Last updated: 8 October 2026
This policy explains what personal data fopen GmbH processes when you use the Tabular IQ software, its online features and the tabulariq.com website, why, on which legal basis, who receives it, how long it is kept, and what rights you have under the General Data Protection Regulation (GDPR).
fopen GmbH
Gartenstr. 12
71155 Altdorf
Germany
Email: contact@fopen.com
fopen GmbH is registered with the commercial register of the Local Court of Stuttgart under HRB 789767. For any question about this policy or your data, write to contact@fopen.com.
Tabular IQ is a desktop application. Opening, analyzing, filtering, joining and reporting on your data happens on your computer, with the files and databases you choose. None of that data is sent to us, except as described in section 3.4 for the AI features. The software collects no telemetry and sends no crash reports.
To use Tabular IQ beyond the local trial you sign in with a Tabular IQ account.
Data: your email address and, if you set one, a password (stored as a salted hash); the one-time codes we email you to sign in; your name where you give it; the license and edition assigned to you; for each computer you sign in on, a random device identifier generated by the software, the computer’s name, its operating system and the version of Tabular IQ, with the times of registration and of the last license check; for business customers, the company name, contact person, phone number and postal address needed for the contract and the invoice; and a security log of actions on your account with the IP address they came from.
Purpose and legal basis: to provide the license you hold, to let you sign in on the number of computers it allows and to see and free those computers, to secure the account, and to invoice (Art. 6(1)(b) GDPR, performance of a contract; Art. 6(1)(c) for the retention of invoices; Art. 6(1)(f), our legitimate interest in preventing misuse of licenses and accounts).
Where: our licensing service runs at Amazon Web Services EMEA SARL in the Frankfurt region (eu-central-1), Germany. Sign-in codes and license emails are sent through Amazon Simple Email Service from the same region.
Retention: account and license data for as long as you hold a license or trial and until the statutory limitation periods for claims from the contract have expired; invoices and the data on them for the ten years German commercial and tax law requires; device registrations until you or we deactivate them and the license ends; one-time codes for minutes; the security log for as long as it is needed to secure the service and investigate incidents.
Offline licenses: a computer without internet access can be licensed with a file we issue for it. We then process the request code the software shows you, which contains part of the device identifier, in the same way as a registration.
When the software checks for updates it requests a small file from www.tabulariq.com. Our website host records the request in its server log with your IP address, the time and the software’s version string (section 4.1). The software offers an available update; it is installed only when you confirm. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in keeping installations current and secure.
The AI features answer questions about your data, propose analyses and prepare actions in the software. They are available only where your license includes them, the organization that holds your license has not turned them off for its users, and you have not turned them off in the software (the AI page of the Options window, or the AI switch in the console; they are on when the software is installed); nothing is sent until you use them.
What is sent: your request, the conversation so far, and a description of the project it concerns: the names of its tables, folders and connections, the columns of the active table with their types, row counts, indexes, and the current filter and sort. That description is sent whatever the setting below.
Values from your tables are sent only when the model asks for a few sample rows (at most 20 at a time), or for the lowest and highest value of a column, to answer your request, and only as far as the Sample Data setting on the AI page allows. None sends no value. Anonymized, the setting when the software is installed, replaces every letter of a text value with a random letter and every digit in it with a random digit: the length is kept and equal values stay equal within one request, while numbers and dates are sent as they are. Full sends the values as they are. The organization that holds your license can limit the setting for its users to Anonymized or None; you can always choose a stricter setting, never a looser one. Anonymized values can still identify a person, for example through the numbers and dates among them or the length and form of a value; they are not anonymous data in the GDPR’s sense, so the paragraph on your data in your tables below applies to them too.
Actions the model proposes, such as filtering, grouping, creating or deleting data, run only after you confirm them in the software.
Where it goes: the request goes to our AI service at api.tabulariq.com, hosted at Amazon Web Services in Frankfurt, which passes it to OpenAI to generate the response. Our service keeps no copy of the conversation. It records, for metering, which license made the request, the request and conversation identifiers, and the credits charged.
The AI provider: OpenAI, L.L.C., San Francisco, USA, and its affiliates, process the request on their servers in the United States as our processor under OpenAI’s data processing addendum, which includes the European Commission’s standard contractual clauses. Under OpenAI’s published policies for its API, data submitted through the API is not used to train OpenAI’s models and may be retained for a limited period to monitor for abuse. OpenAI’s privacy policy is at openai.com/policies.
Your data in your tables: if the tables you analyze contain personal data of other people (customers, vendors, employees), you are the controller of that data, and the parts sent through the AI features are processed by us and by OpenAI on your behalf. Business customers who use the AI features on such data must have a data processing agreement under Art. 28 GDPR with us; ask contact@fopen.com. Do not send data you are not permitted to disclose.
Legal basis: Art. 6(1)(b) GDPR, performance of the contract with you. For the personal data of other people contained in your data, you decide on the legal basis as the controller.
Credits: the AI features consume credits that belong to your license. The balance and the metering records are kept in our licensing service (section 3.2) for the term of the license and the retention period for invoices.
When you write to support@tabulariq.com or contact@fopen.com we process your email address, the content of your message and what you send with it, to answer you (Art. 6(1)(b) and (f) GDPR). Support correspondence is kept for as long as the matter is open and then as business correspondence for the statutory retention period.
The website is hosted by Vercel Inc., San Francisco, USA, which serves it from a global network. Each request is recorded in a server log with the IP address, the time, the page requested, the referring page and the browser’s identification string, for operating and securing the site (Art. 6(1)(f) GDPR). Vercel is certified under the EU-U.S. Data Privacy Framework. The same applies to the pages the software opens in its embedded browser (the welcome, check-in and trial pages), which are ordinary pages of this site.
Vercel Web Analytics gives us aggregated page-view statistics. It sets no cookies and uses no identifier that follows you across sites.
The site works without cookies. Analytics cookies are set only if you allow them in the cookie notice:
_ga, _gid and _gat and reports which pages are visited, from where and on what device, with IP addresses shortened before storage. Legal basis: your consent (Art. 6(1)(a) GDPR and Sec. 25(1) TDDDG). Without consent, Google’s scripts are not loaded.klaro so you are not asked again. You can change your choice at any time through the “Cookie settings” link in the footer.Fonts are served from our own site; no font provider receives your requests.
The contact form and the feedback form ask for your name, email address, an optional phone number and your message. The site sends them to us as an email through Mailgun (Sinch Mailgun, EU region, with servers in the European Union); nothing is stored on the website itself. We use the data to answer you (Art. 6(1)(b) and (f) GDPR) and keep the correspondence for as long as the matter is open and then for the statutory retention period for business correspondence.
Emails about your account and license (sign-in codes, trial and license notices, invoices) are part of the service. Marketing emails are sent only if you have asked for them, and every one carries an unsubscribe link. We keep a list of addresses that bounced or reported our mail as unwanted so that we do not write to them again (Art. 6(1)(f) GDPR).
We share personal data only with the processors named in this policy, each bound by a data processing agreement: Amazon Web Services EMEA SARL (hosting, email), Vercel Inc. (website), OpenAI, L.L.C. (AI responses), Google (analytics, with consent), KIProtect GmbH (consent manager), Ahrefs Pte. Ltd. (analytics), Sinch Mailgun (contact form email). Beyond that, data is disclosed only where the law requires it, for example to tax authorities or on a court order, and to our tax and legal advisers under professional secrecy.
Account, licensing and AI metering data stays in the European Union. Data leaves it in three cases: website requests served and logged by Vercel and analyzed by Google (United States; both certified under the EU-U.S. Data Privacy Framework), AI requests answered by OpenAI (United States; standard contractual clauses), and page-view counts by Ahrefs (Singapore; standard contractual clauses).
You have the right to obtain access to your personal data (Art. 15 GDPR), to have it rectified (Art. 16) or erased (Art. 17), to have its processing restricted (Art. 18), to receive the data you gave us in a portable format (Art. 20), and to object to processing based on our legitimate interests (Art. 21). Where processing is based on your consent, you may withdraw it at any time with effect for the future. To exercise a right, write to contact@fopen.com; we answer within one month.
You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.
To hold a Tabular IQ account you must give us an email address; without it we cannot issue a license or sign you in. Everything else, including the use of the AI features, is optional.
We make no decisions based solely on automated processing and we do not profile you.
Tabular IQ accounts are for people aged 16 and over. We do not knowingly collect data from children under 16.
Connections to our services and to the website use TLS. Passwords are stored only as salted hashes, one-time codes expire after minutes, and access to our servers is limited to the people who operate them.
We update this policy when the software or our services change. The date at the top says when it was last changed, and the version in force is always the one published here.