Privacy policy
This page says what intabulo stores, why, for how long, and who else gets to see it. It describes the service as it actually works.
Controller
The controller under the GDPR is the operator named in the legal notice. Data protection questions go to admin@intabulo.eu.
What is stored
| Data | What for | Legal basis |
|---|---|---|
| Email address, username, password as an scrypt hash | Account, login, address verification | Art. 6(1)(b) GDPR (contract) |
| Language, default instrument, tuning and tablature style | Interface defaults | Art. 6(1)(b) GDPR |
| Two-factor secret, if enabled | Second factor at login | Art. 6(1)(b) GDPR |
| Sessions: a hash of the session token, timestamps, user agent | Staying logged in; the token itself is never stored | Art. 6(1)(b) GDPR |
| Uploaded PDFs and the PDFs made from them | The conversion itself and later downloads | Art. 6(1)(b) GDPR |
| Job data: name, comment, instrument, tuning, status, error text, duration, model used | Your job list, fault-finding, "try again" | Art. 6(1)(b) GDPR |
| Ledger: token counts and cost per attempt | Accounting and cost control | Art. 6(1)(b) and (c) GDPR |
| Salted hash of a guest's IP address | The daily cap for guests | Art. 6(1)(f) GDPR (abuse prevention) |
| Rate-limit counters | Protection against overload and abuse | Art. 6(1)(f) GDPR |
| Model requests: email address, model wanted, reason | Answering the request | Art. 6(1)(f) GDPR |
| Your own API keys, stored encrypted | Running conversions through your own provider | Art. 6(1)(b) GDPR |
Uploads are private
Nothing uploaded or generated is public. Files sit outside the web root under random names and are served only through an address that first checks who owns them. There is no directory listing, no guessable path and no CDN. The operator can reach the files as administrator; nobody else can.
robots.txt lets search engines see the landing page and the three legal pages, and nothing else.
How long files are kept
- Guest files are deleted after 24 hours.
- Registered users' files are deleted after 90 days.
- A nightly job does both, and also clears expired sessions and old rate-limit counters.
- Job data and ledger rows stay while the account exists and are deleted with it.
Guests' IP addresses
The daily cap needs to recognise a returning guest. For that the IP address is not stored: only a SHA-256 hash of it, salted with a secret value. The address itself appears neither in the database nor in any log of this service.
Who else receives data
- Anthropic. If the paid model (claude-opus-5) is chosen, each page of the uploaded PDF is sent as an image to Anthropic PBC in the United States and processed there. That model cannot work without it. If you would rather not, choose the local model.
- Local model. The free model runs on a machine the operator owns. No page image leaves that network.
- Your own API key. If you store a key of your own, the page images go to that provider, whose privacy terms then apply as well.
- Mail. Verification and notification mail goes through the operator's own mail server, not a sending service.
There are no analytics, no advertising networks, no external fonts and no embedded third-party content.
Cookies
Two cookies, both strictly necessary: one keeps you logged in
(HttpOnly, SameSite=Lax, Secure in
operation) and one remembers the language you picked. No tracking cookie, so
no consent banner.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection. A message to admin@intabulo.eu is enough. On request an account is deleted in full, together with its files, jobs and ledger rows.
Complaints can be made to the Austrian data protection authority (www.dsb.gv.at).
Changes
When the service changes, this page changes with it. The version in force is always the one shown here.