Last updated: October 19, 2026
This Privacy Policy explains how Tartabit, LLC ("Tartabit", "we", "us", or "our") collects, uses, discloses, and protects personal information through our public website, marketing activities, checkout flows, and Tartabit services.
This policy is intended to describe Tartabit's practices as a controller for our own website, marketing, account, billing, and business operations. When Tartabit processes customer data on behalf of a customer through Tartabit IoT Bridge or related services, the customer is generally the controller and Tartabit acts as a processor or service provider under the applicable agreement and Data Protection Addendum.
Tartabit, LLC is the controller for the personal information described in this policy, except where we process personal information on behalf of a customer under a separate agreement.
For privacy questions, rights requests, or marketing opt-out requests, contact us at:
We collect personal information in the following categories, depending on how you interact with us:
We do not intentionally collect special category personal data through our public website. Customers control the data they submit to Tartabit services and should not submit sensitive personal information unless it is necessary for their use case and permitted by their agreement with Tartabit.
We collect personal information from:
We use personal information for these purposes:
| Purpose | Examples | Legal basis where GDPR or UK GDPR applies |
|---|---|---|
| Provide and operate services | Account access, service delivery, support, security, maintenance, webhooks, device data routing, and customer-requested integrations | Contract performance, legitimate interests, and customer instructions where Tartabit acts as processor |
| Respond to inquiries | Contact forms, demo requests, sales questions, support requests, and follow-up communications | Legitimate interests, contract steps, and consent where required |
| B2B marketing | Sending product updates, event invitations, service information, and business outreach to professional contacts | Legitimate interests or consent where required by local electronic marketing law |
| Manage subscriptions and opt-outs | Newsletter preferences, unsubscribe requests, suppression lists, and consent records | Consent, legal obligation, and legitimate interests |
| Analyze and improve the website | Google Analytics after opt-in consent, page performance, content engagement, and site improvement | Consent for analytics cookies/storage where required; legitimate interests for aggregate site improvement where permitted |
| Process checkout and billing | Paddle checkout, subscription setup, transaction handling, tax, invoicing, and payment records | Contract performance and legal obligation |
| Security and fraud prevention | Authentication, monitoring, logging, abuse prevention, vulnerability response, and incident investigation | Legitimate interests and legal obligation |
| Legal and business administration | Contract management, compliance, dispute handling, audits, corporate records, and enforcement of agreements | Legal obligation, legitimate interests, and contract performance |
Where we rely on legitimate interests, we consider the nature of the personal information, the purpose of processing, and your rights and expectations. You may object to processing based on legitimate interests as described in Section 11.
Tartabit may receive business contact information from third-party B2B list providers, public business sources, event organizers, referrals, partners, or marketplaces. We use this information only for business-to-business outreach about Tartabit products, services, events, and related updates.
Although we may purchase or otherwise obtain third-party B2B contact lists for outreach, we do not sell personal information or contact lists, including information provided to us directly by customers, prospects, website visitors, or subscribers. We do not sell unsubscribe or suppression lists. If you opt out of marketing, we may retain limited information, such as your email address, to ensure we honor your request.
Marketing communications include an opt-out or unsubscribe method where required. You may also opt out by contacting info@tartabit.com. We honor opt-out requests as required by applicable law. We do not treat inclusion on a purchased B2B list as proof of consent, and we send electronic marketing only where applicable law permits it.
Electronic marketing rules vary by country. For EU and UK business contacts, our privacy-law basis may be legitimate interests, but electronic marketing laws may require consent or other conditions depending on the recipient type and location.
Our website uses strictly necessary technologies to operate the site, remember security and consent choices, route pages, and support core functionality. These technologies are used without optional analytics consent where permitted because they are necessary for the service you request.
We use Klaro to manage cookie and analytics preferences. Klaro stores your consent choice in a consent cookie or browser storage so the website can remember your preference. The current consent preference is remembered for up to 365 days unless you clear cookies or change your preference earlier.
We use Google Analytics to understand how visitors find and use our website. Google Analytics is optional. Analytics storage defaults to denied and is enabled only after you opt in through the cookie consent tool. You may decline analytics or later withdraw consent through the cookie preferences control where available, or by clearing your browser cookies and revisiting the site.
Google Analytics may set cookies such as identifiers beginning with _ga, _gid, or _gat after consent. Google may process analytics information as an independent provider under its own terms and privacy documentation.
Our website may also use server logs, routing logs, and 404 or broken-link reports to maintain the site, diagnose errors, and improve navigation. Broken-link reports may include the requested URL and query parameters.
We disclose personal information to vendors and recipients that support our business and services, including:
We require service providers and processors to protect personal information and use it only for permitted purposes, subject to applicable agreements.
Tartabit does not sell personal data. We do not sell customer data, website visitor data, contact lists, marketing contacts, service data, or unsubscribe and suppression lists. Our acquisition of third-party B2B marketing lists does not involve selling the personal information that individuals provide to Tartabit.
Tartabit is not currently subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act, because Tartabit is below the applicability thresholds. If that status changes, or if Tartabit chooses to provide a voluntary California notice, we will update this policy.
Tartabit is based in the United States, and our vendors, customers, partners, and service infrastructure may be located in the United States and other countries. Personal information may be transferred to, stored in, or accessed from countries that may not provide the same level of data protection as your location.
When GDPR, UK GDPR, or similar transfer rules apply, Tartabit uses appropriate safeguards where required. These may include adequacy decisions, the European Commission Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, vendor data processing terms, transfer risk assessments, and supplemental technical and organizational measures.
Customer application data hosted in the European Union is stored on EU-based infrastructure. Authorized Tartabit personnel located in the United States may remotely access that data for service operation, administration, security, and support, subject to access controls and applicable transfer safeguards. EU hosting therefore does not mean that all access or processing is confined to the EU.
We do not rely on your agreement alone as the basis for cross-border transfers. Once our participation in the EU-U.S. Data Privacy Framework and UK Extension becomes effective, we may also rely on those frameworks for transfers within their scope.
We retain personal information only as long as needed for the purposes described in this policy, unless a longer period is required or permitted by law. Retention periods depend on the data type, relationship, legal requirements, security needs, and operational context.
Examples of retention criteria include:
When personal information is no longer needed, we delete, anonymize, or securely retain it only as required for legal, security, or backup purposes.
Depending on your location and the nature of our relationship, you may have rights to:
To exercise rights, contact info@tartabit.com. We may need to verify your identity and request enough information to locate the relevant records. If we process personal information on behalf of a customer, we may direct your request to that customer or assist the customer in responding.
EU and UK individuals may contact their local data protection authority or the UK Information Commissioner's Office, as applicable.
We use administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, and disclosure. These measures include access controls, authentication, monitoring, logging, encryption where appropriate, operational controls, and vendor management.
No security measure is perfect. If we become aware of a personal data breach requiring notice, we will provide notices as required by applicable law and customer agreements.
Our website may link to third-party websites, marketplaces, social networks, documentation, partner pages, or checkout services. These third parties control their own privacy and security practices. Review their privacy policies before providing personal information to them.
Tartabit's website and services are intended for business and professional use. We do not knowingly collect personal information from children through the public website.
We may update this Privacy Policy from time to time. The "Last updated" date shows when this policy was last revised. Material updates will be posted on this page or communicated by other appropriate means.
Publication condition: The statements in this section are for initial certification review. Tartabit will publish a finalized section claiming participation only when the U.S. Department of Commerce instructs it to finalize its privacy policy as part of the certification process. This heading and note should be removed upon authorized publication.
Tartabit, LLC complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF as set forth by the U.S. Department of Commerce. Tartabit has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. DPF Principles with regard to personal information received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar, where applicable) in reliance on the UK Extension to the EU-U.S. DPF. If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles, the Principles govern with respect to covered personal information.
To learn more about the DPF program and view our certification, visit https://www.dataprivacyframework.gov/.
This section applies to personal information covered by Tartabit’s certification, including business contact and account information and, where applicable, personal information processed as a service provider for customers. It does not represent a certification for human resources information transferred in the context of an employment relationship.
The categories of personal information covered, sources of information, and processing purposes are described in Sections 2–5 of this policy. They include account administration, authentication and authorization, software service delivery, technical support, security, customer communications, billing and lawful B2B marketing. Tartabit may obtain business contact details from third-party B2B list providers, but does not sell personal information provided to us.
Where Tartabit processes customer-controlled application data on a customer's behalf, the customer generally determines the purposes and means of processing, and Tartabit processes that data according to the applicable agreement and Data Protection Addendum. Customer application data hosted in the EU remains stored in EU-based infrastructure, although authorized U.S. personnel may remotely access it for legitimate service-related purposes, subject to applicable safeguards.
Tartabit may disclose covered personal information to the categories of recipients described in Section 7, including hosting and cloud infrastructure providers, Twilio SendGrid for email delivery, Paddle for checkout and billing, and other providers required to operate and support our services. We do not sell covered personal information.
For onward transfers of DPF-covered personal information to a third party acting as our agent, Tartabit takes steps required by the DPF Principles, including appropriate contractual protections limiting use and requiring appropriate privacy safeguards. Tartabit remains liable under the DPF Principles if an agent processes such information in a manner inconsistent with the Principles, unless Tartabit proves that it is not responsible for the event giving rise to the damage.
Individuals may request access to DPF-covered personal information about them and seek correction, amendment, or deletion if it is inaccurate or has been processed in violation of the DPF Principles, subject to applicable exceptions. Individuals may also opt out of disclosures to non-agent third parties or uses for purposes materially different from those for which their personal information was originally collected or subsequently authorized, subject to applicable exceptions. If sensitive information is processed in circumstances requiring affirmative express consent under the Principles, Tartabit will obtain that consent.
Requests and marketing opt-outs may be sent to info@tartabit.com. Where Tartabit acts as a processor for a customer, we may direct requests to that customer or assist the customer in responding, consistent with our contractual obligations.
In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, Tartabit commits to resolve complaints about our collection and use of personal information received in reliance on those frameworks. Individuals with inquiries or complaints should first contact info@tartabit.com. Tartabit will respond to DPF-related complaints within 45 days.
For unresolved complaints concerning personal information received in reliance on the EU-U.S. DPF, Tartabit commits to cooperate with the panel established by the EU data protection authorities (DPAs) and to comply with the panel's advice. Information about EU data protection authorities is available at https://www.edpb.europa.eu/.
For unresolved complaints concerning personal information received in reliance on the UK Extension to the EU-U.S. DPF, Tartabit commits to cooperate with the UK Information Commissioner's Office (ICO) and, where applicable, the Gibraltar Regulatory Authority (GRA), and to comply with their advice. Information about the ICO and how to make a complaint is available at https://ico.org.uk/make-a-complaint/.
These independent recourse mechanisms are available to eligible individuals free of charge.
Under certain conditions, individuals may invoke binding arbitration for residual claims concerning compliance with the DPF Principles that have not been resolved through other available mechanisms. More information is available through the Data Privacy Framework website.
Tartabit, LLC is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC) in relation to its compliance with the DPF Principles.
Tartabit may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.