Privacy Notice

Effective date: October 27, 2026 · Version: 2026-10-27

Isbell Group, LLC, a Texas limited liability company, operates Tarca. This notice explains how we handle personal information through tarca.app, personal and team workspaces, support interactions, external update forms, public intake forms and workspace contacts.

The Service is initially offered in the United States to adults aged 18 and over. Optional image transcription and AI Meeting Notes require a separate choice before selected content is sent for AI processing. Meeting Notes is available only where enabled for the account. There is no general AI assistant or automatic AI analysis of your workspace. A paid feature can be purchased only when its checkout is enabled and you expressly authorize the order.

1. Our role and your workspace's role

We determine how personal information is used to operate accounts, secure the Service, handle support and administer our business. When an organization supplies personal information in its workspace and directs how that information is used, it may be the controller or business responsible for that information, and we act as its service provider or processor where applicable. Applicable law and any executed customer agreement govern those roles.

If a person or organization invited you into a workspace, sent an external update request or published an intake form, that operator also determines what it asks you to provide and how it uses the response. Public intake forms identify the operator and link to its privacy notice before submission. Contact that operator about its own practices; its notice does not replace this notice about Tarca's processing. You can also contact us to help identify the appropriate request route. We do not require you to have a paid account to make a privacy request.

2. Information we collect

Credentials are processed through our authentication provider. Do not send your password to support. The Service uses session credentials to keep you signed in; it does not need your bank credentials to operate.

For spreadsheet import, your source workbook is parsed in your browser. Reviewed task data and import records are submitted when you confirm the import; the original workbook is not automatically uploaded as an import source. A file deliberately attached to an external response is a separate upload.

The sample workspace stores its sample changes in your browser rather than a live account. Do not place confidential or sensitive information in a demo on a shared device. Browser clearing or device access can affect those local records.

Public form submissions are not verified identities. An email address, name or phone number someone types may be inaccurate or belong to another person. We do not create an account, membership or subscription from that entry. Public intake accepts answers and attachments when enabled by the form operator. It does not collect payments. Submitted attachments are handled with their response and may be linked to authorized work according to the actions and permissions in the Service.

3. How we use information

We use the information described above to provide the features you request; authenticate users and enforce permissions; save and display authorized work; send account and deliberately requested workflow emails; provide optional notification email; diagnose problems and improve reliability; support customers; prevent fraud, abuse and security incidents; comply with legal obligations; and establish or defend legal claims.

Necessary account notices include trial-expiry email and in-app Inbox messages, normally scheduled approximately three days and one day before expiry. These are separate from optional work-activity digests and marketing; their purpose is to explain access status and recovery. We use the account’s verified address and limited access/delivery records, not private task or document contents, for these notices. A failed delivery does not change the agreed expiry.

We do not sell personal information or share it for cross-context behavioral advertising in the current Service. We do not run an advertising network or use advertising pixels in the current application or landing page. We do not use private workspace content to target ads. We do not use private workspace content to train general-purpose AI models. Introducing a materially different data use would require a separate review, an updated notice and any choice or permission required by law.

Mobile information and SMS consent. We do not sell or share mobile numbers, text-message opt-in information or consent with third parties or affiliates for marketing or promotional purposes. We do not give another business permission to message you using your Tarca consent. Necessary service providers process information only to operate, deliver and protect the requested Text to task service, as described below; this does not authorize their own marketing.

4. Who can receive information

People you collaborate with. Shared workspace content is accessible to authorized members according to the workspace's roles. Current team permissions cover the workspace rather than individual private projects. Members' names and verified email addresses can be available to other authorized members for collaboration. Private planned days and reminders have their own user-specific access controls. A personal space is separate from a team, but platform operators with appropriate privileges can access information when needed for authorized operations and support.

External recipients you choose. Sending an external update request shares the task title, workspace name, message and selected fields shown in the preview. The private link grants access to that request, not general workspace membership. Anyone who obtains a valid forwarded link may be able to use it; the link is not verified identity. Submitting a response makes it and submitted files available to authorized readers in the requesting workspace. Draft uploads are not shared with ordinary internal readers until submission. Internal comments are not automatically forwarded.

Public forms and their operators. Publishing exposes the form's questions, instructions, operator name and linked notice to anyone who can reach its public address. Search-engine exclusion requests are not passwords or access controls. Submitted answers are not published with the form: authorized editors in the owning workspace can review responses and contact records. A reviewer may deliberately create or link a contact or task. Information copied into a task follows normal task visibility, which can include workspace viewers. The original submission remains separate from that task. Personal forms and contacts remain in their personal workspace when the owner joins a team. Submitting a form is not permission to send marketing email or to add the respondent as a workspace member.

Service providers. We use Supabase for database, authentication, private file storage and server functions; Vercel for website and application hosting; Resend for account and workflow email delivery; Google Workspace for business email and support/privacy correspondence; and Cloudflare Turnstile to protect public forms from automated abuse. They receive information necessary for the services they provide. For example, an email provider receives message addresses, contents, attachments and relevant delivery information. Information you choose to send to our support or privacy inbox is processed through Google Workspace; customer workspace content is not automatically copied into that mailbox. The current optional daily digest uses a generic Inbox link rather than private task or comment content. See Service providers for additional details. These providers may use their own infrastructure providers under their agreements with us.

Optional Text to task. You can choose Connect phone in Settings → Connections to authorize incoming task capture, then send the displayed linking code from that phone. Creating a Tarca account or providing a phone number elsewhere does not enroll you. Twilio and participating carriers process sender/recipient phone numbers, message contents, linking messages and delivery or opt-out metadata to carry this traffic. Tarca receives the incoming text and provider metadata through its hosted service. Accepted texts become private Backlog tasks in the destination saved when you connected; they are not instructions to analyze your workspace, update contacts or trigger an AI workflow. Unknown or disconnected phones cannot create tasks. Media attachments are not retrieved or saved as task attachments. Tarca sends no automatic linking, task-confirmation or error replies by SMS. Twilio or participating carriers may still send standard responses to your STOP, START or HELP commands; check Tarca itself for connection and task status.

You may reply STOP to stop the SMS program or disconnect your phone in Settings → Connections. This stops new task capture through that connection without deleting previously created tasks. Reply HELP for assistance; after STOP, text START to restore carrier delivery and then link your phone again in Tarca if you want to resume. Phone-ownership, consent and limited delivery records are retained as described below. See Text to task details for the setup steps, supported messages and program terms.

Optional task import and image transcription. You can review tasks extracted from files before adding them to a workspace. Plain text and spreadsheets are read in your browser. Word documents and text-based PDFs are processed by Tarca’s hosted extraction service. If you choose “Read image with AI,” the selected image is transmitted through Vercel AI Gateway to OpenAI for transcription. The feature sends that image and transcription instructions; it does not send your entire workspace, contacts or other files. We configure no model training on these requests and disable AI SDK input/output telemetry. This is not a promise of zero provider retention: providers may retain information for security, abuse prevention and legal obligations under their applicable terms. Do not submit information you are not authorized to share with those providers.

The import service does not save the original uploaded file in your workspace. Extracted text is returned for your review; tasks, notes, source references and tags are saved when you confirm the import, under that workspace’s access permissions. Save an original separately in Library if you want to retain it there. We retain limited access and usage records to enforce processing limits and protect the service. AI transcription can contain mistakes, particularly in handwriting, so you should correct it before import. You may instead type or paste the text, or import a supported text document without AI transcription.

Public-form security checks. Turnstile processes technical signals such as IP address, browser/connection characteristics, and the site origin to detect bots. Cloudflare also uses these signals to improve its bot detection under its own Turnstile Privacy Addendum. Tarca does not send form answers, contact fields or workspace records to Turnstile as part of verification. Our form gateway does not store raw IPs with submissions; it uses a shared form-level security bucket rather than a visitor profile. Hosting and security providers can still receive technical request information in operating their services.

Optional AI Meeting Notes. When you choose to process a meeting, selected audio, the meeting title and short background terms you supply are sent through Vercel AI Gateway to Mistral for transcription and vocabulary context. The transcript, meeting title/type, and background or personal notes you enter for processing are sent through the Gateway to OpenAI for a summary, suggested actions and a separate source-grounding check. Pasted transcripts follow the summary path without audio transcription. Linking a contact, company, project or task does not authorize scanning its contents or other workspace records. You must have authority to process the material and obtain any required participant consent before starting.

Meeting Notes requests require Gateway routes configured for zero data retention of model inputs/outputs and no prompt training. Processing stops if an eligible route is unavailable. AI SDK content telemetry is disabled. These controls concern the model requests; they do not delete the transcript and summary you asked Tarca to save or eliminate necessary account, security, billing and usage metadata. They also do not change the separate retention terms for optional image transcription described above.

Saved meeting notes are private to their owner under the account's ordinary access controls. Linking them to shared work does not expose the transcript or summary to other members. Suggested actions do not become tasks until you review and add them. Copying or exporting notes places that copy under your control. Summaries, speaker labels and action suggestions can contain errors; transcript references support review and do not certify accuracy.

Authorized operators and advisers. Personnel and professional advisers may access information when reasonably necessary for their role, assistance, security, legal or business administration. Designated privileged platform operations are audited. We do not promise that all operational access through every vendor system is represented in the application's audit history.

Legal and protective disclosures. We may disclose information when legally required, to protect people or systems, investigate abuse, enforce agreements, or pursue or defend claims. We assess requests and limit disclosure as appropriate rather than promising unconditional secrecy.

Business changes. Relevant information may be reviewed or transferred in a financing, merger, acquisition, reorganization or sale of the Service, subject to appropriate protections and applicable notice obligations. It remains subject to applicable privacy requirements.

At your direction. We may disclose information when you direct an export, choose a sharing action or otherwise authorize a disclosure. A downloaded export is under the recipient's control, so consider where you store or send it.

5. Payments

When a paid checkout is available, Stripe collects payment details through its hosted checkout and billing portal. Tarca receives the account/customer and subscription identifiers, billing contact and address, invoice/payment status, amounts, taxes, and limited payment-method details needed to administer the authorized order. Creating an account, accepting these policies or redeeming no-charge access does not authorize payment. We do not ask you to send bank account numbers, full card numbers or payment credentials through tasks, forms or support.

6. Browser storage and tracking choices

The application uses local browser storage for authentication sessions and the interactive sample. Certain screens keep unsaved state only while the screen remains open. See Cookies and local storage for the current categories and controls.

We do not currently enable advertising trackers or cross-site behavioral advertising. Browser Do Not Track signals do not change essential authentication or hosting behavior; there is no current advertising-tracking feature for that signal to disable. Our current Service does not sell or share personal information for advertising, so a Global Privacy Control signal does not need to switch off such processing. If we introduce a practice requiring opt-out controls, we will provide the controls and honor applicable signals as required by law.

Hosting, security and email providers receive ordinary technical information necessary to deliver their services. Following a link to a separate website is subject to that website's practices. We do not control information independently collected by a site after you leave Tarca.

7. Retention, deletion and exports

We retain information for as long as reasonably needed to operate the account and workspace, follow authorized instructions, protect the Service, maintain appropriate history, resolve disputes and meet legal requirements. Factors include the record's purpose, sensitivity, account/workspace status, contractual requirements, statutory retention and backup lifecycles. We do not apply a single retention period to all information.

Meeting audio is temporary. Tarca schedules its deletion after successful processing; unsuccessful uploaded recordings remain recoverable by their authorized owner for up to 24 hours from upload, then are scheduled for deletion. Cleanup may be delayed by a service interruption and is retried. This feature does not provide a permanent audio library. Transcript, summary, personal notes and selected links remain saved until deleted or handled under the account's retention rules. Deleting a meeting does not automatically erase a task previously created from it, an exported copy, or limited billing/processing records. Unuploaded browser recordings are held in memory and can be lost when the page is closed or reloaded.

The current pilot does not have automated account erasure or a fixed scheduled purge for every data category. Deletion requests require review and authorized handling. Archiving content normally preserves it. Removing someone from a team ends their access but does not automatically delete the organization's history or their separate personal account. Ending an external link does not delete the internal response, attachments or history already submitted.

For Text to task, we store accepted message text in the resulting task and keep limited capture-authorization, linking, delivery and outcome records for access control, opt-out handling and duplicate prevention. The message receipt does not keep an additional copy of the text. Linking codes expire after ten minutes; Tarca stores a code hash rather than the usable code. Disconnecting or deleting an account does not automatically remove the phone's ownership association: we retain that association to prevent someone from attaching a previously linked number to a different account without review. Contact support if your number has changed ownership. SMS providers and carriers may retain their own traffic and delivery records under their terms and legal obligations; deleting a task does not delete those records. Privacy requests are reviewed under the rights and limitations in this notice.

Pausing or archiving a public form stops new intake without erasing prior answers or linked contacts/tasks. Archiving a contact preserves its record; marking a response reviewed or spam does not erase its answers. Ask the form operator or contact us about correction, access or deletion; there is no anonymous response-edit or erasure link. A linked task or exported response may contain a separate copy that must be considered when handling the request.

We may need to retain limited records for security, fraud prevention, legal obligations, disputes, valid legal holds or other lawful purposes. Deletion from active systems may occur before copies expire in backups or provider systems; those retained copies remain subject to applicable protections. Where practical and appropriate, we will delete or de-identify information that no longer needs to be retained. A legal right to deletion is not postponed merely because the interface lacks a self-service button.

When workspace access permits, Settings can export the currently loaded workspace snapshot. It is not a complete account-wide export of every attachment, discussion and historic record. Flowchart downloads contain that chart's structure or rendered image. For trials subject to content lockout, expiry may prevent opening workspace content or using self-service exports. It does not automatically delete that content. Account/billing recovery and support remain available. Contact us for assistance with a broader access, portability or deletion request rather than assuming the on-screen export includes everything.

8. Your choices and requests

You can use available controls to update work, manage permitted memberships and notifications, turn optional digest email off, and sign out. Workspace administrators may need to handle requests concerning organization-controlled content.

Depending on where you live and which law applies, you may have rights to know about, access, correct, obtain a copy of, or delete personal information; to object to or limit certain processing; and to appeal a denied request. We will assess and honor rights that apply to the request. We do not require a paid subscription to receive a legally required response and will not unlawfully discriminate for exercising a right.

Use the contact details below to make a request. Include the account email or other context needed to locate the information and describe what you are requesting. Do not send a password, authentication code or unnecessary identity document. We may take proportionate steps to verify identity and authority to protect information from being disclosed or deleted for an impostor. Authorized agents may be asked to establish their authority as required by law.

If a request is denied, we will explain the basis and any available review or appeal route to the extent required by law. You may contact us with “Privacy appeal” and the prior request reference. This does not prevent you from contacting the relevant attorney general, regulator or other authority. We respond within the timing required by applicable law; any permitted extension will be explained when required.

9. Security and processing locations

We use access controls, authenticated workflows, scoped private links and other technical and organizational measures appropriate to the current Service. Information is transmitted through HTTPS. No online service can promise perfect security, and we do not make a security certification or absolute data-loss guarantee by publishing this notice. Keep credentials and private links secure and tell us promptly about suspected misuse.

Tarca is operated from the United States. Providers may process information in the United States and other countries where their infrastructure or personnel operate. We do not currently offer a contractual country-specific data-residency commitment. International expansion and any transfer mechanism or data processing agreement required for it must be addressed before offering a corresponding commitment. This notice does not purport to replace a required data-transfer mechanism.

10. Children and sensitive information

The Service is intended for adults aged 18 and older and is not directed to children. We do not knowingly invite children to open accounts. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

Do not use Tarca to submit regulated health records, government identity documents, Social Security numbers, financial account credentials, biometric identifiers or similar highly sensitive information unless we first agree in writing that the intended processing is supported. Ordinary work content can still contain personal information, and this restriction does not remove our obligations for information we receive.

11. Changes and contact

We will post a revised notice with a new effective date when our practices change. For material changes affecting existing users, we will provide an in-product notice or email as appropriate and obtain any consent required by law. We will not treat a new notice as retroactive permission for a materially different use that requires consent.

Isbell Group, LLC · Tarca — Privacy
7913 Buttonwood Dr.
Fort Worth, Texas 76137, United States

For a privacy request or appeal, email privacy@tarca.app. For general account assistance, email support@tarca.app. You may also send a written request to the address above. See Legal & contact for contact details. Our automated account-email sending address is not a monitored support inbox.