Privacy Policy

Last updated 19 October 2026

Tarshal is operated by Monolith®, a design studio in Montréal, Québec. This policy describes what Tarshal collects, where it is kept, who can see it, and what happens when you stop using it. It covers the application at app.tarshal.com and this site.

Who the information is about

Four groups, and we hold different things about each:

• People who use Tarshal — staff of a company that holds an account.
• Clients of that company — the businesses and contacts an estimate or invoice is addressed to. They never sign in; their details are entered by the company they work with.
• Suppliers of that company — the talent and businesses it hires. Most of their details are entered by the company; some they give themselves, when they apply through the company’s public form or update them in their supplier portal.
• People who write to us through the Contact form on this site.

What we collect

From people who use Tarshal:

• Name, work email address, job title and profile photo.
• Employment details recorded by their employer — hiring date, salary, vacation entitlement, contracts and signed agreements. These are entered by the company, not by us.
• Time entries: hours, dates, the project and activity, and any note written against them.
• Expenses and the receipts submitted with them.

From a company’s own records: its clients and contacts, projects, estimates, invoices and payments.

About a company’s suppliers: name, contact details, website or portfolio, location, skills and agreed rate; the agreements they sign in their portal, with the name they sign with; their purchase orders and bills; and how each order went (on time, and its quality), with any note the company keeps about their work.

From the Contact form on this site: your first and last name, email address, company if you give one, and what you are writing about. We keep the message in Tarshal and email it to our studio, so we can answer you. Nothing else is recorded about you, and you are not added to any mailing list.

We use no advertising trackers, build no profiles for marketing, and sell information to nobody.

Where it is kept

Application data is stored in a PostgreSQL database hosted by Supabase in Canada, in the Montréal region, and the application’s server runs on Vercel beside it, also in Montréal; Vercel’s network delivers pages from the location nearest you. Email Tarshal sends, such as estimates and invoices, goes through Resend, in the United States. So does the copy of a Contact message or support request sent to our studio, which is then kept in the studio’s mailbox, at Google Workspace. Of the other services listed below, Google, Stripe, Intuit and Anthropic are in the United States too, and each receives only what its part needs.

Who can see it

Access is enforced by the database on every read, not only by the interface. A person sees their own time and expenses; managers and owners see what their role permits; salary and internal cost rates are restricted to owners and super administrators and are never sent to anyone else’s browser. We do not look at a customer’s data except where they ask us to for support, or where the law requires it.

Services we rely on

• Supabase — the database, and sign-in.
• Vercel — application hosting.
• Google — sign-in, calendar access where a person connects it, and our studio’s email, where Contact messages and support requests arrive.
• Resend — the email Tarshal sends, such as estimates and invoices, and each message written through this site’s Contact form, delivered to our studio.
• Stripe — card payments on invoices, where a company enables them. Card details are handled by Stripe and never reach us.
• Intuit — QuickBooks Online, where a company connects its books so invoices and payments can be copied across.
• Anthropic — where a person connects Claude to log time by asking. That connection acts strictly as them, with their permissions and no others.

Each connection is made deliberately, by the company or by the person, and each can be ended at any time from Integrations.

Connected accounts, and disconnecting

When a service is connected we store the tokens needed to talk to it and nothing more. Disconnecting revokes the grant with the provider and deletes the tokens we hold. We read a connected QuickBooks company only for the customers, items, invoices and payments needed to copy documents across. What a connected Google Calendar is used for is set out below.

Google account data

Tarshal uses Google in two separate ways, each with its own permission from you.

• Signing in with Google. Google tells us your name, email address, profile picture and an identifier for your Google account. Tarshal uses only the email address, to find the profile your company created for you; if there is none, you are signed straight back out. Our sign-in service, Supabase, keeps what Google returns with your sign-in record. We take nothing else from your Google account: no contacts, files or mail.
• Connecting Google Calendar, which you choose to do from your timesheet. Tarshal then adds each time entry you save to the calendar you connected, as an event, and changes or removes that event when you edit or delete the entry. It also reads that calendar’s events for the current week, to offer your meetings as time you can log. We keep no copy of your calendar: a meeting you choose to log becomes a time entry, and we keep the identifier that links the two.

Google account data is used only to provide these features to you. It is never sold, never used for advertising, never used to train AI models, and never shared, except with the services listed above that run Tarshal, and only as far as running it needs.

You can disconnect Google Calendar at any time from your timesheet: we revoke the permission with Google and delete the tokens we hold. You can also remove Tarshal’s access from your Google account, at myaccount.google.com/permissions.

Tarshal’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How long it is kept

Business records — time, estimates, invoices and expenses — are kept for as long as the company keeps its account, because they are that company’s books. Archiving a person ends their access but keeps the work they did, since removing it would silently change historical totals. On request we will export or delete a company’s data.

A message sent through this site’s Contact form, and the copy emailed to our studio, is kept until we delete it. Ask us and we will delete yours.

Your rights

Under Québec’s Act respecting the protection of personal information in the private sector and Canada’s PIPEDA, you may ask what we hold about you, ask for it to be corrected or deleted, withdraw consent for a connected service, and complain to the Commission d’accès à l’information du Québec. Where the information was entered by your employer, ask them first — they control it and we act on their instructions.

Security

Traffic is encrypted in transit. Credentials for connected services are held server-side and are useless on their own, because redeeming them needs secrets that are never stored in the database. Every read of every record is checked in the database itself.

Changes

If this policy changes materially we will say so here and update the date above.

Contact

Questions about this policy, or a request about your own information: