TABLERULING · PUBLIC CHALLENGE BETA

Privacy

Last updated: 7 September 2026

1. Controller

2. Privacy at a glance

TableRuling requires no account and uses no advertising, marketing cookies or cross-site user profiles. A question and its answer are processed to provide the requested ruling but are not stored in the TableRuling application database unless you separately choose to share that interaction for diagnosis after receiving the answer.

Please do not include names, contact details, confidential information or copied rulebook passages in a question.

3. Data and purposes

Rules questions and answers

We process the question, the selected language and the generated answer to provide the requested rules decision. The question is sent to the OpenAI API for semantic interpretation and answer wording. TableRuling uses API settings that do not create application state at OpenAI. OpenAI may retain API inputs and outputs in abuse-monitoring logs for up to 30 days and states that it does not use API data to train its models unless the customer explicitly opts in.

Legal basis: Article 6(1)(b) GDPR (providing the service requested by you).

Human verification, session and abuse prevention

Cloudflare Turnstile processes technical signals such as IP address, browser and device characteristics, user agent and the requesting website to distinguish humans from automated access. After successful verification, TableRuling sets a strictly necessary, signed session cookie. The associated server-side quota record uses a one-way hash of a random session identifier, not your name or account. These mechanisms protect the service, enforce question and cost limits and prevent abuse.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interests are secure, abuse-resistant and economically controllable operation of the free beta. Access to the service cannot be provided without these technically necessary mechanisms.

Language preference

If you switch the website language, your browser stores the value “en” or “de” locally so that your choice remains active. This preference is not transmitted as a user profile and can be removed through your browser settings.

Content-free operational metrics

We store daily aggregate counts for service status, response time, engine path, model calls, token use, estimated cost and feedback events. These aggregates contain no question, answer, IP address, user agent, session identifier or individual user profile. They are used to operate and evaluate the beta.

Where these operational records are personal data, the legal basis is Article 6(1)(f) GDPR (reliable and cost-controlled operation and improvement of the service).

Optional diagnostic sharing

After an answer, you may separately choose “Share for diagnosis”. Only then do we store that question, answer, your rating and selected technical diagnostics, including the selected rule capabilities, execution status, model usage and timing. The record is stored without an account or direct identifier, but free text may still contain personal data. Sharing is voluntary and declining has no effect on use of the service.

Legal basis: Article 6(1)(a) GDPR (your consent). You may withdraw consent at any time for the future. Email us the random diagnostic code shown after sharing to request immediate deletion. Withdrawal does not affect processing carried out before withdrawal.

4. Storage and retention

• Questions and answers: no persistent storage in the TableRuling application database by default; they are held only for the duration of the request and short-lived diagnostic handoff.
• Unshared diagnostic ticket: encrypted in your browser and expires after 30 minutes.
• Session cookie and pseudonymous quota record: expire after two hours; expired server records are removed by the recurring retention job.
• Consented diagnostic contribution: no more than 90 days, or earlier when deleted using the diagnostic code.
• Azure infrastructure logs: 30 days. The application does not intentionally write questions, answers, IP addresses or user agents to its logs.
• Content-free daily aggregates: retained for evaluation and operation of the beta because they are not linked to an interaction or person.

5. Service providers, recipients and international transfers

Microsoft Azure hosts the application and its protected operational storage in the West Europe region. Microsoft processes hosting, network and log data on our behalf under its data-protection terms.

Cloudflare provides Turnstile human verification. Cloudflare processes the technical signals required for bot detection and may act as a controller for certain signals used to improve Turnstile, as described in its Turnstile privacy information.

OpenAI provides the API models used to interpret the question and formulate the answer. For users in the EEA and Switzerland, OpenAI Ireland Limited acts as our processor under OpenAI’s Data Processing Addendum.

These providers may process data outside the European Economic Area. Depending on the destination and provider, transfers are protected by an adequacy decision, the EU Standard Contractual Clauses and/or other safeguards described in the provider terms.

Microsoft privacy statement · Cloudflare Turnstile privacy information · OpenAI privacy policy

6. Cookies and local storage

We use only the session cookie required for human verification, security and quotas, plus the language preference stored locally after you select a language. No advertising or marketing cookies are used. Access to or storage of this information is necessary to provide the requested service or remember your explicit language choice (section 25(2)(2) TDDDG).

7. Your rights

Subject to the legal requirements, you have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests. You may withdraw consent at any time. Because TableRuling has no accounts and intentionally keeps no direct user identifier, we may need your diagnostic code to locate a voluntarily shared contribution; we will not collect additional identity data solely to identify you.

You may also lodge a complaint with a data protection supervisory authority. The competent authority for the controller is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

Complaint information from LDI NRW

8. Required data and automated decisions

You are not legally required to provide personal data. A rules question and the technically necessary security data are required if you want to receive an answer. Diagnostic sharing is optional. TableRuling does not make decisions producing legal or similarly significant effects and does not perform user profiling.

9. Changes to this notice

We will update this notice when the service, providers or processing purposes change. The date at the top identifies the current version.

Provider information · Terms of use · Back to TableRuling