.

3. Why we use it

We never sell data and run no advertising on it.

On the website

We use access logs to run and secure the site (legitimate interest). We use your emails to answer you (legitimate interest). If you join the early list, we use your email address to tell you when Tamarind opens. This rests on your consent, which you can withdraw at any time.

In the app

We use app data to provide the service you asked for (contract), to keep it secure and fix problems (legitimate interest), and to send the emails the app needs: sign-in links, invitations, and the summaries and alerts you choose.

4. Who else handles it

• Hetzner Online GmbH: the server that runs the website, the app and its database. Nightly backups and uploaded files are kept in Hetzner's object storage in Falkenstein, Germany.
• Resend: sends the app's emails and the website's confirmation email, and keeps the contacts of your newsletter if you connect one.
• Fireworks AI: runs the language models that draft from your workspace content.
• Google: sign-in with Google. Gemini creates images, video, voice and music from text prompts. Google Ads and Search Console when you connect them, including the sign-ups and payments sent to your Google Ads account.
• Firecrawl: reads the public pages of your product's site when you add it.
• The channels you connect (such as LinkedIn, Instagram, X and Telegram) receive what you approve to publish, under their own privacy policies. If you turn on Telegram notices, our Telegram bot sends them to your chat.
• Zernio: publishes to your LinkedIn Page what you approve, when you connect one.
• Our mailbox provider handles email sent to hello@hellotamarind.com.

Some of these providers process data outside the UAE, the UK and the EU, including in the United States.

5. Cookies and analytics

The website sets no cookies.

The app uses only cookies it needs to work: a sign-in session cookie (30 days, renewed while you use the app) and short-lived cookies (10 minutes) that secure signing in with Google and connecting a channel or a Google service.

Neither tracks you for analytics or ads, and fonts are served from our own server, so there is no cookie banner. The visitor tracking in section 2 runs only on the sites of customers who install the connector. If cookieless analytics come later, this page changes first.

6. How long we keep it

On the website

• Access logs: up to 14 days.
• Early list: until we write to you about the launch, or until you ask to be removed. Addresses never confirmed are deleted after 7 days.
• Other emails: 2 years after the last message.

In the app

• Account and workspace data: while your account is open, until you ask us to delete it.
• App logs: 14 days. They leave out email addresses and content.
• Backups: about 14 days.
• The activity log: 2 years by default. A workspace owner can set 1 to 7 years.
• Your product's visitor events: 25 months, then only anonymous daily counts.
• The text of comments on your posts: 48 hours.

7. Your rights

You can ask for a copy of your data, a correction, deletion, or that we stop using it, by writing to hello@hellotamarind.com. For now, we handle account and workspace deletion on request. To leave the early list, reply to any of our emails or write to us. We answer within a month.

Complaints may go to the UAE Data Office, the UK Information Commissioner's Office (ICO), a data protection authority in the EU or India's Data Protection Board.

8. Security

The website and the app are served over HTTPS. The access tokens of the channels and Google services you connect are encrypted at rest. Sign-in links are stored hashed and are valid for 5 minutes. Each workspace is kept separate from the others.

9. Children

The website and the app are for adults. We do not knowingly collect data from anyone under 18.

10. Changes

When this policy changes, we update this page and the date at the top. Account holders get an email before a major change.

11. Contact

Write to hello@hellotamarind.com.