Privacy
Plainly, and kept.
This page is written from the code: the list of companies we use, the retention periods, and the text-message rules below are the same constants the software runs on, and a test fails if they drift apart. Last updated 2026-09-05.
Contents: who · what we collect · why · who sees it · companies we use · text messages · cookies · how long · your rights · security · buildings' own sites · children · changes · contact
Who we are, and whose data this is
Taberna is run by Taberna (Jeromy Darling, sole proprietor), in Minnesota, United States, reachable at hello@taberna.pro. Taberna is software a building uses to run itself: a console for the people who run the building, a portal for its tenants, and a public site.
For the records a building keeps in Taberna (its tenants, leases, ledger, applicants, guests), the building is the controller and Taberna is its processor or service provider: we act on the building's instructions and our data processing terms. For your Taberna account itself, for the usage events we keep about the product, and for people who write to us, Taberna is the controller.
What we collect
- Accounts. Name, email, a password we store only as a salted hash, an optional mobile number, when you logged in, and which terms version you accepted.
- Building records, entered by the building or by tenants. Businesses, contacts, units, leases and rent, ledger status, shifts, event requests, repairs with photos, documents such as insurance certificates with expiry dates, announcements, and notes. We do not ask for Social Security numbers or dates of birth anywhere, and there is no field for them.
- Applications. What an applicant types on a building's public form: name, email, phone, business, and their pitch.
- Screening. If a building orders a background or business check and the applicant consents, we record the consent (name typed, time, IP address, browser) and hold the report the provider returns, or the outcome the building records by hand.
- Signatures. When a document is signed electronically: the signer's name, time, IP address, and a fingerprint of the document.
- Payments. Card and bank details go straight to Stripe and never touch our servers. We keep the amount, date, and Stripe's reference for each payment.
- Guests (buildings with nightly rooms): name, email, phone, dates, and any note they leave.
- Text messages. Whether a number opted in or out, and a log of what was sent and received, for a year.
- Product usage. Events like "signed up", "finished setup", "invited a tenant", "logged in", with the building and account they belong to. No third-party analytics run on the console or portal.
- Technical. IP addresses are used for rate limiting and kept for a short window in a cache, and stored with consent and signature records as evidence. Cloudflare keeps request logs for its own operation of the network.
- Things you tell us. Feedback from the "Something confusing?" box, privacy requests, and email you send.
Why
- To run the building: the ledger, the calendar, invites, work orders, the public site, the digest.
- To let people in and keep others out: sessions, login links, invites, password resets.
- To send what the building or you asked for: invites, confirmations, repair updates, shift covers, announcements, the morning digest, receipts.
- To draft text when asked: the marketing studio and a few "write this for me" buttons send the words you give them to an AI model running on Cloudflare. Nothing is sent unless you press the button, and nothing is used to train a model.
- To understand whether the product works: the usage events above, in aggregate and per building, so we know who to help.
- To meet legal duties: consent records, adverse-action notices, tax and payment records.
We do not sell personal information, do not share it for cross-context advertising, do not build profiles for advertising, and do not use it to train models. We collect what the features above need and nothing "just in case".
Who sees it
- The building. Owners and coordinators see everything in their building. Maintenance staff see work orders, assets, and the calendar, never rent. Tenants see their own records and their own shifts, and the names and shifts of their neighbors on the shared calendar. Nobody sees another building.
- The public. A building's directory, storefront pages, public events, and the Open Now board are public by design and readable by search engines and AI assistants. Tenants write their own storefront page and can leave it blank.
- Companies that work for us, listed next. Each is bound by contract to use the data only to provide their service to us.
- Companies the building chooses: a Zapier automation, or analytics on the building's own public site (below).
- The law. If we are required to by a valid legal process, and then only what is required. We will tell the building unless we are legally barred from doing so.
Companies we use (subprocessors)
| Company | What for | When | Where |
|---|---|---|---|
| Cloudflare | Hosting, database, file storage, email sending, and the AI model that drafts text you ask for | Always | United States and Cloudflare's global network |
| Sentry | Error reports when something in the software breaks: the error, the page, the building id and role. No names, emails, cookies or IP addresses | Always | United States |
| Stripe | Card and bank payments, subscription billing, payouts to the building | When the building connects Stripe or buys a plan | United States |
| Twilio | Text messages | When texts are switched on | United States |
| Checkr | Background checks on applicants | When the building orders one and the applicant consents | United States |
| Middesk | Business verification on applicants | When the building orders one | United States |
| Zapier | Automations the building sets up | Only if the building connects it | United States |
We will update this list at least 30 days before adding a company that would see building records, and buildings can object by ending their use of Taberna and exporting their data. This list is also the subprocessor list under our DPA.
Text messages
A building can text its tenants about the building: portal invites, login links, open shifts, and repair updates. Texts only go to a number whose owner opted in, on an unchecked box with these words: message type, "message frequency varies", "message and data rates may apply", and "reply STOP to stop". Reply STOP at any time and nothing further is sent; reply HELP for help; reply START to resume. Opting in is never a condition of using Taberna, a building, or a lease.
Mobile information and text-message opt-in data will not be shared with third parties or affiliates for marketing or promotional purposes. Numbers are used only to send the messages described here, through Twilio, which delivers them and nothing else.
Cookies and local storage
One cookie, tb_session, keeps you logged in; it is strictly necessary and set only when you log in. The console remembers which navigation groups you opened in your browser's local storage. That is all: no advertising cookies, no tracking pixels, no third-party analytics on taberna.pro, the console, or the portal. There is therefore no cookie banner. Building-chosen analytics on a building's own public site are covered below.
How long we keep things
| What | How long | Then |
|---|---|---|
| Building records (tenants, leases, ledger, calendar, work orders, documents) | While the building is on Taberna | Deleted within 30 days of the owner deleting the building, along with uploaded files |
| Declined applications | 12 months after the decision | Deleted |
| Screening consent records and reports | 12 months after the decision | Report contents and files deleted; the fact that consent was given is kept for the building's records |
| Guest bookings (nightly rooms) | 18 months after check-out | Name, email and phone replaced with 'past guest'; the stay itself stays in the building's occupancy numbers |
| Text message log | 12 months | Deleted |
| Login links and password resets | Until used or 7 days | Deleted |
| Sessions | 30 days from login | Deleted |
| Product usage events (signup, setup steps, logins) | 24 months | Deleted |
| Feedback and privacy requests | 24 months after they are handled | Deleted |
| Email unsubscribe list | Kept | Kept, so we keep not emailing you |
| Your account (name, email, phone, password hash) | Until you delete it | Deleted the same day, along with sessions and links |
A job runs every day and applies this table. Backups held by Cloudflare age out within 30 days.
Your rights, and the buttons for them
Wherever you live, you can ask us what we hold about you, get a copy, correct it, delete it, or tell us to stop a kind of contact. Most of it is self-serve:
- Copy of your data: Your account → Download my data (JSON). Buildings export everything from Setup → Export.
- Correct: your name and mobile on Your account; your storefront and contact details in the portal; tenants ask the building for the rest, since it is the building's record.
- Delete your account: Your account → Delete my account. It goes the same day. Business records the building keeps about a tenancy (rent history, a signed lease) stay with the building, because the building is required to keep them; your login, sessions, and phone go.
- Delete a building: Settings → Delete this building (owners). Everything in it, including files, is gone within 30 days.
- Stop email: every announcement and campaign has an unsubscribe link, and it is honored per building. Transactional mail (invites, receipts, password resets) keeps coming while you have an account.
- Stop texts: reply STOP.
Anything else, or if you can't log in: use the form below or email hello@taberna.pro. We answer within 45 days, verify you by writing to the email address on file, never charge for it, and never treat you differently for asking. If we say no, we say why, and you can appeal by replying; we keep a record of appeals. If a request is about a building's records, we pass it to the building and help them answer, because they decide. Residents of California, Minnesota, Colorado, Virginia, Connecticut, and other states with privacy laws have these rights by statute; everyone else has them by this policy. We honor Global Privacy Control signals as an opt-out of sale or sharing, of which we do none.
Security, and what happens if it fails
Everything travels over TLS. Passwords are hashed with PBKDF2 and a per-user salt; login links, invites, and reset links are single-use, expire, and are stored only as hashes. Sessions expire after 30 days. Card data never reaches us. Access is limited by role, and every change is logged with who made it. The service runs on Cloudflare Workers with a D1 database and R2 storage in the United States, with the one person who runs Taberna holding the keys.
If we learn of a breach that affects personal data, we will tell the affected buildings within 72 hours of confirming it, with what happened, what was involved, and what we are doing, and we will notify individuals and authorities where the law requires. We keep an incident log.
Buildings' own public sites
A building's public site (taberna.pro/building, or its own domain) is the building's site. A building may add its own analytics from this list: Google Analytics, Google Tag Manager, Meta Pixel, Plausible. When it does, that provider sets its own cookies under the provider's and the building's policies, and a line in the site's footer says so. Taberna itself sets no cookie on public sites. Applications and bookings submitted on a public site go to that building.
Children
Taberna is for running a building and is not directed at children. We do not knowingly collect information from anyone under 16; a tenant or guest must be an adult. If you believe a child has given us information, email us and we will delete it.
Changes
The date at the top changes when this page does. For a change that reduces your rights or adds a company that sees building records, we email account holders at least 30 days before it takes effect. The previous versions are in the project's public source history.
Contact
Taberna (Jeromy Darling, sole proprietor). hello@taberna.pro. A person reads it and replies. This page: taberna.pro/privacy. Terms: taberna.pro/terms. Processing terms for buildings: taberna.pro/dpa. Service status: taberna.pro/status.