Privacy Policy

Who is responsible for your information

Tavlo is operated by Solid Grove Pte. Ltd., 68 Circular Road #02-01, Singapore 049422. We are the controller responsible for the personal information covered by this policy. Contact us about privacy or your rights at support@trytavlo.com or at that postal address.

This policy covers our web app at https://trytavlo.com and our quiz and checkout at https://quiz.trytavlo.com. Tavlo is intended for adults aged 18 or over.

Information we process and where it comes from

You provide your email address when using the service. Sign-in uses a one-time, six-digit code sent by email from mail.trytavlo.com, rather than a password.

You provide quiz answers about yourself, such as your gender, age range, communication goals, how you feel about your communication skills, and your learning preferences. We use these answers to prepare your personalised plan.

Stripe processes payments and provides us with purchase and subscription information. We do not store card numbers.

Your learning progress in the web app, such as completed lessons, daily goals, streaks, lesson ratings and any name you enter there, is stored locally in your browser on your device. It is not synced to our servers, and we do not receive it unless you send it to us.

We process device and analytics information when you visit or use the quiz, and marketing pixel and attribution information where analytics or advertising pixels are configured for the quiz. FunnelsGrove sends our sign-in codes and service emails from mail.trytavlo.com.

Why we use information and our GDPR legal bases

We use the email address and necessary sign-in, purchase and subscription information to provide access, deliver sign-in codes and administer the subscription. The GDPR basis is performance of our contract with you, or steps you ask us to take before entering it (Article 6(1)(b)). Without the information needed for sign-in and payment, we cannot provide the corresponding account or paid service.

Our policy is to use consent (Article 6(1)(a)) for optional analytics and marketing or advertising tracking. Consent must be separate from accepting the Terms, and you may refuse or withdraw it. See our Cookie Policy for the categories and controls.

Where we must keep information to meet an applicable EU or Member State legal obligation, the GDPR basis is Article 6(1)(c). A requirement under Singapore law alone is not automatically a legal obligation under that GDPR provision.

Age requirement and sensitive quiz answers

Tavlo offers lessons and conversation-practice scenarios to help adults build communication skills. You must be at least 18 to use the service. It is not directed to anyone under 18. If you believe someone under 18 has given us their information, please contact support@trytavlo.com so we can investigate and take the action required by applicable law.

Please provide only the information requested and avoid including medical records or unnecessary details about yourself or other people.

Tavlo is for general education and self-improvement, not diagnosis or treatment. Even so, answers about how you feel in conversations or about your communication skills may reveal information about your mental health. Where information reveals health or another special category of personal data, GDPR requires an additional condition under Article 9 as well as an Article 6 basis. Accepting the Terms is not explicit consent to this processing.

Service providers and other recipients

Our service providers include FunnelsGrove for the quiz, checkout orchestration, subscription records and transactional email; Stripe for payments and subscriptions; and Vercel for hosting the web app and lesson media.

Lesson videos in the web app are shown through an embedded third-party video player, whose provider receives information from your browser when a video loads.

Where analytics or advertising pixels are configured for the quiz, the relevant analytics or advertising platforms are involved in measurement and advertising attribution. These activities can involve disclosure of personal information to those platforms. The data and controls for these technologies are described in the Cookie Policy.

A provider that processes information on our instructions acts as a processor for that activity. A provider that determines its own purposes may instead act as an independent controller or share controller responsibilities with us. This distinction affects which privacy notice and rights procedures apply.

International processing and safeguards

Our operator is in Singapore, and our providers may process information outside the country where you live. The countries involved may have different privacy laws.

Where GDPR applies to a transfer outside the European Economic Area, a valid transfer mechanism is required. European Commission Standard Contractual Clauses (SCCs) are contractual safeguards that can be used for eligible transfers, with a transfer assessment and additional measures where necessary. An applicable adequacy decision may provide another basis.

How long information is kept

Our retention policy is to keep personal information only for as long as it is needed for the stated purpose, including applicable record-keeping duties and the resolution of legal claims. Different information may have different retention periods; cancelling a subscription does not necessarily require immediate deletion of records we must legally keep.

Progress stored locally in your browser stays on your device until you clear it, for example by clearing your browser's site data.

Security

Protect access to your email account and do not share your sign-in code. Contact support@trytavlo.com if you believe someone has accessed your Tavlo account without permission. Stripe processes payments, and we do not store card numbers.

Your privacy rights and choices

Where GDPR applies, you may ask to access your personal information and receive a copy, correct inaccurate or incomplete information, delete information, restrict its use, and receive eligible information in a portable format. The availability of a right depends on the circumstances and legal basis.

You may object to processing based on legitimate interests for reasons relating to your situation. You may always object to direct marketing, including related profiling. You may withdraw consent at any time without affecting processing that was lawful before withdrawal.

You also have rights concerning decisions based solely on automated processing, including profiling, that have legal or similarly significant effects.

To make a privacy request, email support@trytavlo.com. We may ask for information reasonably necessary to confirm your identity. Requests are normally free. Where GDPR applies, we will respond without undue delay and within one month; a permitted extension of up to two further months will be explained within the first month.

If we cannot fulfil a request, we will explain why and how to challenge the decision. Other applicable privacy laws may give you additional rights; you can use the same contact address to ask about them.

Complaints and policy changes

You may contact us at support@trytavlo.com with a concern. You also have the right to complain directly to the relevant data protection authority. In the EEA, this may be the authority where you normally live or work, or where an alleged infringement took place. Authority contact details are available at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.

For Singapore privacy concerns, you can contact the Personal Data Protection Commission through https://www.pdpc.gov.sg/contact-us. These options do not affect any other remedies available under applicable law.

We may update this policy to reflect changes to the service or legal requirements. The date at the top identifies this version. We will provide any notice or obtain any new consent required before using information for a new purpose.