Privacy Policy
This policy explains what ChartBase does with your data — what we collect, where it is stored, who else can see it, and what you can ask us to do about it. It is written to be read, not to be survived.
Who we are
ChartBase is an independently operated software service, run as a sole proprietorship. For anything in this policy, including requests about your own data, contact info@chartbase.io — that address reaches the operator directly.
Where the GDPR applies, we are the data controller for your account information, and a data processor for the business data you upload or connect. In plain terms: your account is ours to look after, and your datasets are yours — we hold them on your instructions.
What we collect
Account information
Your name, email address, and a password. Passwords are hashed with bcrypt (cost 12) and are never stored or transmitted in a form we can read — we cannot tell you your password, only help you replace it.
The data you bring
Files you upload (CSV and Excel), and the tables or query results you import from a database you connect. We store the original file, a processed copy, and a columnar version used to run your charts. We do not inspect, mine, or sell any of it.
You choose what to upload. ChartBase is a general analytics tool and not designed for special-category data — health records, government identifiers, payment card numbers, or children's data. We are not certified for HIPAA or PCI-DSS, and you should not put that data here.
Database credentials
If you connect a database, we store the host, port, database and schema names in the clear, and the username and password encrypted with AES-256-GCM. We recommend a read-only database user — ChartBase never needs write access.
What you build
Dashboards, charts, formulas, filters, snapshots, and the settings that control who can see them.
Technical data
Standard server logs (IP address, timestamp, requested path, status). Request URLs are redacted before they are written, so identifiers that appear in a path are recorded as a short irreversible fingerprint rather than the value itself.
Artificial intelligence features — read this one
ChartBase has optional AI features: generating a dashboard from a description, and suggesting formulas. These send data to a third-party AI provider — OpenAI or Google, depending on how your instance is configured.
What leaves our systems when you use them:
- Your dataset and column names, and their data types
- A sample of your actual rows — up to 8 rows per dataset, across up to 12 datasets, so the model can see the shape of real values
- The description you typed
This means real values from your data leave our infrastructure when you press those buttons. If a dataset contains anything you would not paste into a third-party service, do not use the AI features on it. They are entirely optional — every part of ChartBase works without them, and nothing is sent to an AI provider unless you actively invoke one of those features.
Who else sees your data
We do not sell personal data, and we do not share it for advertising. We use a small number of service providers to run the product:
| Provider | What it does | What it receives |
|---|---|---|
| Paddle.com Market Ltd | Payments, invoicing, tax and refunds — our merchant of record | Name, email address and billing details you enter at checkout. Card details go straight to Paddle; they never reach our servers. |
| OpenAI or Google | AI dashboard and formula generation | Schema and sample rows — only when you use an AI feature |
| Email provider | Verification, invitations, password resets | Email address and message content |
| Object storage | Stores uploaded and processed files | Your uploaded files |
| Vercel Analytics | Aggregate page-view counts | Page URL and coarse device info. No cookies, no cross-site tracking |
| Hosting and database | Runs the application | Everything, as infrastructure |
We will also disclose data if legally compelled, and we will tell you when we are permitted to.
What you choose to make public
Some things are shared because you asked for them to be. These are worth knowing precisely:
- Link sharing. An unlisted link can be opened by anyone who has it, with no account required. Treat the link itself as the credential.
- Embedding. An embed token grants read-only access to that dashboard regardless of its other settings. Rotating the token immediately invalidates the old one.
- Community gallery. Submitting publishes a frozen copy of the dashboard — including the data visible in it — publicly. You can withdraw it, but copies others have already taken are beyond our reach.
Cookies
We use two cookies, db_access and db_refresh. They keep you signed in. Both are HttpOnly (unreadable by JavaScript), SameSite=Lax, and sent only over HTTPS in production. They expire after 7 and 90 days respectively.
These are strictly necessary cookies — the product cannot function without them, and under the GDPR and ePrivacy rules that means no consent banner is required. We do not use advertising, profiling, or cross-site tracking cookies, which is why you have not been asked to accept anything.
How long we keep things
- Account data — until you delete your account.
- Datasets and dashboards — until you delete them. Deleting a dashboard also deletes its snapshots and any dataset private to it.
- Snapshots — capped at 10 per dashboard; the oldest unpinned one is removed when you take an eleventh.
- Logs — a rolling short-term window for debugging and abuse investigation.
Deletion removes the records and the stored files. Backups age out on their own schedule, so a copy may persist there briefly after deletion.
Your rights
Depending on where you live, you have the right to access, correct, export, delete, or restrict use of your personal data, and to object to processing. Under the GDPR you may also complain to your local supervisory authority. Under the CCPA/CPRA we do not sell or share personal information as those terms are defined.
Email info@chartbase.io and we will respond within the period the applicable law requires — 30 days under the GDPR, 45 under the CCPA. We do not charge for this and will not treat you differently for asking.
Security
Passwords are bcrypt-hashed, database credentials are encrypted with AES-256-GCM, traffic is encrypted with TLS and the certificate is verified, and access to every dashboard and dataset is checked on every request. Our Security page describes this in more detail, including what we do not yet do.
We hold no SOC 2, ISO 27001, HIPAA, or PCI-DSS certification. If a compliance questionnaire asks, that is the honest answer.
If we discover a breach affecting your personal data, we will notify affected users and the relevant authorities as required — under the GDPR that is within 72 hours of becoming aware.
International transfers
Our providers may process data outside your country, including in the United States. Where required, transfers rely on the European Commission's Standard Contractual Clauses or an equivalent mechanism.
Children
ChartBase is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has an account, tell us and we will remove it.
Changes
We will update this page when the product changes, and revise the date at the bottom. For changes that materially affect your rights, we will notify account holders by email rather than relying on you to re-read this page.