Privacy
Your candidates are yours.
Last updated 5 October 2026
Tabby helps your team handle the profiles that land in your inbox. Candidate data belongs to the company that received it, and we handle it only to run the service for you.
Who owns what
- You own your data. Every profile, CV, email, decision and comment in your workspace belongs to your company. 1597 OS is a processor acting on your instructions.
- Your workspace is separate. Nothing from one company is shown to, or mixed with, another. Memory and recall only ever use your own team's past decisions.
- People decide. Tabby reads, summarises and remembers. It never rejects a candidate on its own.
What we collect
- The emails and CV files (PDF or Word) that your team forwards to your Tabby address, or drops in your Slack channel.
- What your team records in Slack about each profile: Yes, Maybe or No, written reasons and thread comments.
- Workspace details needed to run the app: your Slack workspace and channel, role names, who the hiring managers are, and your plan.
- Basic usage counts (for example, a profile was posted). These never contain candidate names, contact details or CV text.
How we protect it
- Strict separation. Every database query is scoped to your workspace. The database accepts connections only from our server, never from a browser.
- Encryption. Data is encrypted in transit. Slack access tokens are additionally encrypted with AES-256-GCM before they are stored.
- Private storage. CVs and emails sit in a private file bucket. Links shown in Slack are signed and expire after 7 days.
- Treated as data, not instructions. Text inside a CV or email is never followed as a command. Everything shown in Slack is escaped.
- No secrets in logs. Our logs and analytics hold ids and counts only, never resume text or personal details.
- Verified webhooks. Every message from Slack, email and payment providers is signature-checked before we act on it.
How Tabby learns
Tabby gets better the more your team uses it. We use your workspace's decisions, written reasons, skills and role context to make Tabby sharper for your team and for your candidates.
We also learn across customers, but only from de-identified patterns: skills, role, company stage and size, and decision outcomes. We never put candidate names, contact details, raw CVs or your private comments into anything shared across companies, and we never show one company's data to another.
You stay in control. Ask us at any time and we will exclude your workspace from cross-customer learning. Deleting a person's data with /redstone delete removes it from your workspace and from anything we have not already de-identified.
The AI provider that reads the CVs (Claude, by Anthropic) processes them for us under its commercial terms, which do not allow it to train its own models on this data.
Who else handles data
| Service | Used for |
|---|---|
| Slack | Where your team works. Cards and decisions live in your own workspace. |
| Supabase | Database and private file storage. |
| Vercel | Hosting the app. |
| Resend | Receiving the emails sent to your Tabby address, and sending email on your behalf where you switch it on. |
| Anthropic | Reading and summarising profiles (see Model training). |
| Razorpay | Payments. We never see card numbers. |
| PostHog | Website and product usage counts, with no candidate data. |
| Meta (WhatsApp) | Delivering WhatsApp messages between your team and candidates, where you switch that on. |
| Cloudflare | DNS for 1597.in. |
We do not sell data and we do not use it for advertising.
Keeping and deleting
- We keep your data while your workspace uses Tabby, because memory is the point of the product.
- A Slack admin can permanently delete any person's data at any time with
/redstone delete name@example.com. It removes the Slack cards, the stored email and CV, every decision and comment, and any mention in other cards. - If you uninstall Tabby or close your account, ask us and we will delete your workspace's data.
- Replies other people typed in a Slack thread are theirs to remove in Slack.
Contacting candidates and agencies
Today Tabby talks to your team in Slack, and can email agencies you have marked, only if you switch that on (it asks you first by default). We are building messages to candidates on email and WhatsApp. They will be off until you turn them on, will only use contact details from the CV, and will always include a way to opt out. Your private comments never leave Slack.
If you are a candidate who applied
If you applied through a Tabby apply page, the company you applied to receives your name, email, optional phone number and CV, and its hiring team reviews them in Slack with the help of Tabby. We handle your details only to run that service for the company. To see, correct or delete your data, ask the company you applied to, or write to omar@1597.in and we will pass your request on and help them act on it.
Your rights, and India's DPDP Act
Candidates can ask the company that received their profile to access, correct or delete it, and the company can action that in Slack. If a candidate contacts us directly, we will pass the request to the right company and help it respond. We aim to follow India's Digital Personal Data Protection Act, 2023.
Questions
Write to omar@1597.in. We read every message. If we change this page in a way that matters, we will tell workspace owners in Slack first.