Privacy policy

Version 2026-10-22 · applies to tablewise.dev and api.tablewise.dev

Short version: the CLI and the desktop app send nothing anywhere. The hosted API deletes your document after answering and logs metadata, never content.

1. Who is responsible

Tablewise is operated from Spain by Luis Francisco Palomares Gamarra ("we", "the controller"). Contact: hello@tablewise.dev.

2. What we process

Data	Why	Retention
Email address	Identify the account, billing, support	Until you delete the account
API key (SHA-256 hash only)	Authenticate requests	Until the key is revoked
Monthly unit counts	Quota and billing	24 months
Request metadata (time, size, engine, duration, status)	Operate and debug the service	30 days
Payment data	Charged by Stripe; we never see card numbers	Stripe's policy

3. What we never store

The content of your documents. Uploads are written to an ephemeral directory, converted, returned, and deleted. Nothing is queued for training.
Your document file names beyond the source field in the Markdown you receive (kept only in the event log if you have logs enabled — off by default).
Card data. Stripe handles the payment page end to end.

4. Legal basis

Contract performance for the service you request (Art. 6.1.b GDPR); legitimate interest for security and abuse prevention (Art. 6.1.f); consent for any optional email you subscribe to (Art. 6.1.a).

5. Sub-processors

Provider	Purpose	Location
Stripe Payments Europe	Payments and invoices	EU / US (SCCs)
Render Services Inc.	Cloud compute for the API	EU region
GitHub Inc.	Source code and issues	US (SCCs)
Cloudflare Inc.	DNS and static site delivery	Global edge

We notify changes to this list 30 days in advance by email to paying accounts.

6. Your rights

Access, rectification, erasure, restriction, portability and objection, by writing to hello@tablewise.dev. We answer within 30 days. You may complain to the Spanish AEPD (aepd.es) or your local authority.

7. Security

TLS everywhere, hashed keys, least-privilege containers, no document content in logs. A security report can be sent to the same address; we do not retaliate against good-faith research.

8. Changes

Material changes are announced by email 30 days before they apply. The current version always lives at this URL.