Totsum Data Explorer — Privacy Policy

Policy revision 2026-09-10 — Effective date: 10 September 2026

The revision above identifies this text; the application has its own version number, shown in its About dialog, and the two change independently. Where this policy describes what the application does, it describes the release it ships with.

1. Who we are (data controller)

Totsum SRL, a société à responsabilité limitée incorporated in Belgium, registered office Avenue Kersbeek 308, 1180 Uccle, Belgium, enterprise number 1041.093.971 (RPM Bruxelles, Tribunal de l’entreprise francophone de Bruxelles) (“Totsum”, “we”, “us”), is the controller of the personal data described here, in connection with the Totsum Data Explorer desktop application (the “Application”), its installer, our website and the sale of licences.

For any privacy question or to exercise your rights (Section 9): privacy@totsum.app.

2. The short version

The whole policy in one screen; each line names the section that carries the detail.

3. How the Application handles your data (on your device)

3.1 Local processing. The data you import, the questions you ask, the results produced and the workspaces you save are processed and stored on your device. The Application has no feature that transmits any of them to Totsum or to a third party: no account, no synchronisation, no telemetry, and no update check.

3.2 What that is worth. That is what we build and test for; it is our effort, not a guarantee, and a defect in the Application, the operating system or a third-party component could still cause network activity we did not build. If your work requires that nothing can leave the machine, run the Application on a computer with no network connection; the documentation explains how to provision the model files by hand.

3.3 Local AI models. Inference runs on your device, with a model provisioned separately (Section 4.1). The Application sends no prompt, data or output to any model provider — it has no such feature.

3.4 Local settings, caches and logs. The Application stores on your device your preferences and facts about your hardware; the report branding you enter (logo, organisation, the names you type as prepared for and prepared by); the record of the licence-agreement revision you confirmed at first launch (the installer shows the agreement and records no acceptance); a cache that speeds up the AI model and may contain fragments of your questions, your column names and your data values; crash-recovery snapshots of the tables you loaded, removed on a normal exit; and diagnostic logs. In ordinary builds, error records are stripped of the error message and the source line, either of which could quote your data; debug builds, which we provide only for support, do record questions, prompts, generated SQL and sampled data. None of this is sent to us; if you send us a diagnostic file (Section 4.3), we receive whatever it contains. The documentation lists where each of these lives.

3.5 Files you save. Workspace files (.totsum) and any exports are saved where you choose. You are responsible for those files and any personal data they contain.

3.6 Protection and deletion of local data. The Application does not itself encrypt anything it writes; assume everything described in this Section is stored unencrypted, protected only by your operating-system account, disk encryption and other device safeguards. You control how long it is kept, and the documentation lists the folders the Application uses so that you can delete what you no longer want. The licence key file carries the email address it was issued to (licence agreement §5). Uninstalling may leave models, caches, preferences and your own files in place; the uninstaller we provide removes the trial usage record and the report branding.

3.7 Licence enforcement on your device. Two features enforce the terms of your licence tier; both operate on your device and neither reports anything to us.

Trial usage record. During the free trial, the Application counts the questions asked since installation to apply the trial’s cap. The record holds that number and a value used to detect editing — no questions, no data, no identifier relating to you. The uninstaller we provide removes it, and the documentation says where it is. Reinstalling in order to begin a further trial once yours is used up is a breach of the licence agreement (its Section 4).

Watermark. Charts and Query Flow diagrams produced under a Trial or Personal licence carry a watermark. Under a Personal licence it includes an opaque licence identifier, shown on screen and embedded in the files you export. The identifier is not your name, email address or licence key, but we can link it to the corresponding licence record (Section 4.4), so it remains personal data in our hands; a recipient ordinarily cannot identify you from it alone. Commercial licences carry no licence watermark.

Purpose: to enforce the trial’s cap and the non-commercial terms of a Personal licence, and to deter sharing of keys and of output produced under a licence that does not permit commercial use. Legal basis: our legitimate interest in protecting the Application against unlicensed use (Art. 6(1)(f)).

4. Personal data we process (and why)

We act as a data controller for the processing below. We do not ordinarily receive the content you explore unless you deliberately include it in a support request.

Whether you are obliged to provide anything. No law obliges you to give us personal data. Some of it is a contractual requirement, and the only consequence of not providing it is that we cannot provide the thing it is needed for: without an email address we cannot deliver a licence key, run the waiting list or include you in the beta; without the details of a problem we cannot answer a support request. The billing details the checkout asks for are Paddle’s requirement as the seller (Section 4.2). Everything beyond that is voluntary.

4.1 Installation and AI Model download

During installation, a separate networked setup helper downloads and verifies the AI Model from our own download server, hosted by OVHcloud in France (Section 5), the only host the helper contacts. On a machine without internet access you can copy the model files by hand instead, and the helper downloads nothing. The server necessarily receives ordinary connection data: your IP address, the date and time, browser or device information, and the file requested. The helper uploads none of your content.

Purpose: to supply and verify the AI Model required to use the Application. Legal basis: taking steps at your request and performing the contract (Art. 6(1)(b)). OVHcloud hosts the server as our processor (Section 5); we keep no log of who downloads the model.

4.2 Purchases — handled by our reseller / merchant of record

Licences are sold through Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom (the “Reseller” or “Paddle”), and are offered in the European Union only. Paddle is the seller of record: it collects and processes your payment and billing data under its own privacy policy (https://www.paddle.com/legal/privacy). From Paddle we receive your name and address, your email address, your purchasing history and the transactional analytics of its dashboard; we do not receive your card number or other payment credentials, and we generate the licence key ourselves. Paddle and Totsum are each an independent controller of the data they hold; Paddle is in the United Kingdom (Section 6).

Purposes and legal bases: delivering and administering the licence you bought — the key and its record, transfers, and the support included in it — and telling you about security and conformity updates for the version you licensed, a notice the licence agreement promises (its Section 9.3): performance of a contract (Art. 6(1)(b)); asking for your feedback on the Application (Section 4.9), preventing purchase or licensing fraud and handling contractual claims: our legitimate interests in improving the Application, protecting the licensing system and establishing or defending claims (Art. 6(1)(f)); the accounting and tax records of the sale: our legal obligations under Belgian accounting and VAT law (Art. 6(1)(c)).

Limits we are bound by. Paddle’s terms permit us to use the data only to supply the product, complete the sale and meet our obligations to Paddle; in particular we may not use data received from Paddle for direct marketing without your explicit consent.

4.3 Support and correspondence

If you contact us, we process your contact details, your message and the related correspondence, including the contents of anything you attach. Please send only what is necessary. Do not send us special categories of data (Art. 9 and 10 GDPR): we never need them to answer a support request and have no basis to process them; if an attachment contains such data, we delete it and ask you for an extract without it.

Purpose: to respond to and manage your enquiry, provide any support included in your contract, and establish or defend legal claims. Legal basis: performance of a contract where applicable (Art. 6(1)(b)) and our legitimate interests in assisting users, improving the documentation and handling claims (Art. 6(1)(f)).

4.4 Licence keys

Your licence key is validated on your device and is not sent to us; there is no activation server. We generate it when Paddle confirms your order, when we issue a licence at no charge (a beta licence, Section 4.7) or when we issue a free trial key (Section 4.8), and we keep a licence record — the key or an identifier for it, with the email address it was issued to — for delivery, administration, fraud prevention and support.

When you buy, you accept the licence agreement on our pricing page before the checkout opens, and we record that acceptance first: the revision and a one-way hash of its exact text, the date and time, a salted one-way hash of the connection’s IP address with the browser identification string, and the edition chosen, linked to your order. When Paddle confirms the order, we add the email address Paddle holds for you and the edition paid for, and issue the key. An acceptance not followed by an order within 30 days is deleted; an order that reaches us without a prior acceptance is refunded in full through Paddle, and its record deleted after 30 days.

When a licence is transferred or reassigned as the licence agreement allows (its Section 2), we process the request, its date and the email address of the new holder, to issue a replacement key carrying the same licence identifier; the previous holder’s record is kept for the periods in Section 7, so that use made under the licence can still be attributed to the right person.

Where you act for an organisation that is the licensee, the basis for your own details, as its representative, is our legitimate interest in performing and proving the agreement with that organisation (Art. 6(1)(f)); this applies to every kind of licence. Otherwise: performance of the agreement (Art. 6(1)(b)), and our legitimate interests in administering licences and establishing or defending claims (Art. 6(1)(f)).

4.5 Website and cookies

Our website totsum.app is a set of static pages hosted by Scaleway in Paris. To deliver each page Scaleway, as our processor, necessarily handles connection and security data — IP address, date and time, page requested, referring page, browser and operating-system information, and error or abuse events — and keeps a request log for seven days, which we open only to troubleshoot the site or investigate abuse.

Cookies and measurement. As at the revision date, our own pages set no cookies and embed no third-party content that could set one; Paddle’s checkout is loaded only when you click Buy on the pricing page, after you have accepted the licence agreement there, and then uses the cookies its checkout needs under Paddle’s privacy policy. Our pages load no analytics script into your browser. What we count comes from the aggregate statistics Scaleway derives from the seven-day log, and from one line our own service writes, kept seven days, when you download an installer, run the hardware check or complete an order — the platform, the check’s result, the campaign tag of the link you arrived by and, for an order, the order and licence identifiers; no IP address, no name. Should we ever add storage on your device that is not strictly necessary to provide what you asked for, we will describe it here and ask your prior consent first.

Abuse protection on forms. Our service rate-limits submissions with a salted one-way hash of the connection’s IP address, kept for one hour — the raw address is not stored — and, on the trial-key form, an anti-robot check we serve ourselves, with no third party and no cookie, which we treat as strictly necessary to provide the key you asked for.

Purpose: to deliver, operate, troubleshoot and secure the website. Legal basis: our legitimate interests in operating a reliable and secure website (Art. 6(1)(f)) and, where a service is provided at your request, performance of a contract or steps requested before one (Art. 6(1)(b)).

4.6 The waiting list

If you ask to be told when something is released, we store the email address you give us, the dates you asked and confirmed, and the platform and hardware-check result your browser reported, so that the announcement we send concerns your machine. We send a confirmation email first and add you only if you click the link in it. Purpose: to send you the announcement you asked for. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time through the unsubscribe link or by contacting us.

The waiting list is the only mailing list we operate, and nothing else puts you on it: not buying a licence, not a trial key, not the beta. We send no newsletters and use no open- or click-tracking. Messages about your licence — the key, and the notices the licence agreement provides for — are part of supplying the Software, not marketing, and are sent regardless of any mailing-list choice; a message meant to interest you in something new is marketing, and we will not send it unless you have separately asked. If we ever introduce a newsletter, this policy will describe it before the first message is sent, and you will be added only through a separate, confirmed signup of its own.

4.7 The beta programme

Before a public release we run a private beta: a small group of testers receives a time-limited licence at no charge (licence agreement §3.4). Taking part is voluntary and you can stop at any time.

Applying. We process the email address you give us, the platform your browser reports and the country you select, and nothing else from the form. We send a confirmation email first and keep the application only if you click the link in it, and we write to you again only if we select you — or, if you ticked the box asking for it, about a later beta programme. An application we have not selected is deleted when the beta ends, unless you ticked that box, in which case we keep the address until you unsubscribe. Legal basis: taking steps at your request (Art. 6(1)(b)); your consent (Art. 6(1)(a)) for keeping the address for later programmes.

Taking part. We process your email address; your acceptance of the licence agreement — given in writing, in which case we keep your reply together with our invitation, the agreement attached to it and our confirmation, or on the acceptance page our invitation links to, where it is recorded like a trial acceptance (Section 4.8); your feedback and correspondence, attachments included (Section 4.3); and the licence record (Section 4.4). Purpose: to run the beta — select participants, issue and administer the licence, send the notices the licence agreement promises, answer you, ask for your feedback (Section 4.9) and act on it — and to keep evidence that the agreement was accepted. Legal basis: performance of our agreement with you (Art. 6(1)(b)); our legitimate interests in improving the Application and in being able to prove the agreement (Art. 6(1)(f)). Being a beta tester does not put you on a mailing list (Section 4.6).

4.8 The free trial key

The Application does not run without a licence key, and the trial’s key is free. You give an email address and your country, which we check against where Totsum is sold and do not store; we send that address a link; on the page it opens you read and accept the licence agreement; we record the acceptance and issue the key from that record, in that order, because the record is what makes the agreement provable, and through the link because only the holder of the mailbox can open it.

We process the email address, with the date of the request and a salted one-way hash of the requesting connection’s IP address; your acceptance — the revision accepted, a one-way hash of its exact text, the date and time, and a salted one-way hash of the accepting connection’s IP address with the browser identification string, as evidence of the circumstances of the acceptance and against abuse; and the licence record (Section 4.4). A request nobody accepts is deleted after 30 days, when its link expires. Purpose: to issue and administer the trial licence, and to keep evidence that the agreement was accepted and of which text. Legal basis: performance of our agreement with you (Art. 6(1)(b)); our legitimate interests in proving the agreement, preventing abuse of the form and sending the notices the licence agreement promises (Art. 6(1)(f)).

One trial per address. Asking again with the same address does not create a second trial: we send the same link again or, if you have already accepted, the same key. The first email we send contains no key, only the link to the acceptance page, so if someone entered your address without your knowledge, nothing has been issued in your name. That email also carries a link to stop any further email to that address; if you use it, we delete the address and keep only a one-way hash of it, so that we can honour your choice (Section 7).

4.9 Feedback requests

The Application reports nothing back to us, so what we know about how it works for you is what you tell us. We may ask, by email to the address your licence was issued to, at most twice a year per licence — during a beta, as often as the programme needs; never for a trial key. Answering is voluntary, and you can stop the requests at any time without giving a reason: each message says how, and a reply is enough; we then keep only a suppression record (Section 7). A request promotes nothing; what you answer is correspondence (Section 4.3). Purpose: to improve the Application from use we cannot observe. Legal basis: our legitimate interests (Art. 6(1)(f)), with the objection right of Section 9.

5. Who we share data with

We do not sell or rent personal data or share it for cross-context behavioural advertising. As applicable to the services you use, personal data is received by:

Each processor acts on our documented instructions under a data processing agreement. Personal data may also be disclosed to professional advisers such as our accountant, lawyer or insurer where reasonably necessary, and to courts, regulators and public authorities where the law requires it or a legal claim makes it necessary. If the business changes hands, personal data may be disclosed to the prospective buyer and their advisers to the extent the transaction requires, under confidentiality, and passes to the acquirer subject to this policy or one no less protective; the licence agreement requires any transferee to assume our obligations (its Section 18).

6. International transfers

The content you explore is processed on your device, and the Application has no feature that sends it to us or to a third party, so using it involves no international transfer of that content.

The personal data we hold is stored in the European Union, with the processors named in Section 5 and in our own records in Belgium. Where a sub-processor of one of those providers is outside the EEA, the provider’s data processing agreement with us applies the European Commission’s Standard Contractual Clauses to it.

One transfer of our own is outside the EEA: Paddle, in the United Kingdom, covered by the European Commission’s adequacy decision for the UK (renewed to 27 December 2031). Paddle may transfer data onward under the Standard Contractual Clauses for controller-to-controller transfers, supplemented by the UK Addendum. You may ask us for information about the safeguard relevant to your data and, where available, a copy.

7. Retention

Each period runs from the event named with it. When it expires, we delete or anonymise the data unless continued retention is required or permitted by law; a complaint, dispute or regulatory procedure actually under way extends the record concerned until it and any proceedings have ended. Ten years is the limitation period for contract claims (article 2262bis of the former Civil Code).

Backups. A deleted record may persist in backups for a limited further period, until those backups are themselves replaced. We use those copies only to restore the service, and deletions that had become due would be re-applied after a restore. Our email provider also keeps a delivery record of each automated email it sends for us — addresses, subject, delivery status — with, at present, no time limit on its side.

8. Security

That the Application keeps the data you explore on your device is the main privacy and security measure for that data. For the data we do hold (Section 4), we apply reasonable technical and organisational measures. No method of storage or processing is completely secure, and we cannot guarantee absolute security.

9. Your rights

Subject to the conditions and exceptions in applicable law, you have the right to access your personal data, to its rectification, erasure, restriction and portability, and to object to processing; where we rely on consent, you may withdraw it at any time, without affecting processing that was lawful beforehand. To exercise these rights: privacy@totsum.app. We normally respond within one month, subject to any extension the law permits, and may need to verify your identity first.

Your right to object. Where we rely on our legitimate interests (each case is identified in Sections 3.7 and 4), you may object at any time on grounds relating to your particular situation; we will then stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. You may ask us for the substance of the balancing assessment behind any legitimate interest we rely on. Feedback requests, and any direct marketing should we ever conduct it, you may object to at any time without giving a reason. For data processed by the Reseller (Section 4.2), you may also exercise your rights directly with it.

You also have the right to lodge a complaint with a supervisory authority. In Belgium this is the Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse / Drukpersstraat 35, 1000 Brussels — contact@apd-gba.be — https://www.autoriteprotectiondonnees.be. You may also contact the authority of the Member State of your habitual residence, place of work or the alleged infringement, or, outside the EU, your local data-protection authority.

10. Children and educational use

Totsum Data Explorer is not directed at children, and we do not knowingly collect personal data from them. Buying a licence, asking for a trial key and taking part in the beta are contracts, for adults and duly authorised representatives. The waiting list rests on consent alone, which Belgian law lets you give yourself from the age of 13 (Act of 30 July 2018, Article 7); below that age, a parent or guardian must do it for you.

The Application may be used in an educational setting under the responsibility of a school, teacher, parent or other authorised adult. Because the data you explore is processed locally, Totsum does not ordinarily receive student data at all; the school or organisation remains responsible for its own lawful basis, for informing the students and for their rights. If you believe a child has provided us with personal data, contact us (Section 13) and we will delete it.

11. Automated decision-making and profiling

We do not carry out automated decision-making producing legal or similarly significant effects about you, and we do not profile you. The Application’s AI features operate locally to help you explore your own data.

12. Changes to this policy

The current version and its effective date are the ones published at totsum.app/legal/privacy; the copy distributed with the Application (in its About dialog) is the version current when that release was built, and may lag the published one until the next release. Before enabling any feature that introduces materially new online processing — cloud sync, online activation, crash reporting — we will update this policy and give any notice, or obtain any consent, that the law requires. For a change involving a new purpose, a change of controller or a change to how you exercise your rights, we will tell you actively, by email where we hold an address for you, before it takes effect.

13. Contact

Privacy contact: privacy@totsum.app · Website: totsum.app · Post: the registered office in Section 1, where the provider of that office opens and scans what arrives (Section 5); if you would rather we alone read what you send, write to privacy@totsum.app.

We have not appointed a Data Protection Officer and are not required to. If we appoint one, their contact details will be added here.