Privacy Policy

01Introduction

ChartPad Ltd. (“ChartPad,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains what information we collect when you use our website, buy a license for our Power BI custom visuals (the “Visuals”), or contact us, how we use and share it, and the rights you have over it.

ChartPad Ltd. is the data controller for the processing described here, except where this policy says a partner acts as its own controller. It should be read together with our Terms of Service and Refund Policy.

02The Visuals collect nothing

The Visuals run entirely inside Microsoft Power BI. They create no accounts, set no cookies, run no analytics, send no telemetry, and never transmit your report data to ChartPad or anyone else. A direct license key is verified offline inside the Visual, with no network request. Each Visual also has its own privacy statement, linked from its page and its AppSource listing, confirming this for the Visual itself.

03Information We Collect

We collect information in the following situations, and only the information listed for each:

• When you contact us: Your name, email address, organisation, and whatever you write in the message, whether through the form on our website or by email.
• When you buy a direct license: Checkout is run by Paddle.com Market Ltd. (“Paddle”), our payment partner and merchant of record. Paddle collects your name, email address, business name, billing address, VAT or tax number where applicable, and payment details. Paddle passes us your name, email address, business name, country, the transaction reference, and what was bought. We never receive your card or bank details.
• When a license key is issued: The key carries the licensee name, which is the business name given at checkout or, failing that, the customer name or email address, together with the license scope and expiry date. The key is shown to you at checkout and emailed to the address given at checkout.
• When you buy through Microsoft AppSource:Microsoft handles the purchase and your payment. Microsoft may share your name, email address, organisation, and subscription details with us as the publisher of the Visual, under Microsoft's commercial marketplace terms.
• When you visit our website: Our web hosting provider receives the technical information any web request carries, such as your IP address, browser, and the pages you open, in its standard server logs. We run no analytics of our own and set no cookies of our own. Paddle's script loads on every page of the website, as described in sections 5 and 10.

04How We Use Your Information

We use the information we collect to:

• Issue, deliver, and reissue license keys, and confirm a license is valid when you ask us to.
• Answer your questions and provide support.
• Process refunds, handle disputes, and keep the transaction records that tax and accounting law require.
• Tell you about changes to a Visual or a license you hold, such as an upcoming renewal or a security update.
• Protect the Services against fraud and abuse.

Under UK and EU data protection law, our legal bases are: performance of a contract with you, for issuing licenses and providing support; our legitimate interests, for security, fraud prevention, and answering enquiries; and compliance with legal obligations, for keeping transaction records. We run no marketing lists and send no promotional email.

05Sharing Your Information

We do not sell your personal information. We share it only with the following, and only as far as needed:

• Paddle: Runs checkout, billing, invoicing, tax, and refunds for direct licenses. Paddle acts as an independent controller of the information it collects at checkout, under its own privacy policy. Paddle's script (Paddle.js) loads on every page of our website. On our licensing page it runs checkout and may use your IP address to work out your location and the tax that applies. On every page it also runs Paddle Retain, Paddle's payment-recovery service, which may set cookies and record how visitors and customers use the site so that Paddle can help recover failed subscription payments.
• Microsoft: Runs AppSource, and shares purchaser details with us as described above. Microsoft is an independent controller for AppSource purchases. Some visual pages also embed a sample report served by Microsoft's Power BI service (app.powerbi.com). When that embed loads, Microsoft receives your IP address and browser details and may set cookies, as an independent controller under its own privacy statement.
• Service providers: Companies that process information on our behalf and on our instructions: our web hosting provider; Cloudflare, which runs the service that issues and emails license keys; Web3Forms, which relays contact-form submissions to our mailbox; and our email provider.
• Legal requirements: Where required by law, a court order, or a valid request from a public authority, or to establish, exercise, or defend legal claims.
• Business transfers: If ChartPad is sold or merged, your information may transfer to the new owner under the same protections.

06How Long We Keep It

• Transaction and license records: For the life of the license and for six years after the last transaction, as UK tax and accounting law requires.
• Support and contact messages: For as long as needed to deal with the request, and for up to two years afterwards so that we can follow up on the same issue.
• Server logs: Kept by our hosting provider for its standard, short retention period.

07Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. Our website and the license service are served over HTTPS, payment details are handled only by Paddle, and the license service keeps no database of its own: it reads the transaction from Paddle when a key is requested and stores nothing afterwards.

08Your Data Protection Rights

Depending on your location, you may have the following rights:

• Access the personal data we hold about you.
• Request correction or deletion of your data.
• Object to or restrict certain processing of your data.
• Receive a copy of your data in a portable format.
• Withdraw consent where processing is based on consent.

To exercise these rights, contact us at hello@chartpad.io. We respond within one month. Please note that we must keep transaction records for the period set out above even if you ask us to delete other information, and that requests about information Paddle or Microsoft hold as controllers should go to them; we will point you to the right place if you are unsure.

If you are in the United Kingdom, you can complain to the Information Commissioner's Office at ico.org.uk. If you are in the European Union or the EEA, you can complain to the supervisory authority in your country. We would appreciate the chance to address your concern first.

09International Data Transfers

We are based in the United Kingdom. Our partners and service providers may process your information in other countries, including the United States. Where information leaves the United Kingdom or the EEA, we rely on adequacy decisions, standard contractual clauses, or the UK International Data Transfer Agreement, as appropriate.

10Cookies and Third-Party Links

Our website sets no cookies of its own and runs no analytics of its own. Paddle's script loads on every page and may set cookies: on our licensing page and in the checkout overlay, the cookies Paddle needs for checkout and fraud prevention; across the site, the cookies Paddle Retain uses to recognise returning visitors and customers for payment recovery. Paddle sets these as an independent controller under its own privacy policy, linked above. On visual pages that embed a sample Power BI report, Microsoft's Power BI service loads inside the page and may set its own cookies, under Microsoft's privacy statement, linked above. Links from our website to third-party sites, including Microsoft AppSource, Paddle, and our documentation host, are covered by those sites' own privacy practices, which we do not control.

11Children

Our Services are for businesses and professional users and are not directed at children under 16. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

12Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on our website and updating the date at the top. If a change materially affects how we use information we already hold about you, we will email you where we have an address.

13Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at: