Privacy policy
TabGang lets a group split trip expenses without accounts. We collect as little as possible. Last updated: 2026-10-27.
Who is responsible
The controller for your data is:
- Holder: Legend Digital SL
- Tax ID (CIF): B44913556
- Registered address: Campus de Espinardo 7, 30100 Murcia (España)
- Email: hola@tabgang.com
- Website: tabgang.com
What data we handle
- Trip data: the trip name and the people’s names typed in by whoever creates the trip, and the expenses you log (amount, description, who paid and who shares it, and who confirmed a payment).
- Receipt photos and voice messages: when you send one, it goes to OpenAI only to read the expense, and the result comes back as a draft. TabGang does not store the photo or the audio. Typed text may also be sent to OpenAI to interpret it.
- IP address: processed in memory to stop abuse (rate limits). It is not saved with your trip. Our web server keeps short technical logs without trip links.
- On your device: your browser remembers which name you picked, your language and, for the creator, the admin link (localStorage). These are not cookies and are not sent to anyone for tracking.
- Anonymous counts: we count events such as “trip created” or “trip closed”, with no names, IPs or identifiers of people.
Why and on what legal basis
- Running the trip you asked for (creating it, logging and reading expenses, settling up): performance of a service you request, art. 6.1.b GDPR.
- Security, abuse prevention, AI cost limits and anonymous usage counts: our legitimate interest in keeping the service safe and sustainable, art. 6.1.f GDPR.
We do not sell data, show ads or build profiles.
Who processes it for us
- Hetzner (Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen (Deutschland)): servers and encrypted backups in the EU.
- OpenAI (OpenAI Ireland Ltd (Dublin) / OpenAI, L.L.C. (USA)): reading receipt photos, voice messages and text. This may involve a transfer to the USA covered by the EU‑US Data Privacy Framework and standard contractual clauses. Under its API terms OpenAI does not use this data to train models and may keep it up to 30 days for abuse monitoring.
How long we keep it
Trip data is kept until someone with the admin link deletes the trip. Deleted data disappears from our encrypted backups within about 30 days. Technical logs are kept for at most 14 days.
Deleting a trip
Whoever created the trip has an admin link. From it, “Delete trip” erases the trip, its expenses and its settlement for everyone. Any member can delete individual expenses. If you lost the admin link, write to us from hola@tabgang.com with the trip link and we will help.
Your rights
You can ask for access, rectification, erasure, restriction, objection and portability by writing to hola@tabgang.com. As there are no accounts, include the trip link so we can find the data. You can also complain to the Spanish Data Protection Agency (aepd.es).
Cookies
TabGang uses no cookies and no tracking. We only store on your device what is strictly needed for the features you use (your name, language and admin link), which is exempt from consent under art. 22.2 LSSI. That is why there is no cookie banner.
Minors
TabGang is not aimed at children under 14.