Privacy policy
Last updated: 26 July 2026 · Kadiaak OÜ · GDPR
1. Data controller
The data controller is Kadiaak OÜ, Sepapaja tn 6, 15551 Tallinn, Harju Maakond, Estonia (registration 16357744, VAT EE102437021), which publishes and operates the Rowbase service.
2. Data we process
For account holders, we process:
- Account data — email address, name, hashed password, account name, plan and billing status. Payments are handled by our provider; we store no card numbers.
- Your table content — the fields, rows and values you enter or import. This data is yours; we process it as a processor, in order to provide the service.
- Usage metadata — per-row edit history, sync log, invited members and assigned roles.
- Google tokens — when you connect a Google account, we keep an encrypted access token and the identifier of the destination file. Nothing else in your Drive is read.
- Technical logs — IP address, browser and usage events, kept for security and debugging.
3. Google Sheets syncing
Syncing is triggered by you and runs in one direction only: from Rowbase to your sheet.
- Minimal scope — we ask for permission to write to the file you designate, not for general access to your Drive.
- Leaving for Google — as soon as a row is written to your Sheet, it is hosted by Google under the terms of your Google Workspace account, outside our control.
- Revocable at any time — turning the automation off deletes the token; the sheet already filled in stays with you.
4. Purposes and legal bases
We process your data to perform the contract between us (providing the service, billing), on the basis of our legitimate interest (security, abuse prevention, improving the product from aggregated statistics) and to meet our legal obligations (accounting). We never use the content of your tables for advertising, nor to train machine learning models.
5. Retention periods
The content of your tables is kept for as long as your account is active. Edit history is kept for 90 days (up to 365 days on the Custom plan). A deleted table remains restorable for 30 days. When an account is closed, everything is deleted within 30 days, except accounting records the law requires us to keep. Technical logs are kept for 12 months.
6. Hosting and processors
Your data is hosted in the European Union (Frankfurt, Germany) with a European host. We rely on a small number of processors to host the service, send transactional emails and collect payments. They act on our behalf, under data processing agreements; the current list is available on request. The transfer to Google Sheets is the only outbound flow, and it only happens on your explicit instruction.
7. Your rights
Under the GDPR, you may access your personal data, correct it, export it, have it deleted, object to processing or ask for it to be restricted, and lodge a complaint with a supervisory authority — in Estonia, the Andmekaitse Inspektsioon; in France, the CNIL. Most of this is self-service from your settings: CSV export of all your tables and account deletion. For anything else, write to us.
8. Contact
Privacy questions and requests: through the contact form on this site, or by post to Kadiaak OÜ, Sepapaja tn 6, 15551 Tallinn, Harju Maakond, Estonia.