1. Introduction
Chartbuddy ("we," "us," or "our"), operated by Chartbuddy B.V., is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share information when you use the Chartbuddy Services ("the Services"). By using the Services, you agree to the collection and use of information in accordance with this policy. If you do not agree to this Privacy Policy, please do not use the Services.
Chartbuddy B.V. is the data controller for the personal data described in this policy.
1.1 The products this policy covers
Chartbuddy is charting software available in two products:
- Chartbuddy Hub: a desktop application for macOS and Windows. Charts are stored on your own device.
- Chartbuddy for Google Slides™: a Chrome extension that builds and edits charts inside Google Slides.
Additional products we make available later are covered by this Privacy Policy when we release them, unless we publish product-specific privacy terms. Chartbuddy Embed is distributed separately as an npm package under its own package license and is not covered by this Privacy Policy. Enterprise customers who execute a Master Subscription Agreement with Chartbuddy may be subject to additional data processing terms, including a Data Processing Addendum (DPA), as set out in that agreement. Any customer can request a DPA, whether or not they have such an agreement. See our Data Processing Addendum page.
2. Data Protection Officer
If you have any questions about this Privacy Policy or how we handle your personal data, you may contact our Data Protection Officer:
- Email: tim@chartbuddy.io
3. Information Collection
3.1. Types of data
Across the Services, we process the following types of data:
- Account information: Name, email address, and organization name for authentication, billing, and support.
- Authentication data: Credentials and tokens needed to sign you in and keep a session, including where you connect a Google account.
- Google integration data: Identifiers for the Google Slides presentations you select for use with Chartbuddy for Google Slides™.
- Organization branding and templates: House style settings and chart templates configured for your organization. These are stored on Chartbuddy servers. The templates feature is intended for clean, non-sensitive chart examples, not for confidential or personal data.
- Usage analytics: Anonymized or aggregated data on how you interact with the Services. This does not include chart content or spreadsheet data.
- Diagnostic data: Crash reports and technical telemetry from Chartbuddy Hub.
Chart configuration and spreadsheet data are processed on your own device. Source spreadsheet data and slide text are not sent to Chartbuddy's backend. Chart images may be transferred briefly as described in Section 3.2.
3.2. Data transfer
Chart image transmission depends on your storage configuration:
- Chartbuddy Managed Storage (Default): Rendered chart images are temporarily transferred to Chartbuddy's Google Cloud Storage (Europe-West4, Netherlands) for approximately two seconds to enable insertion into Google Slides via signed URLs. Images are deleted immediately after insertion, with a lifecycle rule as failsafe. Your source data, spreadsheet content, and slide text are not transmitted to our backend.
- Bring Your Own Google Cloud Storage: Chart images are transmitted directly from your browser to your Google Cloud Storage bucket. Chartbuddy does not receive or process these images.
Google Slides integration: The Chrome extension communicates directly with Google Slides APIs. Your presentation content flows between your browser and Google's infrastructure. Access is limited to the presentations you select.
3.3. Chartbuddy Hub
Charts you create in Hub stay on your own device. We do not receive or store their content. Hub contacts us for sign-in, plan checks, software updates, and crash or technical telemetry.
3.4. Chartbuddy for Google Slides™
Chart configuration and spreadsheet data are processed locally in your browser. Chart image transfer for insertion into Google Slides is described in Section 3.2.
3.5. Data storage
Our backend stores account and authentication metadata needed to run the Services, and organization branding settings and templates as described in Section 3.1. It does not store chart content or spreadsheet data from your day-to-day editing. We will not sell your personal data to third parties, nor share it with third parties for marketing purposes.
4. Lawful Basis for Processing Personal Data
We process your personal data based on the following lawful bases under the General Data Protection Regulation (GDPR):
- Performance of a Contract: Processing is necessary to provide the services you have requested.
- Legitimate Interests: Processing is necessary for our legitimate interests in improving and securing the Services, provided that these interests are not overridden by your rights. We rely on this basis for crash reports and technical telemetry from the desktop application.
- Consent: Where required, we will obtain your consent before processing your personal data.
5. How We Use Your Information
We use your information for the following purposes:
5.1. Authentication
- To verify your identity when accessing the Services, and to determine which plan applies to your account.
5.2. Customer Service
- To provide you with effective and efficient customer support.
5.3. Customization
- To tailor your experience based on your preferences and your organization's settings.
5.4. Security
- To protect your account and our services from unauthorized access and security threats.
5.5. Improvement
- To enhance features and performance based on anonymized usage data, crash reports, and technical telemetry.
5.6. Research
- To conduct analysis and produce reports regarding the use of our services, based on anonymized and aggregated data.
6. Information Sharing and Disclosure
We may share your information in the following circumstances:
6.1. Legal Requirements and Protection
- We may disclose your information if required by law or subpoena, or if we believe it is necessary to:
- (a) Comply with legal obligations or requests from law enforcement.
- (b) Enforce our Terms and Conditions.
- (c) Protect the rights, property, or personal safety of our company, our users, or others.
6.2. Business Transfers
- In cases where we buy, sell, divest, or transfer the company (including shares or any combination of our products, services, assets, or business segments), your data may be transferred as part of the assets. If this occurs, we will notify you promptly of the change.
6.3. Aggregate/Anonymized Information
- We may share aggregated or anonymized data about the use of our services for analytics or marketing purposes. This data does not identify individual users and is not restricted by this Privacy Policy.
6.4. Consent
- We may disclose your information to third parties when we have your explicit consent or a legal basis other than consent.
6.5. Subprocessors
- We use carefully selected subprocessors to help deliver our backend services. For a current list of our subprocessors, please see our Subprocessors page. That page also states which subprocessors apply to which product.
7. International Data Transfers
All personal data is processed and stored within the European Economic Area (EEA). We do not transfer your personal data outside the EEA. Should such a transfer become necessary, we will ensure appropriate safeguards are in place, such as standard contractual clauses, to protect your data.
Where your organization signs in with enterprise single sign-on (SAML or OIDC), authentication data is processed by our SSO provider outside the EEA. In that case we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework where the recipient is certified under it. See our Subprocessors page for the provider and location.
8. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy or as required by law. Retention periods are determined based on legal, contractual, and regulatory obligations.
9. Your Rights Under GDPR
Under the GDPR, you have the following rights regarding your personal data:
9.1. Right to Access
- You have the right to request access to the personal data we hold about you.
9.2. Right to Rectification
- You have the right to request correction of any inaccurate or incomplete personal data.
9.3. Right to Erasure
- You have the right to request deletion of your personal and user-generated data. For detailed instructions on how to delete your account and data, please see our Account and Data Removal Guide.
9.4. Right to Restrict Processing
- You have the right to request the restriction of processing your personal data under certain circumstances.
9.5. Right to Data Portability
- You have the right to receive your personal data in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller.
9.6. Right to Object
- You have the right to object to the processing of your personal data based on legitimate interests or for direct marketing purposes.
9.7. Right to Withdraw Consent
- If processing is based on your consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
To exercise any of these rights, please contact us at legal@chartbuddy.io. We will respond to your request within 30 days.
10. Artificial Intelligence and Automated Access
10.1. We do not train models on your data
We do not use your chart content, your data, or your personal data to train machine learning models, and we do not permit our providers to do so.
10.2. Connecting an AI assistant
You may opt to connect an AI assistant to Chartbuddy Hub through the Model Context Protocol (MCP). That connection runs as a local process on your own device. Chartbuddy operates no remote endpoint for it, and Hub opens no inbound network connection to support it.
10.3. Your AI provider, not ours
When you prompt an AI assistant to build a chart, your prompt and any data you give it are handled by that assistant's provider under your own agreement with them. Chartbuddy is not a party to that agreement and does not receive your prompt. If you need to know how that provider handles your data, consult their privacy notice.
10.4. Automated Decision-Making and Profiling
We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.
11. Data Security
11.1. Transmission Security
- All personal and sensitive user data transmitted between the Services and our servers are encrypted using HTTPS, ensuring secure data transfer.
11.2. Data at Rest
- Personal data stored on our servers is encrypted using strong encryption methods such as RSA or AES. Our servers are located in Amsterdam, the Netherlands, within the European Union.
12. Data Breach Notification
In the event of a data breach that poses a high risk to your rights and freedoms, we will notify you and the relevant supervisory authorities as required by GDPR.
13. Children's Privacy
The Services are not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you are under 16, please do not use the Services or provide any personal data to us.
14. Changes to This Privacy Policy
We may update our Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this Privacy Policy periodically.
15. Contact Information
If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:
- Email: legal@chartbuddy.io
16. Complaints
If you believe that our processing of your personal data infringes data protection laws, you have the right to lodge a complaint with a supervisory authority in the European Union, particularly in your country of residence or where the alleged infringement occurred.
17. Compliance with Chrome Web Store User Data Policy
This section applies to Chartbuddy for Google Slides™, which is distributed as a Chrome extension. Our use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
- Allowed Use: We only use your data to provide or improve the extension's features, in line with its purpose of helping you create charts.
- Allowed Transfer: We do not transfer your data to third parties except as necessary for the extension's functionality or as required by law.
- Prohibited Practices: We do not use your data for personalized advertising or allow unauthorized human reading of your data.
18. Information Control
18.1. Access and Update
- You can access and update your personal information by logging into your account.
18.2. Data Deletion
- You can delete your Chartbuddy account and all associated data directly from your profile settings. For step-by-step instructions, please see our Account and Data Removal Guide. If you need assistance with account deletion or have questions about data removal, please contact us at support@chartbuddy.io. In some instances, we may need to retain certain information even after a deletion request if required to fulfill legal obligations, regulatory standards, or to safeguard against fraud and abuse.
- Charts stored on your own device, or already placed in your presentations, are yours and are not affected by deleting your Chartbuddy account.
18.3. Managing Communications
- You can opt out of receiving promotional emails from us by clicking the "unsubscribe" link in those communications. To stop receiving essential service-related notifications (such as account verification, billing confirmations, feature updates, and security alerts), please contact us at legal@chartbuddy.io.
19. Cookies and Similar Technologies
We use cookies and similar technologies on our website to provide functionality, improve user experience, and analyze usage patterns. For detailed information about the cookies we use, how we use them, and how you can manage your preferences, please see our dedicated Cookie Policy.
20. Third-Party Services
The products you install do not themselves embed third-party services that collect personal or sensitive user data. However:
- When using Chartbuddy Managed Storage: Google Cloud Storage is used temporarily (approximately 2 seconds) to transfer chart images to Google Slides.
- Backend Services: Our web application uses the subprocessors listed on our Subprocessors page.
By using the Chartbuddy Services, you acknowledge that you have read and understood this Privacy Policy and agree to be bound by its terms.