Privacy Policy

Last updated: October 14, 2026

Teable AI, Inc. ("Teable," "we," "us") provides an AI spreadsheet for business. This policy explains how we handle information across our websites, applications, and related services (the "Service").

1. Information we collect

Account and contact information. We collect information you provide when you register, manage your profile, contact us, or purchase a subscription. This may include your name, email address, profile picture, password, organization, job title, phone number, country or region, billing details, and support messages. If you use a sign-in provider, we receive the account information it shares with your permission. For example, Apple may provide a relay email address instead of your personal address.

Content you provide. We process the records, files, images, messages, and other content you add to your spaces and projects, including content submitted to AI features or connected integrations. Features such as photo uploads or voice input may request camera, photo library, or microphone access when needed. You can manage these permissions in your device settings; declining access limits the features that need it.

Usage and technical information. We collect information such as IP addresses, browser and device details, operating system and app versions, referring pages, screens viewed, actions taken, and error, crash, and performance reports. Cookies and similar technologies may assign browser or device identifiers. Usage and diagnostic information may be associated with your account ID; it is not necessarily anonymous.

2. How we use and share information

We use information to provide and maintain the Service, authenticate users, enable collaboration and AI features, process payments, respond to support requests, improve performance and usability, protect against abuse, and meet legal obligations. We also send service notices and marketing communications, which you can unsubscribe from.

Service providers. We share information with providers that help us operate the Service, including hosting, payment, email, analytics, and diagnostic services. They process information to perform their services for us, subject to applicable agreements. Section 4 explains where to find the current list. Content is also shared with collaborators and integrations according to the permissions and workflows you configure.

AI features. Teable's AI features run on OpenAI. When an AI feature runs, such as when the AI answers in a chat, fills in an AI field, transcribes voice input, or suggests next steps, the information it needs is sent to OpenAI, directly or through Vercel's AI Gateway. This includes your messages and requests, files and images you attach, your voice when you use voice input, and the project content, such as tables, records, and files, that the AI reads to complete the request. OpenAI and Vercel act as our processors and are contractually barred from training models on your content. They may retain content briefly for abuse monitoring under their policies. Our mobile apps ask for your agreement to this before you sign in. On a self-hosted deployment, AI features use the providers its administrator configures.

Legal and business purposes. We may disclose information when reasonably necessary to comply with law, enforce our terms, investigate fraud or security issues, or protect users and others. Information may also be transferred as part of a merger, acquisition, or sale of assets, subject to this policy.

We may use aggregated or de-identified information to understand usage trends and improve the Service. Information linked to an account, browser, or device is not treated as anonymous merely because it does not include a name.

3. Legal bases for processing

If you are in the European Economic Area (EEA), the United Kingdom, or Switzerland, data protection law requires a legal basis for each way we use your personal information. We rely on the following:

• Performance of a contract. To provide the Service you sign up for: creating and securing your account, storing and processing the content you add, running the AI features and integrations you use, processing payments and billing, sending service and security notices, and responding to support requests. This covers your account and contact information, the content you provide, and the usage and technical information needed to deliver the Service.
• Legitimate interests. To keep the Service and its users secure, prevent fraud and abuse, verify licenses for self-hosted deployments, understand and improve the Service with privacy-friendly analytics, such as cookieless visit counts and error and crash reports, and send business-to-business communications, such as product updates to business contacts. This covers usage and technical information, account and contact information, and license compliance attestations. We weigh these interests against your rights, and you can object at any time, including by unsubscribing from marketing emails.
• Consent. Where the law requires it, such as in the EEA, the United Kingdom, and Switzerland, we ask before we use analytics and advertising cookies and similar technologies on your device. This includes PostHog and Google Analytics cookies, the Google and Meta advertising tags that measure ad visits and conversions, and session replay. This covers browser and device identifiers, ad click IDs, pages viewed, and recorded page interactions. You can withdraw consent at any time with the Cookie settings link at the bottom of every page of teable.ai; withdrawing does not affect processing that took place before.
• Legal obligation. To keep tax and accounting records, such as invoices and payment records, to respond to lawful requests from public authorities, and to handle requests to exercise your privacy rights. This covers billing details and the account information connected to them.

4. Service providers (subprocessors)

We use service providers, also called subprocessors, to help us operate the Service, including hosting, payment, email, AI, analytics, and diagnostic services. They may process personal information only to provide their services to us, under written agreements that require them to protect it. The current list of our subprocessors, with what each one does, is published in our Trust Center at trust.teable.ai.

5. International data transfers

Teable AI, Inc. is based in the United States, and the Service is primarily hosted in the United States. Some of our service providers process information in other countries. As a result, your information may be processed outside the country where you live.

When we transfer personal information from the EEA, the United Kingdom, or Switzerland to a country that does not have an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum and the amendments required for Swiss data, in our agreements with our service providers. Where a provider is certified under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, transfers to that provider may also rely on its certification. We add supplementary measures, such as encryption in transit and at rest and access controls. Contact us to learn more about these safeguards.

6. Cookies, analytics, and advertising

We use cookies and similar technologies to keep you signed in, remember preferences, understand usage, and measure advertising effectiveness. Blocking necessary cookies may prevent parts of the Service from working. You can manage cookies through your browser and use the consent controls shown on our websites, including the Cookie settings link at the bottom of every page of teable.ai. Our Cookie Policy lists the cookies and similar technologies used on teable.ai, what they do, and how long they last.

Analytics and diagnostics. We use PostHog and Google Analytics to understand usage, and Sentry for error and crash reports. PostHog session replay records page interactions for some visits to our marketing website, such as visits from our advertising campaigns, and for some sessions in our web application, to help us understand how they are used and fix problems. Page text and form inputs are masked, and images and videos are blocked, before recordings leave your browser. Session replay runs only when analytics cookies are allowed; in the EEA, the United Kingdom, and Switzerland, only after you accept them. Native application screens are not session-recorded.

Website advertising. We use tools from Google, Meta, and OpenAI (ChatGPT Ads) to measure website visits and advertising conversions. These tools may receive browser or device identifiers, referring information, and events such as page views, sign-ups, or purchases. Advertising partners may associate this information with information they hold to measure campaigns or personalize advertising, subject to your choices and their policies. You can also manage advertising preferences with those providers.

We do not sell personal information for money. Website advertising disclosures may qualify as "sharing" or a "sale" under some privacy laws. You may contact us to exercise applicable opt-out rights. Product analytics and crash reporting are used to operate and improve the Service; they are distinct from the website advertising activities described above.

7. Self-hosted deployments

For self-hosted deployments, your administrator controls the server and its content retention settings. Internet-connected deployments may send a limited license compliance attestation to Teable to validate licenses, detect copying or overuse, and verify authorized software distributions. This is separate from optional product analytics.

Attestations may include instance and license identifiers; license plan, seat limit, and expiration dates; edition, application and build versions, image digest, and build channel; aggregated user, project, and space counts or count buckets; last activity time; operating platform, CPU architecture, and Node.js version; hashed machine and public origin hostnames, public origin top-level domain, and compliance risk signals.

Attestations do not include workspace content, table records, schema names, field values, SQL queries, secrets, credentials, authentication tokens, license keys, user email lists, user names, or full public origin URLs. Payloads are encrypted in transit, and hostnames are hashed before transmission. Instance and license identifiers may be sent in their original form for validation.

We retain raw attestation events only as reasonably necessary for compliance, security, fraud prevention, disputes, and audits. Aggregated or derived compliance status may be retained for the customer relationship and any legally required period. Administrators can disable reporting, including attestation, with TELEMETRY_REPORT_DISABLED=true. This does not itself prevent offline license activation, but may limit compliance verification and investigation.

8. Security and retention

We use technical and organizational safeguards, including encryption and access controls, to protect information. No system is completely secure. Keep your account credentials private and contact us if you suspect unauthorized access.

You can permanently delete your account from Account in your settings. We immediately delete or anonymize the personal information attached to it, including your name, email address, and profile picture, and remove access tokens, connected sign-in providers, collaborator memberships, invitations, and notifications.

Spaces, projects, tables, and records are deleted separately, before or during account deletion. On our hosted service, we keep information for the following periods:

AI providers may briefly retain content as described in section 2. Retention for self-hosted deployments and license attestations is described in section 7.

9. Your choices and rights

You can update your profile and delete your account in settings. You may also request access to, correction of, or deletion of your personal information by emailing support@teable.ai. Depending on your location, you may also have rights to data portability, to object to or restrict processing, to withdraw consent at any time, and to opt out of certain advertising disclosures. We may need to verify your identity before acting on a request.

We respond within one month of receiving your request. If a request is complex or we receive many requests, we may extend this by up to two further months, and we will tell you within the first month. We do not discriminate against you for exercising your rights.

If you are in the EEA, the United Kingdom, or Switzerland, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live, work, or where you believe an infringement took place.

Use the unsubscribe link in promotional emails to stop receiving marketing messages. We may still send essential account, security, and service notices.

10. Google API services user data

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect a Google account, we access only the data authorized by the scopes you grant:

• Gmail read-only access (gmail.readonly): lists labels and retrieves messages and attachments for the Email Received automation trigger.
• Gmail send access (gmail.send): sends emails through workflows you configure.
• Profile information (userinfo.email, userinfo.profile): displays the connected account in integration settings.

Google user data is used only to provide and improve the user-facing features you configure, not for advertising, marketing, or unrelated purposes. OAuth tokens and associated metadata are encrypted, and tokens are retained only while the integration is active. Email content is processed to run your workflows and is not permanently stored beyond what execution requires.

We do not sell or transfer Google user data except as needed to provide the Service, protect security, or comply with law. Human access requires your affirmative consent, a security need, or a legal requirement. You can revoke access in Teable's integration settings or on your Google Account permissions page.

11. Children and third-party services

The Service is not directed to children under 13, and we do not knowingly collect their personal information or allow them to register. If you believe a child has provided personal information, contact us so we can delete it.

Third-party websites and services you choose to visit or connect have their own privacy policies. Review those policies to understand how they handle your information.

12. Changes and contact

We will notify you of significant changes by email or a prominent website notice at least thirty days before they take effect. Minor changes and clarifications take effect when posted.

For questions about this policy or your information, contact Teable AI, Inc. at support@teable.ai.