Privacy Policy

Wiblo is now Tugboat. The company behind it is the same: Wiblo LLC. This policy replaces the Wiblo Privacy Policy of August 13, 2026. Where the product, the command-line tools, an email, or an earlier agreement still says Wiblo, it means Tugboat.

1. Who we are and what this policy covers

Tugboat is the operating system for small service businesses. It runs bookings and scheduling, services and availability, clients, intake forms, websites, and teams in shared workspaces, and it can be operated by people and by AI agents. Tugboat is provided by Wiblo LLC, a Delaware limited liability company (“Tugboat”, “we”, “us”).

This policy covers the information we handle through the website at heytugboat.com and our earlier domain wiblo.app, the Tugboat web and mobile applications, the command-line tools, the API, the AI agents, the component library, and the websites we host for our customers (together, the “Service”). It forms part of our Terms of Service.

This policy does not cover how a business that uses Tugboat handles your information for its own purposes. That business’s own privacy notice does. It also does not cover third-party services you connect to Tugboat, which have their own policies.

2. Our two roles

What we do with information depends on whose it is.

• Information about our customers. Our customers are the businesses and people who hold Tugboat accounts and run workspaces. For your account information, your usage of the Service, and your communications with us, we decide how the information is used. We are the controller (in South Africa, the responsible party), and this policy describes what we do.
• Information our customers put into Tugboat. A business’s workspace holds information about its own clients, staff, and website visitors: bookings, client records, form answers, messages, and similar records. That business decides why and how that information is processed. The business is the controller and we are its processor (in South Africa, its operator; under US state laws, its service provider). We process that information only to provide the Service to the business, under the data processing terms in section 9 of our Terms of Service.

If you booked with, filled in a form for, or visited the website of a business that uses Tugboat, the business is responsible for your information. Please send questions and requests to that business. If you write to us, we will pass your request to the business and help it respond. Section 15 explains this further.

3. Information we collect

Information you give us

• Account details. Your email address and password. We store your password only as a one-way hash and never see it. If you choose, your display name and profile image. Profile images are served from a public address, so anyone with the link can see them.
• Workspace content. What you and your team put into a workspace: the business name, logo, and branding; services, prices, and schedules; availability and bookings; client and contact records; form questions and answers; notes; the members and roles of your team; files; the content of your websites; and the git repositories that hold your workspace’s code and configuration.
• Instructions and conversations with agents. What you ask an agent to do, the conversation with it, the files it creates, and the memory and skill files it keeps for your business. Section 5 covers agents in detail.
• Billing information. When you buy a paid plan, our payment processor collects your card details and billing address. We never see or store your full card number. We keep the plan, the transaction records, and your billing contact details.
• Messages to us. What you send us for support, feedback, or any other reason, and our replies.

Information we collect automatically

• Service logs. When you, your team, or your agents use the Service, our systems record technical information: the time, the request path and result, IP address, browser and device type, and error details. We do not log request bodies in normal operation.
• Access and security records. Sign-ins, the creation and use of access tokens and API keys, and the approval of command-line sign-ins. For token activity we keep only a hashed form of the IP address. When you approve a command-line sign-in, we show you the requesting device’s IP address and browser details so you can check the request is yours, and we keep them with the record of that sign-in for security auditing.
• Abuse protection. To stop automated abuse of public endpoints such as booking forms, we count requests per IP address for short periods and check browser signals for bot activity.
• Agent activity. A record of each agent run: the steps it took, the tools it used, the files it changed, the model it used, and its usage and cost.
• Cookies and local storage. These keep you signed in and remember display preferences. Section 8 lists every one.

Information from third parties

• Google sign-in. If you sign in with Google, Google gives us your email address, name, and profile image. We use them only to create and sign you in to your Tugboat account and to show your name and picture in the Service. We copy the image to our own storage so it keeps working. We never see your Google password, and we do not request access to your Gmail, Calendar, Drive, or contacts. We do not sell Google user data, use it for advertising, or use it to train AI models. Tugboat’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
• Services you connect. If you connect another service to your workspace, we receive what you authorize that service to share.
• Your team. When someone invites you to a workspace, they give us your email address.

Information we ask you not to give us

The Service is not built for highly sensitive information. Please do not put health or medical records, payment card numbers, bank account numbers, government identity numbers, biometric data, or information about children into the Service. The Terms of Service set out this rule in full.

4. How we use information and why

We use information to:

We do not sell personal information. We do not use your content for advertising, and we show no advertising in the Service. We do not run third-party analytics or tracking on the Service today. We plan to add Google Analytics to our website, and before we do, we will update this policy and our Cookie Policy and ask for consent where the law requires it. Information that has been aggregated or de-identified so it no longer identifies anyone is not personal information. We will not try to re-identify it, except to check that our de-identification works.

Who at Tugboat sees your content. Our systems process workspace content automatically. Our staff look at the content of a workspace only when you ask us to (for example, to help with a support request or an agent run), when it is needed to investigate abuse, a security incident, or a breach of our terms, or when the law requires it.

5. AI agents and AI features

Tugboat’s agents are AI systems that can read and change your workspace, write code and content, and build and publish your websites when you or your team ask them to.

Where agents run. Each agent works in an isolated cloud computer (a sandbox) set aside for your workspace. No other customer’s agent can reach it. The sandbox holds a working copy of your workspace’s repositories, and it goes to sleep when no agent is working. Its saved state is kept so the next run starts quickly.

What goes to AI model providers. Agents are powered by third-party large language models. To run an agent, we send the model provider what the model needs to do the work: your instructions, the conversation, and the workspace content and files the agent reads. Today that provider is Anthropic (Claude models), reached through Vercel’s AI Gateway. Before we add another model provider, we will add it to the list in section 6.

No training on your content. We do not use your content, your agent conversations, or your clients’ information to train AI models. We use our model providers through their business offerings, whose terms do not permit them to train on that content either.

What we keep. We keep the record of each agent run (section 3) so you can review what the agent did, along with the files it changed in your repositories and the memory and skill files it keeps for your business. You can read and delete those files. Usage and cost records are kept for billing.

No automated decisions about you. We do not use AI or other automated processing to make decisions about you that have legal or similarly significant effects, such as decisions about credit, employment, housing, or insurance. If your business uses an agent to help make decisions about your own clients or staff, your business is responsible for those decisions.

6. How we share information

People and agents you authorize can see your content: workspace members see the workspaces they belong to, in line with their roles. Beyond that, we share information only in these cases.

With the service providers that run Tugboat

We use the companies below to provide the Service. Each one may use the information only to provide its service to us, under a written agreement that requires it to protect the information.

We will update this list before a new provider starts handling personal information. The Terms of Service explain how a business can follow those changes and object to them.

Some emails we send load their typeface from Google Fonts when you open them, which tells Google your IP address. Stripe handles payment details under its own privacy policy.

Other sharing

• At your direction. When you connect a third-party service, invite someone to a workspace, or publish a website, we share what that action needs. A published website is public.
• When the law requires it. We disclose information when we believe in good faith that the law, a court order, or a valid government request requires it. Where the law allows, we will tell you first. We may also disclose information to protect the rights, safety, or property of Tugboat, our users, or others, or to prevent fraud or abuse.
• In a business transfer. If Wiblo LLC is part of a merger, acquisition, financing, reorganization, or sale of assets, information may transfer with the business. The recipient must keep honoring this policy, or give you notice and a choice before any change.
• With your consent. In any other case, we share only with your permission.

7. Websites we host for our customers

Tugboat builds and hosts websites for the businesses that use it. When you visit one of those websites:

• The business is responsible for the website and for any information it collects there, such as booking requests or form answers. That business’s privacy notice applies. We process that information for the business as its processor.
• Our hosting provider keeps standard server logs of visits, including IP address, browser type, and the pages requested, to deliver and secure the website. These logs are kept for a short period.
• Our standard website sets no cookies and loads no tracking or advertising scripts. A business can change its own website, so check that business’s notice for its practices.

8. Cookies and similar technologies

We use only the cookies and browser storage the Service needs to work and to remember your own settings. We set no advertising cookies and no third-party analytics cookies, so there is nothing to consent to and no cookie banner. Our Cookie Policy has the same list and our plans for analytics.

The mobile app keeps your sign-in in the device’s secure storage. The command-line tools keep their sign-in in a file in your user folder, which you remove with the logout command.

Do Not Track and Global Privacy Control. We do not sell or share personal information and do not track you across other websites, so the Service behaves the same whether or not your browser sends these signals. We treat a Global Privacy Control signal as a valid opt-out request where the law requires it.

9. How long we keep information

We keep information only as long as we need it for the purposes in section 4.

We may keep information longer when the law requires it, to resolve a dispute, or to enforce our terms. Information that has been de-identified may be kept without a time limit.

10. Security

We protect information with measures that fit its sensitivity:

• encryption in transit, and encryption at rest by our infrastructure providers;
• hashed passwords and hashed access tokens;
• workspace access controls enforced in the database;
• short-lived, narrowly scoped credentials for agent runs;
• isolated sandboxes for agent work, one set per workspace;
• access to production systems limited to the people who need it.

No system is perfectly secure. If a security breach affects your personal information, we will notify you and the authorities as the law requires. For information we hold for a business, we notify that business without undue delay so it can meet its own duties.

11. International transfers

Wiblo LLC is based in the United States. We store and process information in the United States, mainly in the US East region. If you use the Service from another country, your information is transferred to the United States, where privacy laws may differ from yours.

When we transfer personal information out of the European Economic Area, the United Kingdom, Switzerland, or South Africa, we protect it with a recognized safeguard. For transfers to us, we use the European Commission’s Standard Contractual Clauses, the UK Addendum to them, and the binding agreement required by section 72 of South Africa’s Protection of Personal Information Act (POPIA). Our Terms of Service include these for businesses. For onward transfers to our providers, we use the same clauses or the EU-US Data Privacy Framework where a provider is certified. Contact us for a copy of the safeguards that apply.

12. Your rights

Wherever you live, you can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct information that is wrong;
• delete your information;
• give you your information in a portable format;
• stop sending you marketing emails.

Depending on where you live, you may also have the right to object to or restrict certain processing, to withdraw consent you gave us, and to complain to a data protection authority. Section 13 lists the rights in specific places.

How to make a request. Most of your account details can be changed in your account settings. For anything else, email support@heytugboat.com. We will confirm your identity before we act, usually by asking you to reply from your account email. Someone you authorize may make a request for you with proof of that authority. We will respond within the time the law sets, usually within 30 days (45 days under US state laws), and will not charge you unless a request is clearly unfounded or excessive.

Appeals. If we decline your request, we will explain why. You can appeal by replying to our answer or emailing support@heytugboat.com with “Appeal” in the subject. We will answer the appeal within the time the law sets. If you are not satisfied, you can contact your state attorney general or data protection authority.

We will never treat you differently for exercising a privacy right.

13. Region-specific information

European Economic Area, United Kingdom, and Switzerland

The legal bases we rely on are in section 4. Where we rely on legitimate interests, you can object, and we will stop unless we have compelling grounds to continue. Where we rely on consent, you can withdraw it at any time. You can complain to the data protection authority where you live or work, or where you believe a breach happened. We would be grateful for the chance to resolve your concern first.

United States

This section applies under the privacy laws of California and the other US states that have them.

What we collect. In the past 12 months we collected these categories of personal information: identifiers (such as name, email address, IP address, and account ID); customer records (such as billing details); commercial information (such as your plan and transactions); internet and network activity (such as service logs); approximate location inferred from IP address; professional information (such as your business and role); and the content of your messages and files. The sources are you, your devices, your team, Google sign-in if you use it, and services you connect. We use them for the purposes in section 4 and disclose them only to the providers and in the cases in section 6.

Sensitive personal information. The only sensitive personal information we collect is your account login (email address and password), which we use only to authenticate you. We do not use or disclose sensitive personal information for any other purpose, so there is no use to limit.

Sale, sharing, and profiling. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of anyone under 16. We do not use personal information for profiling that produces legal or similarly significant effects, and we do not use automated decision-making technology to make significant decisions about you.

Your rights. Depending on your state, you have the right to know what we collect and how we use and disclose it, to access it, to correct it, to delete it, to receive it in a portable format, to opt out of sale, sharing, targeted advertising, and certain profiling, and to appeal our decision on your request. Section 12 explains how to use these rights. California residents may also ask us once a year about disclosures for direct marketing. We make none.

Consumer health data. Tugboat does not collect consumer health data for its own purposes. When a business stores such data in its workspace, the business is responsible for it, and we process it only on the business’s instructions.

South Africa

For information about our customers, Wiblo LLC is the responsible party under POPIA. For information a business stores in its workspace, the business is the responsible party and we are its operator. You have the rights in section 12, as well as the right to object to processing and to direct marketing, and the right to complain to the Information Regulator. You can reach our Information Officer at support@heytugboat.com.

Other countries

If you live somewhere else with a privacy law that gives you rights over your information, we will honor those rights. Contact us as section 12 describes.

14. Children

The Service is for adults running businesses. You must be at least 18 to hold a Tugboat account. The Service is not directed at children, and we do not knowingly collect personal information from anyone under 18 for our own purposes. If you believe a child has given us personal information, contact us and we will delete it. A business must not use Tugboat to collect information about children except as the law allows and with the consent the law requires.

15. If you are a client of a business that uses Tugboat

When you book with, fill in a form for, or are recorded as a client of a business that uses Tugboat, that business controls your information. It decides what it collects, why, and how long it keeps it, and its privacy notice describes that.

To access, correct, or delete your information, please contact the business directly. If you contact us, we will pass your request to the business, usually within 5 business days, and help the business respond. We cannot act on your information without the business’s instructions, except where the law requires us to.

16. Changes to this policy

We may update this policy as the Service and the law change. When we do, we update the date at the bottom. If a change is material, we will tell you before it takes effect, by email to your account address or by a notice in the Service, usually at least 30 days in advance. We will not make a material change to how we use information we already hold without the notice or consent the law requires.

17. Contact us

Wiblo LLC, operating as Tugboat. Email: support@heytugboat.com.

This policy is effective as of October 18, 2026.