Last updated: 21 September 2026
Tablate is a bill-splitting app. This policy explains what personal data we collect, why, and what you can do about it.
Tablate is operated from the United Kingdom. For data protection law, the operator of Tablate is the "data controller". If you need our registered details — for a complaint, a data request, or anything else — write to us and we will provide them.
Contact: contact@tablate.com
We do not use advertising trackers, and we do not sell your data to anyone.
Data protection law asks us to say which legal basis each of those rests on:
| What for | Legal basis |
|---|---|
| Running the app — your trips, balances, keeping you signed in | Performing our contract with you |
| Reading a receipt when you ask us to | Performing our contract with you |
| Service emails, such as a password reset | Performing our contract with you |
| Keeping the service working, secure and free of abuse | Our legitimate interests |
| News about Tablate | Your consent |
Nothing in Tablate makes an automated decision about you. The receipt reader suggests line items; what to keep is always your choice.
If you use the optional "analyse and itemise" feature, the receipt photo is sent to Google Cloud Document AI to read the line items. Google processes it on our behalf as a data processor. This only happens when you switch that option on for a given receipt.
We also keep a copy of the receipt and of what the reader made of it, so we can keep improving how well Tablate reads receipts. Two things are kept, and they are kept for different lengths of time:
The text we keep is not linked to you. It is stored with no name, no email address, no account and no trip attached — it is the wording of a receipt and what it should have been read as, nothing more. It is also held separately from the live app.
One honest caveat: a receipt's own printed text can occasionally contain something personal, such as a loyalty-card number. We do not go looking for it and we never link it to you, but if you would rather we did not keep your receipts at all, email us and we will remove yours.
That copy is used for one purpose only: making receipt scanning better. We compare what the reader produced against what you corrected, so we can measure how accurate it is and improve it. We do not use it for advertising, for profiling you, or for building any other feature. We do not sell it or share it, and we do not use it to train anyone else's AI models. Only the people who work on the scanning feature ever look at it.
Tablate sets one cookie: the session cookie that keeps you signed in. It contains nothing but a random identifier, it is marked secure and HTTP-only so other sites and scripts cannot read it, and signing out clears it.
The app also keeps a small amount of data in your browser's own storage, on your device: an expense you have started but not yet saved. It never reaches our servers, we cannot see it, and clearing your browser data removes it.
We use no advertising cookies, no tracking pixels and no third-party analytics.
Service emails — a password reset you asked for, or something you need to know about your account. These are part of running the service.
News about Tablate — only if you have asked for it. There is a tick box when you sign up, off by default, and on the home page you can leave your address to be told when Pro goes on sale. Those are two separate permissions, and neither is implied by anything else: an address given so that you can join a trip is not permission to email you news.
You can withdraw either at any time, from your Account screen or by writing to us, and every such email carries an unsubscribe link. If you registered interest in Pro and nothing else, your address is used for that one email and is not kept for anything further.
Everything travels over an encrypted connection. Passwords are stored as a one-way hash, so nobody here can read yours. Receipt and trip photos are held outside the public web folder and are served only to people signed in to a trip that includes them. Access to the servers is limited to those who need it.
No service can honestly promise perfect security. If something does go wrong with your personal data and it is likely to affect you, we will tell you, and the Information Commissioner's Office where the law requires it.
Tablate is shared by design. Anyone in a trip with you can see the expenses, amounts, and your display name within that trip, and any payment name you chose to add. Only share trips with people you are happy to share that with.
Tablate never handles, holds or transfers money. When you tap a "Pay" button we simply open that provider's own page or app. Whatever happens after that is between you and them, under their terms and privacy policy.
On servers in the United Kingdom, provided by our hosting company. Receipt scanning is processed by Google in the European Union.
We keep this list as short as we can. Each one handles only what it needs to, and only on our instructions:
We do not sell your data, and we share it with nobody for advertising.
You can delete your account at any time from the Account screen in the app.
When you do, we remove your email address, display name, password and payment names. Expenses on trips you shared with other people are kept, because they are also those people's records and removing them would break their balances. You appear as "Deleted user" in those trips. Trips that only ever involved you are deleted entirely.
Backups are kept by our host for up to 30 days, so deleted data may sit in those backups for that period before being overwritten.
Under UK data protection law you can ask us to give you a copy of your data, correct it, delete it, or restrict how we use it. Email contact@tablate.com and we will respond within one month.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk.
Tablate is not intended for children under 13, and we do not knowingly collect their data.
If we change this policy we will update the date at the top. Significant changes will be announced in the app.