Legal · Tadpole

Privacy Policy

Last updated: 24 September 2026 · English translation of the Spanish original, which prevails in case of discrepancy.

Tadpole ("Tadpole", "we", "our") operates the modular business-software platform available at tadpole.systems and its subdomains (the "Service"). This policy explains what information we collect, why we collect it, how we use it, who we share it with, how we protect it, and the rights you have over it.

By using the Service you accept this policy. If you do not agree, do not use the Service.

1. Who is responsible for your data

The data controller is Tadpole, S.A., a company incorporated in the Republic of Panama, based in Panama City. For privacy questions or requests, write to [email protected].

2. What information we collect

2.1 Account information

  • Name and email address (when you create your account).
  • Password (stored as a cryptographic hash, never in plain text).
  • Your organization / company name (when you provide it).
  • Your role within your organization (admin, owner, agent, etc.).

2.2 Information you or your organization enter into the Service

Tadpole is a business-management system. We process the information you or your organization choose to enter — clients, products, orders, invoices, messages, accounting entries, attachments, internal notes and the like. That information belongs to your organization; Tadpole acts as a processor on the organization's behalf.

2.3 WhatsApp Business Platform (Cloud API) data

If your organization connects a WhatsApp Business account to Tadpole, we process:

  • Your organization's WhatsApp Business phone number and its identifiers (phone_number_id, waba_id).
  • Inbound and outbound messages exchanged through that number, with their metadata (sender, recipient, timestamp, delivery status).
  • The sender's public WhatsApp profile (wa_id, public display name) when they start a conversation with your organization.
  • The WhatsApp Business access token provided by your organization, stored encrypted at rest with authenticated symmetric encryption (Fernet / AES-128-CBC + HMAC).

This data is processed solely to deliver the requested shared-inbox functionality (receive, display, reply, assign conversations, export history). We do not use it for advertising, do not sell it, and do not share it with third parties other than the processors listed in section 6.

We comply with the WhatsApp Business Solution Terms and the Meta Commerce Policy for WhatsApp.

2.4 Google data (Gmail OAuth)

If your organization connects a Google / Gmail account to Tadpole, we request the following OAuth scopes:

  • https://www.googleapis.com/auth/gmail.readonly — to list inbound emails and show them in the unified inbox.
  • https://www.googleapis.com/auth/gmail.send — to send replies from the Service.
  • https://www.googleapis.com/auth/gmail.modify — to mark emails as read / archived when acting on them from the Service.
  • https://www.googleapis.com/auth/userinfo.email — to identify the connected account.
Google API Services User Data Policy — Limited Use statement:
Tadpole's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

  • We use Gmail data only to deliver the functionality the user requested (unified inbox, reply, search, convert to client).
  • We do not use Gmail data for advertising.
  • We do not sell Gmail data.
  • We do not transfer Gmail data to third parties except where necessary to deliver the functionality, to comply with the law, or as part of a merger / acquisition (subject to this same policy).
  • We do not allow humans to read Gmail data, except:
    • when the user gives explicit consent to resolve a specific technical problem;
    • when necessary for security reasons (e.g., incident investigation);
    • when required by applicable law;
    • when the data is aggregated and anonymized, to improve the Service.

2.5 Technical information collected automatically

  • IP address and user agent (for security and abuse prevention).
  • Session identifier (a technically necessary cookie — without it you could not stay signed in).
  • Access logs (timestamp, endpoint, response code) — kept 30 days, then anonymized.

2.6 What we do not collect

  • We do not collect biometric information.
  • We do not collect precise geolocation (only approximate country by IP).
  • We do not use advertising tracking cookies or third-party pixels.
  • We do not use the contents of your emails, WhatsApp messages, clients or orders to train AI models.

2.7 Website tools

The calculators and the diagnosis on tadpole.systems run in your browser and do not send your answers to any server. Only if you tick the "email me the result" box do we receive your email address, your answers, the result and your consent to be contacted, with the date. We use them to send you the result and to write to you with help on your plan; you can ask us to delete them at any time from the Data deletion page. Templates requested by email work the same way: your email and the template requested, plus the optional consent to be contacted if you ticked it.

3. How we use the information

  • To provide the Service: show the inbox, process webhooks, sync emails, generate reports, compute taxes under the rules your organization configures.
  • For security: detect abuse, prevent fraud, investigate incidents, keep the Service's integrity.
  • For support: answer your requests when you write to us.
  • To meet legal obligations: respond to valid court orders, tax requirements (e.g., DGI Panama) or other applicable legal requirements.
  • To improve the Service: aggregated, anonymized usage analysis to understand which features are useful.

We do not use your information for any other purpose without your prior explicit consent.

4. Legal basis for processing

We process personal data under Law 81 of 26 March 2019 on personal data protection of the Republic of Panama and its regulation, Executive Decree 285 of 28 May 2021, following the principles of loyalty, purpose, proportionality, truthfulness, security, transparency, confidentiality, lawfulness and portability that the law establishes. When a user is outside Panama we also apply the applicable rules (for example, GDPR).

We process your information on the following legal bases:

  • Performance of a contract: providing the Service your organization contracted.
  • Consent: for optional connections (e.g., Gmail, WhatsApp), when you explicitly authorize the connection.
  • Legitimate interest: Service security, abuse prevention, product improvement on aggregated data.
  • Legal obligation: meeting applicable tax or judicial requirements.

5. How long we keep your information

We keep your information while your account is active and as long as needed to deliver the Service or meet applicable legal obligations. When you request deletion or cancel your account, we proceed as detailed below.

  • Account and operational data (clients, orders, invoices, messages, etc.): available while the account is active. If you cancel or request deletion, we process it within 30 days of the request, except for records the law requires us to keep (see below).
  • WhatsApp messages: same treatment as operational data. Your organization can request selective deletion of specific threads or conversations at any time.
  • Gmail data (local cache): while the connection is active. When you disconnect Gmail or request deletion, we purge it within 30 days.
  • Technical and security records (access logs, IPs, sessions): kept for the minimum period needed for security and abuse investigations. Deleted on request, unless actively used in an incident investigation.
  • Information required by law: issued invoices, accounting entries and tax records are kept for the period required by Panama's Tax Code and Commercial Code — generally 5 years from the last entry, in some cases up to 10 years. This applies regardless of your deletion request; it is a legal obligation that also protects us both in an audit or dispute.

Transparency note: deletion you start from your account is automatic (your user immediately; the whole account 7 days after you confirm). Requests that arrive by email are processed by hand, within 30 days.

6. Who we share your information with

We do not sell your information. We share only with the processors strictly necessary to deliver the Service:

  • Railway (United States): compute infrastructure and database.
  • Cloudflare (United States): CDN, DNS, DDoS protection, and encrypted backup storage (R2).
  • Meta Platforms (WhatsApp Business Cloud API): WhatsApp message delivery when your organization has connected a WhatsApp Business account.
  • Google LLC (Gmail API): email sync when your organization has connected a Gmail account.
  • Mailchimp (Intuit Inc., United States): only when your organization connects its own Mailchimp account in the Marketing module, to sync the audiences and campaigns you choose. Tadpole does not send its own newsletters through Mailchimp.
  • Resend (United States): email relay for the website forms (contact, suggestions, tools) and the Service's transactional emails (e.g., password reset). The mailbox that receives website forms is a Google (Gmail) account.

We will share information with authorities when required by a valid court order or applicable law, notifying you beforehand where legally possible.

7. International transfers

Your data may be processed in the United States (Railway, Cloudflare, Google, Meta, Mailchimp, Resend) and other countries where our processors operate. Where GDPR or an equivalent regime applies, we use standard contractual clauses or other approved legal mechanisms.

8. How we protect your information

  • Encryption in transit: all traffic over HTTPS (TLS 1.2+).
  • Third-party tokens encrypted at rest: WhatsApp, Google and similar tokens encrypted with Fernet (AES-128-CBC + HMAC-SHA256).
  • Webhook signature verification: HMAC-SHA256 with constant-time comparison.
  • Password hashing: bcrypt with an appropriate cost factor.
  • Multi-tenant isolation: filtering by account_id at the SQL query level to prevent leaks between organizations.
  • Backups: automatic nightly database backups, encrypted and stored offsite, active since June 2026. Backups follow a fixed retention calendar: daily ones are kept 30 days, monthly ones one year and yearly ones five years. A backup already taken is never edited; your data leaves each backup when it expires under that calendar.
  • Administrative access control: administrative access is limited to the Tadpole team and logged. Administration happens from a separate internal operations console with restricted access and two-step verification (2FA), already active. Two-step verification is also available to every user of the Service.
  • No human access to your organization's contents by default: our administrators do not access your data unless you give explicit consent or it is strictly necessary to resolve a documented security incident.

9. Your rights

As a data subject you have, under Law 81 of 2019, the rights of access, rectification, cancellation, objection and portability (ARCO-P rights), which you can exercise free of charge:

  • Access: request a copy of the information we hold about you.
  • Rectification: correct inaccurate or incomplete information.
  • Cancellation (deletion): request deletion of your information — see the instructions on the Data deletion page (English). If you have an account you can do it yourself in Settings → Account → Your data, where you can also download all your information.
  • Portability: receive your information in a structured, machine-readable format.
  • Restriction: restrict how we process your information.
  • Objection: object to processing based on legitimate interest.
  • Withdrawal of consent: revoke prior consents (e.g., disconnect Gmail or WhatsApp) at any time from the Service settings.

To exercise any of these rights, write to [email protected]. We respond within 30 days at most. If you believe we did not address your request, you may file a complaint with the Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI), Panama's data-protection authority.

10. Cookies

We use only technically necessary cookies (session, preferences). We do not use advertising tracking cookies or third-party analytics cookies in the application panel.

11. Minors

The Service is not directed at people under 16. We do not knowingly collect information from minors. If you learn that a minor has provided information, write to us so we can delete it.

12. Changes to this policy

If we update this policy, we will publish the new version here with a revised "Last updated" date. For material changes affecting how we process your personal information, we will notify you by email or through the Service at least 30 days in advance.

13. Contact

Privacy email: [email protected]
General email: [email protected]
Data deletion: Instructions here