Privacy Policy
Last updated October 16, 2026
This policy explains what personal data Tabstra collects, why, and the choices you have. Tabstra is operated from Sweden and follows the EU General Data Protection Regulation (GDPR).
What we collect
- Account data: your email address, display name and, if you sign in with Google, your profile picture.
- Your content: spreadsheets, dashboards, version history and the requests you send to the assistant.
- Usage data: credit usage, AI request records and basic, anonymous page analytics.
- Free tools: when you use a free tool without an account, we store a one-way hash of your IP address to apply fair-use limits. We do not store the IP address itself.
How we use it
- To provide the service: save your work, run AI requests you ask for and keep your credit balance correct.
- To keep Tabstra secure and prevent abuse.
- To improve the product using aggregated, non-identifying statistics.
We do not sell your personal data, and we do not use your spreadsheets to train AI models.
Legal basis
- Contract: running your account, saving your work and processing the AI requests you make.
- Legitimate interest: security, abuse prevention, fair-use limits on free tools and aggregated product statistics.
- Legal obligation: bookkeeping and tax records once payments are enabled.
AI processing
Tabstra's assistant is powered by AI models from Anthropic, PBC (USA), accessed through Anthropic's commercial API. When you send a request, your request and the relevant parts of your workbook are sent to Anthropic to generate the answer. Anthropic acts as our processor, does not use API data to train its models, and keeps data only for a limited period for safety and abuse monitoring under its commercial terms. Avoid putting sensitive personal data (for example health information or national ID numbers) into requests unless it is necessary.
Service providers and transfers
- Anthropic, PBC (USA): AI processing.
- Hosting, database and authentication providers: storing your account and workbooks.
- Google: only if you choose to sign in with Google.
- Payment provider: once payments are enabled.
Some providers are located outside the EU/EEA, including in the USA. Such transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses. Providers only process data as needed to provide their service to us.
How long we keep data
We keep your account and content while your account is active. When you delete a project it is removed, including its version history. You can ask us to delete your account and all associated data at any time.
Your rights
You can request access to, correction of, export of or deletion of your personal data, and you can object to certain processing. You also have the right to complain to the Swedish Authority for Privacy Protection (IMY).
Contact
The data controller is Woberry AB (Org.nr 559474-0267), Träkilsgatan 50, 416 50 Göteborg, Sweden. For privacy questions or requests, use our contact form and choose "Privacy request".
Messages sent through the contact form (name, email, message) are stored to answer you.