Privacy Policy for gettabula.app and hosted Tabula workspaces

Last updated: 18 October 2026.

1. Who is responsible

Saldes Technology Group AB, org. no. 559391-2776, Landbackegatan 14, 212 30 Malmö, Sweden ("Tabula", "we"). Contact: legal@gettabula.app. Data protection questions: legal@gettabula.app.

We are the controller for visitors to gettabula.app, for signup and billing, and for the records we keep to run the service (section 5). For what people put into a workspace (boards, comments, chat, members' and guests' names and email addresses) the customer who owns the workspace is the controller and we are the processor, acting on their instructions. If you are a member or guest of someone's workspace, ask the owner first; we help them.

This policy covers the hosted service only. If you run the software yourself, nothing reaches us. The software still loads its interface fonts from Fontshare's servers, and any icon from a set it does not include from Iconify's servers; both see your IP address and browser (see Fonts and Icons in section 2).

2. Visitors to gettabula.app

Analytics. We use PostHog, hosted in the EU, on this marketing site to count how people use it (and, separately, for product analytics in hosted workspaces, section 5): page views, whether the pricing or education pages were seen, whether the demo was opened and from where on the site, the steps towards signup, and when a page error happens (which page and the error's kind, nothing else). It sets no cookie and stores nothing in your browser; the only identifier is a random id kept in memory for one page view, gone when you close or reload the page. We send no name, email, form contents or full addresses, PostHog does not keep your IP address, and no profile of you is made. On the page after checkout we also send the address you chose for your workspace (for example "acme"), so we can count which trials become paid workspaces; it is the workspace's name, not yours, and we send nothing else from the form. If your browser sends "Do Not Track" or "Global Privacy Control", we send nothing.

Fonts. The demo and the workspace app load fonts from Fontshare's servers (Fontshare's licence does not allow us to serve them ourselves), so Fontshare sees your IP address and browser details when fonts load, and again when someone uses the font picker in a workspace. Your browser caches the fonts afterwards. The marketing site's own fonts are served from our servers, so a visit to gettabula.app makes no font request to a third party.

Icons. The workspace app serves its icon sets itself. If someone places an icon from a set we do not host, the app fetches it from Iconify's public servers, which then see your IP address and browser details for that request. The demo cannot do this.

Server logs. Our hosting providers keep request logs with IP addresses for a short time to run and protect the service. Our edge router forwards requests to your workspace and keeps no content.

3. Starting a workspace and paying

At signup we store your email address, the workspace name and address, and the region. Stripe runs the checkout: your card, billing address and VAT number go to Stripe and never touch our servers. Stripe is the controller for your payment data. We receive customer and subscription references, invoice status and the billing email, and use Stripe Tax to work out VAT.

We use this to create and run your workspace, bill you, and email you about your subscription (trial ending, failed payment, a link to restart a suspended workspace). Legal basis: our contract with you, and our legal duty to keep accounting records.

4. Inside a workspace: what is stored about people

For every member and guest: email address, display name, role, and whether the account is disabled; sign-in links (stored as a hash, valid 15 minutes) and sessions (which browser, last seen; 30 days); an audit log of actions such as inviting someone or deleting a board, with who did it; comments and chat messages with the author's name (chat is kept one year by default; the admin can change this); boards, images and version history. Live edits on a board are not recorded against a person. Sign-in is by emailed link; we store no passwords.

Workspace owners and admins can see members' email addresses, last sign-in, active sessions and the audit log. Guests see only boards shared with them.

AI. If the admin turns AI on and enters an API key, the key is encrypted on the server (AES-256-GCM) and never shown again. When someone runs an AI feature, that board's content goes to the provider the customer chose, under that provider's terms. We run no AI on a key of our own yet.

5. What we keep to run the service

Our control plane, on one volume in Amsterdam, keeps per workspace: the owner's email, the workspace's name, address and region, Stripe references, the workspace's state and its history (trial, active, past due, suspended), a log of what we did to it (suspend, resume, extend a trial), the hours its machine was running, disk usage, weekly member counts, and daily counts (boards, members, guests, active people in the last 7 and 30 days, AI runs, chat messages). Counts only: nothing from inside a board, no titles, no names or email addresses of members. We use them to run the service, see whether trials convert and plan capacity. Legal basis: legitimate interest. We do not sell personal data and show no advertising.

Product analytics in hosted workspaces. Each hosted workspace sends PostHog, hosted in the EU (Frankfurt), a report once an hour of how its features are used: counts and durations (for example boards opened, timers and polls run, AI runs, chat messages sent), the software version, and counts of device types and browser families. The report is keyed to the workspace, never to a person: it contains no names, email addresses, user or session ids, IP addresses, and nothing from your boards, comments or chat. It is sent by the workspace's server, so nothing is read from or stored in your browser for it. We keep it for 12 months, then it is deleted. The workspace owner can turn product analytics off under Admin → Privacy, and it stops at once. Operating data that we need to run the service (above) is collected either way and kept on our own server in Nuremberg, Germany (Hetzner, EU) as hourly figures for 13 months. Legal basis: legitimate interest.

6. Where data is stored and who else handles it

You choose your workspace's region at signup: EU (Fly.io, Amsterdam) or US (Fly.io, Ashburn, Virginia). A US workspace stores its boards and its members' and guests' data in the United States; if you add people from the EU to a US workspace, you as the controller are making that transfer. Whichever region you choose, our control plane (section 5) and our email relay run in Amsterdam, so the emails we send for a US workspace pass through the EU. Snapshots are stored with the workspace's storage. Our processors:

Processor	What for	What they see
Fly.io	hosting workspaces, the control plane, the email relay and the edge	everything in your workspace, in Amsterdam or Ashburn as you chose
Vercel	hosting gettabula.app and the signup form	visitor IP addresses and the email address you type at signup, in transit
Stripe	payments, invoices, VAT	billing details and card (as controller)
Mailgun	sending our emails	the emails we send (address and content, including sign-in links) and delivery results, through Mailgun's EU region
Fontshare	web fonts in the demo and the workspace app, and the font picker	your IP address and browser details when fonts load or the picker searches; we store font names in boards, never font files
Iconify	icons not in the sets we host, fetched on request in the workspace app	your IP address and browser details for that request only
PostHog	analytics on the marketing site, and product analytics for hosted workspaces	site: anonymous page events, no cookie, no profile; workspaces: per-workspace counts, durations, versions and device-type counts, no person identifier, no content; EU-hosted (Frankfurt), kept 12 months
Hetzner	hosts our own server in Nuremberg (Germany, EU) for monitoring the hosted service	per-workspace operating data (versions, counts, resource use, backup results); no content, no person identifiers; kept 13 months
GitHub	hosting the public code	no customer data

We update this list before adding a processor that handles customer data.

7. Emails we send

Sign-in links (including when you accept an invite), a notice before a trial ends, a restart link for a suspended workspace (to the billing email), and chat-mention emails, which each person can turn off. Stripe sends receipts and failed-payment notices. No marketing email.

8. How long we keep data

• Workspace data: while the subscription runs. After suspension (unpaid or cancelled) it is kept 30 days, then deleted. The address stays reserved 90 days, with no data.
• Snapshots: daily, kept 14 days, plus one taken before each upgrade.
• Chat messages: one year by default, set by the admin.
• Billing and control-plane records: as long as accounting requires. Swedish bookkeeping law: 7 years.
• IP addresses for rate limiting are counted in memory, not stored by us.

9. Deleting a person's data, honestly

When an admin removes a member, their account and sessions go at once. Their comments stay under the name they were written with; their chat messages are anonymised. An admin can also erase a person's chat messages, which overwrites the text immediately, and can export a channel's messages.

Erased data stays in snapshots until they age out (14 days). Removing a removed member's data from backups is being built. Today, restoring a workspace from an older snapshot can bring back content erased after it, and we would erase it again. We say this plainly rather than promise what the code does not do.

10. Security

HTTPS everywhere. Sign-in, session and invite tokens are stored as hashes. The session cookie is HttpOnly and tied to your workspace's address. AI keys are encrypted at rest. Each workspace runs on its own machine with its own storage. Operator access is limited to running the service, restoring a backup, or helping you when you ask. This is a beta: report security problems to legal@gettabula.app.

11. Your rights

Under the GDPR you can ask for access to your data, correction, deletion, a portable copy, restriction, and to object to processing based on our legitimate interest. Write to legal@gettabula.app. If your data is in someone's workspace, we route the request through that workspace's owner, the controller. You can export your boards yourself at any time. You can complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or the authority of your own EU country.

12. Cookies and browser storage

The workspace app sets one session cookie, needed to keep you signed in, and keeps your board list, a chat cache and fonts in browser storage so it works offline. Marketing site: no analytics cookie and no browser storage (see section 2). No advertising cookies anywhere.

13. Children

Workspaces used by schools may hold students' data. The school is the controller and decides whether a student is added.

14. Changes

We email the workspace owner before a change that affects them. The date at the top says when this was last changed.