This translation is provided for convenience. If it differs from the French version, the French version prevails, without prejudice to your statutory rights as a consumer.
Privacy
Effective 3 October 2026.
tabello is a shared board for architects. You upload drawings to it, often confidential ones. This page explains what we do with your data, where it is, how long we keep it, and how to exercise your rights. In short: we keep only what is needed for tabello to work. Your data is hosted in the European Union. Only AI rendering, if your team turns it on, sends a view outside the Union. We do not sell it, we do not advertise and we do not measure your audience.
Who is responsible
The controller for your account data and for billing is Emmanuel Bekhor Architecte SRL, avenue Dolez 580, 1180 Brussels, Belgium, company number 0895.583.875, RPM Bruxelles, which publishes tabello.
For any question about your data, or to exercise your rights: contact@tabello.app.
A team’s content. What a team uploads to tabello (drawings, boards, annotations) belongs to it. It is the team, your practice for instance, that decides on this content: the team is its controller, and we act as its processor (Article 28 of the GDPR), solely to provide it with the service, under the data processing agreement included in our terms.
What we process, and why
| Data | Why | Legal basis |
|---|---|---|
| Your account: email address, name, author colour, password. We never keep the password itself, only an argon2id hash that cannot be reversed. | To identify you, sign you in, and sign what you draw. | Performance of the contract |
| Your session: a cookie that keeps you signed in. The server keeps only its hash. | To keep you signed in from one visit to the next. | Performance of the contract |
| Verification codes sent by email, kept only as a hash. | To verify your address and change your password. | Performance of the contract |
| Security counters: the number of attempts per email address and per IP address. These addresses are never kept in plain text, only as a hash. | To slow down intrusion attempts and the abusive sending of emails. | Legitimate interest (the security of the service) |
| Teams’ content: teams, members and roles, projects, boards, uploaded drawings and images, annotations. In addition, a summary of each board for the home page, and the date on which you viewed each board. | To provide the service: drawing together, finding your work, knowing what has changed since your last visit. | On the team’s behalf (as processor) |
| What is sent for AI rendering, only if your team has turned it on and only when you click “Generate”: what is connected to a Render, the AI rendering node (view, materials, atmosphere, mask, brief). Never the whole board, neighbouring drawings or comments. | To produce the requested image. | On the team’s behalf (as processor) |
| Invitations: the invited address, who invited it, and to which team. And the team’s log of who has joined. | To bring someone into a team, and to let its admins know who has joined. | Performance of the contract |
| Sign-in with Google or Microsoft, if you choose it: the identifier that service assigns you for tabello, your address and your name. | To sign you in without a password. | Performance of the contract |
| Payment: the subscribed team and the paying account. We never see your payment methods. | To link a subscription or a purchase to the right team. | Performance of the contract |
Where your data lives, and who processes it
- Cloudflare hosts the server, the database, the uploaded drawings and the real-time layer of the boards. The database, the drawings and the boards are stored under European jurisdiction and encrypted at rest. Traffic passes through Cloudflare’s network, always encrypted (HTTPS).
- Scaleway (France) sends tabello’s emails: verification codes, invitations. It receives the recipient’s address and the text of the message.
- Paddle (Paddle.com Market Ltd, United Kingdom) sells the subscriptions and packs, collects payments and issues invoices, VAT included. It is the seller, and as such is responsible for the data it asks you for in order to pay, under its own privacy policy. The United Kingdom benefits from an adequacy decision of the European Commission.
- An image generation provider, based in the United States, produces the images for AI rendering with the chosen model — Google’s Nano Banana, for example: only if your team has turned it on, and only what is connected to a Render. We use its paid plan, which does not train the models on these requests, and tabello asks it to keep nothing.
- Google and Microsoft, only if you choose to sign in through them. You identify yourself with them, under their own rules. tabello sends them nothing about you: it receives from them your identifier, your address and your name.
Transfers outside the European Union. Cloudflare is an American company, certified under the EU–US Data Privacy Framework (and its UK Extension), on which transfers to it rely. The image generation provider is based in the United States without being certified: transfers to it rely on the European Commission’s standard contractual clauses, provided for in its data processing agreement. The list of our processors by name, and a copy of these safeguards, are available on request at contact@tabello.app.
We neither sell nor rent your data, to anyone.
How long we keep it
| Your account | For as long as it exists. You can delete it at any time (see below): it is closed immediately, and erased 30 days later. |
| An account deletion link | One hour, and single use. |
| A session | 30 days after your last visit. |
| A verification code | 15 minutes. |
| A sign-in round trip through Google or Microsoft | 10 minutes. |
| Security counters | The length of their window, one hour at most, then erased the following night. |
| An invitation | Until it is accepted or withdrawn. It can no longer be accepted after 14 days. |
| The dates on which you viewed a board | For as long as you have access to the board. They are erased when you lose it. |
| A team’s content | For as long as the team keeps it. An item moved to the bin is permanently erased when the team empties its bin. |
| Emails sent | tabello keeps no copy of them. Scaleway keeps its sending logs for its own retention period. |
| Billing | With Paddle, for the period the law requires for invoices. |
Cookies and your browser’s storage
tabello uses no audience measurement or advertising cookies. It uses only what is strictly necessary for the service. That is why it does not ask for your consent.
tabello_session: keeps you signed in. It lasts 30 days after your last visit and cannot be accessed by the page’s scripts.tabello_externe: exists only during a sign-in through Google or Microsoft, for 10 minutes at most.- Your browser’s local storage keeps your display preferences and the team you last opened. It also keeps a working copy of the drawings, to display them faster. This data stays on your device. You can erase it from your browser’s settings.
The payment page loads Paddle’s form, which may set its own cookies under its own policy.
Your rights
Under the General Data Protection Regulation (GDPR) — and, if you live in the United Kingdom, the UK GDPR and the Data Protection Act 2018 — you can ask to access your data, to rectify it, to erase it, and to receive it in a machine-readable format. You can also object to processing or request its restriction. Write to us at contact@tabello.app: we reply within one month.
Deleting your account. You can do it yourself, at any time, from the application: “Delete my account”, under your name. To avoid any mistake, the deletion is confirmed twice. You first receive an email with a link, valid for one hour. This link opens a page that sets out what will be erased, and you confirm on that page.
- Your account is closed immediately: you can no longer sign in, and no one can see the teams of which you were the only member any more.
- Everything is permanently erased 30 days later. Until then, a mistake can be put right: write to us.
- Your address, your name, your sessions and your access rights are then erased. All that remains is a technical identifier, with no link to you.
- A team of which you were the only member is erased, together with its projects, boards and drawings.
- A team with other members carries on. If you were its only admin, another member becomes one. What you drew or wrote there remains the team’s, and your name may appear on it as the author of those annotations.
- A subscribed team of which you are the only member must first be cancelled, so that the subscription does not continue to be billed.
- The restore history of our database, kept by Cloudflare, may still contain a trace for 30 days at most. It then disappears on its own.
You may also lodge a complaint with the Belgian Data Protection Authority, rue de la Presse 35, 1000 Brussels (dataprotectionauthority.be), or, if you live in the United Kingdom, with the Information Commissioner’s Office (ico.org.uk).
Security
- Passwords are stored as argon2id hashes. Sessions and codes, as SHA-256 hashes.
- All traffic is encrypted (HTTPS). Uploaded drawings can only be read with an authorisation issued by the server, valid for a few minutes, to whoever has access to the board.
- Repeated sign-in attempts close the door for a while.
Changes
If this page changes on a point that concerns you, we will let you know before the change takes effect. The date at the top of the page is that of the version in force.