Privacy policy

The data controller is the publisher of Tably, an online service available at tably.works.

For any question about your data, write to pro@tably.works.

When your employer opens a Tably workspace and adds information about you, they decide what goes in it: they are the data controller, and Tably acts as a processor within the meaning of the GDPR. For your account and billing data, Tably is the controller of its own processing.

Nothing is collected without your knowledge. In practice:

• Your account — name, email address, password (never stored in plain text: only a bcrypt hash is), and what you add yourself to your profile: phone, photo, banner, bio.
• Your company — name, industry, website, logo, and billing details when provided.
• What you write — feed posts and their replies, polls, boards, cards and due dates, private messages, files and images you attach.
• Vos absences — les dates, le type (congés payés, maladie, télétravail…), le commentaire facultatif que vous écrivez, et la réponse de votre responsable. Jamais de diagnostic ni de justificatif médical. Voir la section 7.
• Vos jours de passage — le fait que vous avez ouvert votre espace tel jour, avec l’heure de la première ouverture ; ni les pages consultées, ni la durée. Voir la section 7.
• A few technical traces — failed sign-in attempts, with the targeted address and the origin of the request, to slow down bursts of attempts.
• Your Google Calendar, if and only if you choose to connect it. See section 6.

We collect no browsing data for analytics: no audience measurement, no profiling, no reselling. There is nothing to sell because nothing is collected for that purpose.

• Running the service (account, workspaces, content, messaging) — performance of the contract between us.
• Securing accounts (limiting sign-in attempts, logging access) — legitimate interest in protecting the service and its users.
• Billing the subscription — performance of the contract and accounting obligations.
• Connecting your Google Calendar — your consent, given when you click, and withdrawable at any time.
• Reaching out to companies — legitimate interest in introducing a professional tool to professionals. Every message sent includes an unsubscribe link that stops all sending immediately.

This is the question that matters most, and we answer it precisely rather than with a stock phrase.

A private conversation can only be read by its members. No role opens that door: not a manager, not an administrator, not the workspace owner, not the Tably team. There is no screen, no exception and no internal procedure for reading a conversation you are not a member of.

For the rest: feed posts are visible to all workspace members; a restricted board is only visible to those it was opened to; billing details are only visible to workspace administrators.

Tably staff can technically access the database to maintain the service. This access is reserved for operational needs. It does not allow reading message content or the titles of your calendar events, which are encrypted — see the next section.

• The site is only accessible over HTTPS; passwords are hashed with bcrypt and are never stored or transmitted in plain text.
• The session cookie contains only a random token; the database keeps only its SHA-256 hash, so a leak of that table does not allow a session to be hijacked.
• The content of private messages, the names of shared files and the titles of imported calendar events are encrypted in the database (AES-256-GCM). A copy of the database file, a misplaced backup or a stolen disk only reveal unreadable blocks.
• Files attached to conversations are not served publicly: every download checks membership of the conversation.

This encryption protects the database at rest, its copies and its backups. It does not protect against a takeover of the server itself, since the key lives there. We would rather say so than let you believe otherwise.

Connecting your Google Calendar is optional, individual, and undone in one click. Until you do it, none of the following applies to you.

• Tably requests a single permission: calendar.events, reading and writing events. It cannot create, rename or delete a calendar, nor touch your Google account settings.
• Imported events only appear in your own calendar. Neither your management, nor an administrator, nor a colleague can see them.
• Tably only writes to your calendar the dated tasks assigned to you, and never modifies or deletes an event it did not create itself.
• When you disconnect, imported events are deleted from Tably, and those Tably had written are removed from your Google Calendar.

Tably's use of data received from Google complies with the Google API Services User Data Policy, including its Limited Use requirements.

Ces deux rubriques concernent directement les salariés. Elles sont décidées par l’employeur, qui en est responsable au sens du RGPD ; Tably les fait fonctionner pour son compte. Chacune se coupe à tout moment depuis les rubriques de l’espace.

Congés et absences

• Une demande contient ses dates, son type, un commentaire facultatif et la décision du responsable. Tably ne demande ni ne stocke aucun diagnostic ni justificatif médical.
• Vos collègues voient que vous êtes absent, pour ne pas vous confier une tâche ce jour-là. Pour un type marqué discret — la maladie, par défaut —, ils voient seulement « Absent », sans le motif. Votre commentaire n’est lu que par vous et par ceux qui valident les demandes.
• Vos soldes de congés ne sont visibles que de vous, de vos responsables et des administrateurs de l’espace.

Notes d’activité

Si l’employeur active cette rubrique, chaque salarié reçoit une note sur 100, recalculée automatiquement sur les 30 derniers jours à partir de ce qui existe déjà dans Tably :

• Réactivité aux messages — le délai entre un message direct reçu et votre réponse. Seule l’heure des messages est utilisée : le calcul ne lit jamais leur contenu.
• Tâches tenues — les cartes qui vous sont confiées et dont l’échéance est passée : terminées à temps, en retard, ou non terminées.
• Régularité — les jours ouvrés où vous avez ouvert votre espace.
• Suivi des annonces — les annonces lues et les sondages auxquels vous avez répondu.

Les week-ends, les jours fériés et vos absences validées ne comptent jamais. Aucune autre donnée n’entre dans le calcul : ni le temps passé, ni les pages consultées, ni la position de votre appareil.

Votre note n’est visible que de vous et de vos responsables ; vos collègues ne la voient pas. Vous voyez exactement ce que voit votre responsable : la note, le détail de chaque critère et la façon dont il est calculé. Quand l’employeur active la rubrique, une annonce l’explique à toute l’équipe dans les Actualités.

La note est un indicateur, pas une décision. Elle aide chacun à s’organiser ; elle ne doit jamais, à elle seule, fonder une sanction, un licenciement, une prime ou une évaluation annuelle. Vous pouvez à tout moment demander à votre employeur des explications sur votre note, et la contester.

Avant d’activer cette rubrique, l’employeur doit informer ses salariés et, s’il en a un, consulter son comité social et économique (CSE), comme l’exige le Code du travail.

• ARYK SAS — hosting of servers and the database, in France.
• Stripe — subscription payments. Your bank details are entered on Stripe and never pass through our servers; we only keep a customer and subscription identifier.
• Google — only if you connect your calendar.
• Groq and Google — engines behind the assistant. When you ask the assistant a question, the text of your question and the excerpts of your workspace needed to answer it are sent to them, for the time it takes to produce the answer. They are not used to train their models. The assistant can be turned off per workspace from the modules page.
• Hostinger — delivery of transactional emails (invitations, password resets) and the publisher's mailbox.

Stripe and Google may process some data outside the European Union. These transfers are governed by the European Commission's standard contractual clauses.

• Your workspace and your content — as long as the workspace is active. When it is closed, everything remains accessible for 30 days, then is automatically deleted from our servers: messages and attachments, Cloud files, boards, calendar, wiki, suggestions. Closure can be cancelled with one button during those 30 days; after that, nothing can be recovered, including by us.
• Your account — it is deleted along with the last workspace it belonged to. As long as you are a member of another workspace, it remains.
• Sign-in sessions — 30 days, then automatic expiry.
• Failed sign-ins — for the duration of the anti-burst window; they stop counting on their own.
• Subscription — when a workspace is closed, renewal is stopped with our payment provider: the period already paid runs to its end and no new invoice is issued. Cancelling the closure restarts it.
• Invoices — 10 years, as required by accounting law.
• Absences — tant que l’espace est actif, comme les autres contenus : elles servent au calcul des soldes d’une année sur l’autre.
• Jours de passage — 90 jours, puis effacés automatiquement. Les notes ne sont pas conservées : elles sont recalculées à chaque consultation.
• Imported calendar events — until you disconnect from Google, when they are deleted.

Tably sets few cookies, and none can be read by page code: they are all marked httpOnly. Those needed for the service don't require your consent; the only one that does is set only after a “yes”.

Needed for the service

• tably_session — keeps you signed in. Set when you sign in, it lasts 30 days and contains only a random token.
• tably_langue — remembers the language you chose, for one year. It is only set if you change language.
• tably_consentement — remembers your answer to the cookie banner: six months for a refusal, thirteen months for consent.
• tably_admin_controle — reserved for the team that publishes Tably, to open the back office. It lasts eight hours and concerns no customer.

Subject to your consent

• tably_acquisition — only if you arrive through the link in an email we sent you, and only if you accept it. It remembers which mailing you came from, for 90 days, so we know whether our messages are useful. It does not track your browsing elsewhere and is not shared with anyone.

Your browser also keeps two settings on your device, without sending them to anyone: the light or dark theme, and whether you have already followed the getting-started tour.

You can change your choice at any time with the “Cookies” link at the bottom of every page.

No advertising cookies, no third-party trackers, no audience measurement. Nothing set here leaves Tably.

You can at any time request access to your data, its rectification, its erasure, the restriction of its processing, its portability, and object to processing based on our legitimate interest.

Some of this can be done directly in the app: your profile can be edited by clicking on it, your messages can be removed, your Google Calendar can be disconnected. For the rest, write to pro@tably.works ; we reply within one month.

If our answer does not satisfy you, you can refer the matter to the CNIL, the French supervisory authority.

We will update it when the service changes. The update date at the top of the page is authoritative. A change affecting what we do with your data will be announced in the app, not slipped quietly into this text.