Privacy Policy

Account and identity data: name, display name, email, phone, and organization details you give us. Some profile fields, such as date of birth, are optional and have their own visibility setting.

Profile and site content: bio, services, prices, availability, city-level location, photos, video, reviews, and site configuration. Content you publish is public.

Inquiries, messages, and bookings: the contact details, message text, attachments, offers, and booking records that clients, talents, and agencies exchange.

Payment records: Stripe references, amounts, payouts, refunds, and disputes. Card numbers go straight to Stripe and never touch our servers. Identity and bank checks for payouts are held by Stripe.

Usage and device data: IP address, browser type, page views, and performance data. Analytics cookies are used only if you accept them (see Cookies).

Security, audit, and error logs, and, for AI features, the text you submit to them. For AI search we keep the query text.

Marketing preferences: whether you subscribed to or unsubscribed from our emails.

We do not collect guardian information, government ID numbers, or home addresses as part of the service.

To run the service (render your site, deliver inquiries and messages, take and pay out payments, send transactional email), to keep the platform secure and prevent fraud and abuse, to improve the product, to show talents in our directory and marketing where they have chosen to be discoverable, and to meet legal obligations. We do not sell personal data.

We use these providers. Each receives only what it needs to do its job.

• Vercel: hosting and delivery, plus cookieless page-view and performance measurement.
• Supabase: database, sign-in, file storage, and realtime messaging.
• Stripe: card payments, payouts, and subscription billing. Stripe is also an independent controller for its own identity verification and fraud checks.
• Resend: sending email.
• Google: Analytics (only after you accept analytics cookies) and Google Maps (maps, places, and directions).
• Sentry: error and performance monitoring.
• Anthropic and OpenAI: optional AI features (see AI features below).
• Upstash: rate limiting, using hashed identifiers.
• Embedded media from services such as YouTube, Vimeo, Spotify, SoundCloud, Calendly, Instagram, and TikTok, when a page you visit includes them. These services may receive your IP address and set their own cookies.

Talents and agencies may add their own analytics or advertising tags to their sites. Those are their choice and they are responsible for them.

We use essential cookies to keep you signed in and the service working, functional ones to remember language and currency, and optional ones for analytics only if you consent. The full list, and how to change your choice with the “Privacy choices” link, is on the Cookies page.

Card payments are processed by Stripe. The talent or workspace that provides the service is the seller and merchant for the payment; Tulala provides the platform and the payment processing tools, and fees are deducted as described in the plans. Card details are entered with Stripe and never touch Tulala. We keep the payment records described above for accounting, tax, and dispute purposes.

Pending legal review

Optional features such as drafting bios, translation, transcription, search, and support chat send the text you submit to Anthropic or OpenAI to produce a result. Some workspaces use their own API keys. Profile text may also be converted into search embeddings. If you do not want your text processed this way, do not use those features.

Shared discovery is opt-in per organization and per profile. Nothing is discoverable in the network unless you turn it on, and you can turn it off at any time.

We keep data only as long as needed. These are the periods:

• Messages and bookings: 3 years after the last activity
• Deleted accounts: purged 30 days after the 14-day grace period
• Security and error logs: 90 days

Backups are held by our database provider and age out on its schedule. Data we must keep by law may be kept longer.

You can ask for a copy of your data, to correct it, or to have it deleted. You can edit most profile details yourself. For access, export, correction, or deletion requests, email privacy@tulala.digital. We may need to confirm who you are first, and we respond within one month. We may keep records we are legally required to keep. You can unsubscribe from marketing email at any time using the link in the email.

Data in transit is encrypted with TLS. Access is role-scoped and sensitive actions are logged. No system is perfectly secure. To report a security issue, email security@tulala.digital.

Tulala is for people aged 18 and over, both talents and clients. We do not knowingly collect data from anyone under 18. If you think we have, email us and we will remove it.

Our providers operate in several countries, including the United States, so your data may be processed outside the country where you live. We rely on our providers’ contractual safeguards for those transfers.

We may update this policy as the product changes. The date at the top shows the latest version, and we will give notice of material changes.

Privacy questions and requests: privacy@tulala.digital.