Privacy Policy

Last updated: 3 October 2026

TablesToXYZ ("we", "us") converts documents such as PDFs, images, receipts, invoices and bank statements into Excel and CSV files, inside AI assistants like ChatGPT, Claude, Cursor and VS Code. This policy explains what personal data we process and why. For the data described here, we are the controller.

1. Data we process

• Account data: your email address (and name if you provide one), and sign-in records needed to keep your account secure.
• Uploaded documents: the files you send for conversion. These may contain sensitive financial information such as bank transactions, account details, invoices and receipts, and personal data of third parties. Please only upload documents you are entitled to process.
• Generated spreadsheets: the XLSX or CSV files we produce from your documents, and a preview (the first rows of each converted table) stored with the conversion record.
• Usage metadata: which conversion you ran, the page count, status, timings, the assistant you used, errors, and product analytics events (page views and feature use). IP addresses are processed transiently to deliver and protect the service.

2. Why we use it

• To provide the conversion service you request (contract).
• To authenticate you, apply fair-use allowances and prevent abuse (legitimate interests).
• To maintain and improve the service, measure reliability and cost (legitimate interests).
• To send essential account emails such as sign-in links (contract).
• To meet legal obligations.

We do not sell personal data and we do not use it for advertising.

3. Retention: automatic deletion after 7 days

Uploaded documents and generated spreadsheets are deleted automatically 7 days after they are created. Download links stop working at that point. The preview rows stored with a conversion record are deleted at the same time. Conversion metadata (type, page count, status, timestamps) is kept while your account exists for usage accounting. Session records (including IP address and user agent) are kept for the lifetime of the session and deleted when it expires or you sign out. Rate-limit counters are short-lived. Deleting your account removes your account data, sessions and conversion records. Cloudflare keeps its own request logs under Cloudflare's privacy policy.

4. No training on your files

We do not use your documents or generated spreadsheets to train AI models. Our AI providers process them only to return a result to us, under terms that do not permit training on this data.

5. Who processes data for us

• Cloudflare, Inc.: hosting, storage (R2, D1), networking, email delivery, and Workers AI and AI Gateway for routing model requests.
• Google (Gemini models), accessed via Cloudflare: reads your documents to extract tables and fields as part of a conversion.
• PostHog (EU region): product analytics, hosted in the European Union and proxied through our own domain. We configure analytics so that IP addresses are not forwarded to or stored by PostHog, and we do not send document contents to it.

These providers act as processors on our instructions. Where data is transferred outside the EEA/UK we rely on appropriate safeguards such as Standard Contractual Clauses. We may update this list and will reflect changes here.

6. Security

Data is encrypted in transit and at rest. Files are stored privately and are downloadable only by the account that created them, through authenticated or short-lived signed links. Access to production systems is limited and logged. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as required by law.

7. Your rights

Depending on where you live (including under the GDPR and UK GDPR) you can request access to, correction of, deletion of, or a copy of your personal data, object to or restrict certain processing, and withdraw consent where we rely on it. You can also lodge a complaint with your local data protection authority. To exercise a right, or to delete your account and its data, email privacy@tablesto.xyz. We respond within one month.

8. Cookies

We use a session cookie to keep you signed in and first-party analytics storage to understand how the site is used. We do not use advertising cookies.

9. Children

The service is not intended for people under 16 and we do not knowingly collect their data.

10. Changes and contact

We will post changes to this policy on this page and, for material changes, notify you by email. Questions: privacy@tablesto.xyz.