Privacy policy
1. Who is responsible
The controller is the operator named in the imprint, based in Switzerland: Babala Özdemir, Unterer Rainweg 22, 4414 Füllinsdorf, Switzerland, hello@tabellab.com. We process personal data in line with the Swiss Federal Act on Data Protection (FADP) and, where it applies to users in the EU/EEA, the General Data Protection Regulation (GDPR).
2. The short version
- No tracking, no analytics, no advertising, no third-party scripts, no social-media pixels.
- We only use one cookie, the session cookie, which is needed to keep you signed in and to protect forms. No consent banner is needed because nothing else is set.
- We store what is needed to run your account: email, optional name, a hashed password, your lesson progress and your certificates.
- Payments are handled by Stripe. We never see or store your card details.
3. Data we process
Account
Email address, password (stored only as a one-way hash), optional name (printed on certificates), date of registration. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
Learning data
Which lessons you completed, which lab tasks you passed or failed (to unlock "Show solution"), exam results and certificates. When you use a lab, the contents of the sheet cells are sent to our server to be checked; they are not stored, only the result (passed / not passed) is recorded for signed-in users. For visitors who are not signed in, nothing is stored except a temporary session counter.
Certificates
A certificate shows your name, the course, the date, your score and a credential ID. Anyone who has the certificate link can view it — that is what makes it verifiable. Certificate pages are marked "noindex" so search engines do not list them.
Payments
Subscriptions are processed by Stripe Payments Europe Ltd. (Ireland) and Stripe, Inc. (USA). Stripe receives your email address and your payment details directly. We receive and store the Stripe customer and subscription IDs, the plan, status and renewal date. See stripe.com/privacy. Transfers to the USA are based on the Swiss-U.S. and EU-U.S. Data Privacy Framework and/or standard contractual clauses.
Server logs
Our web server logs IP address, date and time, requested page, browser identifier and status code to keep the service secure and to fix errors. Logs are deleted after 14 days. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). IP addresses are also used briefly for rate limiting (protection against password guessing).
We do not send newsletters.
4. Hosting
The website and database are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in [PLEASE CONFIRM: Germany / Finland].
5. How long we keep data
Account and learning data are kept as long as your account exists. When you delete your account (Account → Delete account), your account, progress and certificates are deleted immediately; certificate links stop working. Records we must keep for accounting (invoices at Stripe) are retained as required by law (in Switzerland generally 10 years).
6. Your rights
You can request access to, correction or deletion of your data, restriction of processing, data portability, and object to processing. You can delete your account yourself at any time. Contact: hello@tabellab.com. You may also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, to your local supervisory authority.
7. Security
All connections are encrypted (HTTPS). Passwords are hashed. Access to the server is restricted to the operator.
8. Changes
We will update this policy when the service changes. The date at the top shows the current version.