Legal

Privacy Policy

Last updated: 23 July 2026

This policy explains how personal data is processed when you use Tabla ("the Service"), in accordance with the EU General Data Protection Regulation (GDPR / DSGVO).

1. Controller (Art. 4(7) GDPR)

The controller responsible for data processing on this site is:

Marco Traspel
Email: tabla@mt-web.dev
The operator's full postal address is listed in our Impressum.

A data protection officer has not been appointed. Tabla is operated by a single individual and does not carry out large-scale or systematic processing of the kind that would require the appointment of a data protection officer under Art. 37 GDPR / § 38 BDSG.

2. Categories of data we process

  • Account data: your email address, submitted when you request a magic sign-in link.
  • User content: the boards you create — text, links, sketches, stickers, and any images you upload.
  • Board-view analytics: for public boards, an aggregate view count and a first-party de-duplication identifier (the tabla_vid cookie), collected only with your consent.
  • Technical/log data: data processed to operate and secure the Service, including error diagnostics (see processors below). IP addresses may be processed transiently by our hosting and email providers.

3. Purposes and legal bases (Art. 6(1) GDPR)

  • Authentication (magic-link sign-in) — to provide access to your account. Legal basis: Art. 6(1)(b) (performance of a contract).
  • Storing and displaying your boards — to provide the core Service, including publicly shared boards at /b/{id} when you choose to make a board public. Legal basis: Art. 6(1)(b).
  • Board-view analytics — to show board owners aggregate view counts. Legal basis: Art. 6(1)(a) (consent); you can decline via the cookie banner.
  • Security, error monitoring, and abuse prevention — to keep the Service reliable and safe. Legal basis: Art. 6(1)(f) (legitimate interests). Our legitimate interest is keeping the Service available, secure, and free from abuse; the processing is limited to what is necessary for that purpose, does not involve profiling or intrusive monitoring, and we consider it not to override your interests or fundamental rights.

4. Recipients and processors

We use the following processors, each engaged under a data processing agreement (Art. 28 GDPR):

  • Resend — delivery of magic-link authentication emails (processes your email address).
  • Cloudflare R2 (S3-compatible object storage) — storage of images you upload to your boards.
  • Netlify — application hosting and the (Postgres) database that stores your account and board data.
  • Sentry (EU region) — error and performance monitoring. Sentry is configured without session replay and does not set cookies; events are proxied through our own server.

Each processor acts only on our instructions under a data processing agreement, and each publishes its own privacy terms describing how it handles data on our behalf.

5. International transfers

Some of the processors listed above may process data outside the EU/EEA (for example in the United States). Where that occurs, transfers are safeguarded by appropriate measures under Chapter V GDPR — typically the EU Standard Contractual Clauses and, where the processor is certified, the EU–U.S. Data Privacy Framework. Sentry is used in its EU region, so error-monitoring data stays within the EU.

6. Retention

  • Account and board data are retained for as long as your account exists. When you delete a board or your account, the data is removed from our active systems immediately and purged from routine encrypted backups within 30 days.
  • Board-view analytics are stored only as aggregate counts that are not linked to an identifiable person, and are kept for the lifetime of the board.
  • Magic-link tokens expire within minutes of issue.

7. Cookies and local storage

Tabla sets a strictly necessary session cookie to keep you signed in — this is exempt from consent. On public boards, we set an optional analytics cookie (tabla_vid) only if you accept it in the cookie banner; declining leaves no analytics cookie set. Your theme preference and recently used emojis are stored in your browser's local storage for functionality only and are not used for tracking. You can change your cookie choice at any time by clearing the tabla_consent cookie.

8. Your rights

Under the GDPR you have the right to:

  • access your personal data (Art. 15);
  • rectify inaccurate data (Art. 16);
  • erase your data (Art. 17, "right to be forgotten");
  • restrict processing (Art. 18);
  • data portability (Art. 20);
  • object to processing based on legitimate interests (Art. 21);
  • withdraw consent at any time, without affecting prior processing (Art. 7(3));
  • lodge a complaint with a supervisory authority (Art. 77). You may contact the data protection authority of the German federal state in which the operator is established — [PLACEHOLDER — specific authority pending the operator's confirmed address (ticket 087)] — or any other EU supervisory authority, in particular the one in your country of residence.

To exercise any of these rights, contact us at tabla@mt-web.dev.

9. Changes to this policy

We may update this policy as the Service evolves. Material changes will be reflected by updating the "last updated" date above; where a change materially affects how we process your personal data and we have a way to reach you, we will make reasonable efforts to notify you in advance (for example by email).