Privacy Policy
Last updated Sep 28, 2026.
This policy explains what Tablevault ("we", "us") collects when you use tablevault.co, why, where it is stored, how long it is kept, and what you can ask us to do with it. It is written to be read, not skimmed, because the whole point of the service is that you can trust it with your data.
What we collect and why
| Data | Why | Kept for |
|---|---|---|
| Your email address | To send the confirmation link, the download link, and failure notices, and to identify your account | Until you delete your account |
| Your Airtable personal access token | To read the base you asked us to export | Encrypted while the export runs; deleted when it finishes. Unconfirmed requests are deleted with their token when the confirmation link expires |
| The list of bases your token can see, and the schema of the base you chose | To let you pick a base and to make linked records reconstructable in the archive | With your account |
| The contents of the base you chose, including attachments | To produce the archive you requested | Free exports: 72 hours, then deleted. Paid plans, when available: for the retention period of the plan |
| Your IP address when you start an export | To limit abuse of the free tool | Deleted with the export request, within about a week |
| Which plan you clicked and any note you left | To decide what to build and to tell you when it is available | With your account |
| Anonymous page-view counts | To see which guides bring visitors to the tool. Cookie-free; no personal data is stored | Aggregated only |
| Technical error reports | To find and fix failures | 90 days |
We do not collect payment details. We do not use advertising or cross-site tracking. Visit counting is cookie-free, and the site sets only the cookies needed to keep you signed in and to protect forms.
Where it is processed
We use a small number of service providers, each for one job, and we share with each only what that job needs:
- A hosting provider runs the application and its database, which holds the account, connection, and export records described above.
- A cloud storage provider holds export archives, encrypted at rest, until they expire.
- An email delivery provider sends the confirmation, download, and failure emails, and processes your email address to do so.
- An error monitoring service receives technical reports when something fails. Reports may include your account id and the request that failed, and are configured not to include personal data by default.
- Airtable, which we read from using your token, under Airtable's own terms and privacy policy.
All providers are bound by contracts that limit them to processing data on our behalf. A current list of providers and the regions where data is stored is available on request at the address below. If you have a data residency requirement, ask before relying on the service.
What we never do
- Write to, change, or delete anything in your Airtable account.
- Read your base for any purpose other than producing the archive you asked for.
- Sell, rent, or share your data or your email address with anyone, other than the providers above as needed to run the service.
- Keep a token after a free export has finished.
Security
Tokens are encrypted at rest with a key held only by the application. Archives are stored in private buckets and served only through the application to the account that owns them. Sign-in links are signed and expire. Access to production systems is limited to the people operating the service.
No system is perfectly secure. If we discover a breach affecting your data we will tell you promptly, with what we know and what we are doing about it.
Your choices and rights
- Revoke your token at any time from Airtable's token page. Any running export will stop.
- Delete your account from the profile page. This deletes your connections, bases, export records, and plan interest immediately, and any archives at their next expiry.
- Ask us for a copy of the data we hold about you, or to correct or delete it, at the address below. We answer within 30 days.
If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your supervisory authority. Our legal basis for processing is the performance of the service you requested, and our legitimate interest in keeping it secure and improving it.
Children
The service is for businesses and is not directed at children under 16. We do not knowingly collect their data.
Changes
We may update this policy. The date at the top shows the current version, and material changes will be announced on the site or by email.
Contact
Privacy questions and requests: hello@tablevault.co.