Privacy Policy

1. Who this policy covers

The Platform is not open to the public. Accounts are created by Tessera administrators for Tessera employees, contractors and staff of partner organisations that work with Tessera. There is no self-service sign-up, and the Platform is not intended for children.

If you are a client of Tessera, Tessera staff may record business contact details about you or your company in the Platform (for example a contact name, email address and phone number). This policy covers that data too.

2. Data we collect

Depending on how you use the Platform, we process the following categories of data.

• Account data: your name, email address, role, profile picture, language and theme preferences, and the times you sign in. Passwords are handled by our authentication provider as salted hashes; we never see or store the password itself.
• Sign in with Google: when you sign in with Google, we receive your Google account’s email address, name, profile picture, account ID and Workspace domain. We use them only to match you to an account an administrator already created. No account is created automatically.
• Google Workspace connection (optional): if you connect your Google Workspace account, we store the access and refresh tokens that let the Platform act on your behalf in Google Drive (client folders and files), Google Calendar (events and Meet links), Gmail (your own mailbox: reading, replying, composing and sending), Google Sheets and Google Docs (exports and content plans). Tokens are stored encrypted and are never sent to your browser.
• Work content: content items and their stage history, comments and chat messages, scheduled events and their attendees, client records, uploaded files and links to files in Drive, and notes. This content may include the names and contact details of client contacts.
• Notifications: in-app notifications about work that concerns you and, if you turn on push notifications, a push subscription identifier managed by our push provider.
• Technical data: IP address, browser and device information and request logs that our hosting providers keep for security and troubleshooting, plus the cookies described below.
• Audit data: administrative actions and stage changes are logged with who performed them, what they affected and when, so that work history stays traceable.

The Platform also uses a Tessera-owned Google service account to keep the shared team calendar in sync and to read the Tessera Workspace directory for names and profile photos. A profile photo you uploaded yourself is never replaced by a directory photo.

3. Google user data

Tessera Fulfillment’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

• Google data is used only to provide the features you turn on: showing and organising client folders in Drive, creating and updating calendar events and Meet links, showing your mailbox and sending email you write, and creating Sheets and Docs for exports and content plans.
• Google data is never used for advertising, never sold, and never used to build profiles of you.
• Email content is shown only to you, the owner of the mailbox. The Platform does not mark messages as read and does not delete messages.
• Google data is not read by people at Tessera except with your consent, where needed for security or to comply with the law, or where it has been aggregated or de-identified for internal operations.
• Google data is shared only with the service providers listed below, as needed to run the Platform.

You can disconnect Google at any time under Settings → Connected accounts, or by removing the Platform’s access on your Google Account permissions page. When you disconnect, we revoke the tokens with Google and delete them.

Tessera also connects a Tessera-owned mailbox to the Platform with send-only access. It is used to send notification emails on the Platform’s behalf and never reads mail.

4. Why we process data

• To run the Platform: sign you in, show you the work assigned to you and let you collaborate with your team.
• To coordinate content production and keep an accurate record of what was planned, produced, approved and published for each client.
• To sync with Google Workspace when you choose to connect it.
• To notify you about work that concerns you, in the app, by push notification and by email.
• To keep the Platform secure, investigate problems and prevent misuse.
• To comply with legal obligations.

Where a legal basis is required, we rely on the performance of your employment or engagement contract with Tessera, our legitimate interest in running our business, your consent for optional features such as the Google connection and push notifications, and compliance with legal obligations.

5. Cookies

The Platform uses only cookies it needs to work:

• Session cookies set by our authentication provider that keep you signed in.
• Preference cookies that remember your language, theme and sidebar setting so the page renders correctly from the first byte.
• A short-lived cookie that protects the Google sign-in and connection flow against forgery.

There are no advertising or cross-site tracking cookies. Our hosting and network providers may collect aggregate, cookie-less performance metrics.

6. Who we share data with

Within Tessera, access is limited by role: administrators, account managers and creators each see what their role needs.

We use the following service providers to run the Platform. Each processes data only on our instructions.

• Supabase — database, authentication and file storage (United States, us-east-1).
• Vercel — application hosting (United States).
• Cloudflare — network delivery and protection against attacks.
• Google LLC — Sign in with Google, Google Workspace APIs and the shared team calendar. Your Google data is also governed by Google’s Privacy Policy.
• OneSignal — delivery of push notifications, only if you turn them on.

We disclose data to authorities when the law requires it. We do not sell personal data and do not share it for advertising.

7. International transfers

Tessera is based in Aruba. The Platform’s data is stored and processed in the United States by the providers listed above, under contracts that require them to protect it. Google processes Workspace data under its own terms and in its own data centres.

8. How long we keep data

• Account data is kept while your account is active. When an administrator deactivates an account, the profile is kept so that the work history it appears in stays intact, and is deleted on request once it is no longer needed.
• Work content is kept as a business record for as long as Tessera needs it for the client relationship. Content items moved to the trash can be restored or permanently deleted by an administrator.
• Google tokens are deleted immediately when you disconnect, when an administrator disconnects you, or when Google reports the token as no longer valid.
• Audit logs and records of failed Google API calls are kept for troubleshooting and accountability.
• Request logs are kept by our hosting providers for a short period.

9. Security

All traffic to the Platform is encrypted in transit. Google tokens are encrypted at rest with a key that is not stored in the database. Database access is enforced row by row according to your role, administrative actions are logged, and you can sign out every other device from Settings → Security at any time.

No system is perfectly secure. If you believe your account or data has been compromised, tell an administrator or email privacy@madebytessera.com immediately.

10. Your rights and choices

You can see and change your name, profile picture, language and theme under Settings. You can change your password, sign out other devices, turn push notifications on or off, and connect or disconnect Google there too.

Subject to applicable law, you may ask us to access, correct, delete or export the personal data we hold about you, or object to or restrict how we process it. Send requests to privacy@madebytessera.com. We may need to verify your identity, and we may have to keep some data to meet legal obligations or to preserve the work history described above. If you are in the European Economic Area or the United Kingdom, you also have the right to complain to your local data protection authority.

11. Changes to this policy

We update this policy when the Platform changes. The date at the top shows when it was last revised. If a change materially affects how we use your data, we will tell you in the Platform.

12. Contact

Questions about privacy go to Tessera at privacy@madebytessera.com, or to any administrator of the Platform.