When AI is used
This beta creates charts from local tables and completed examples. Remote planning, public-data AI research and AI repair are paused. Preparing and copying the Excel instructions does not call an AI service.
If you give the instructions or template to your own AI, that service handles what you share under its own terms. Custom icon URLs are requested by your browser from the image host. The retained remote-AI disclosures below describe the paused capabilities, not an active beta workflow.
What the visualization planner sends
Only a minimized planning request:
- Locale (en-US or ko-KR)
- Still vs animated experience mode
- Requested renderer family
- Input mode (natural-language, Excel, or hybrid)
- Your prompt text
- Bounded recent chat turns
- Boolean hasLocalExcelFile — not original file name, not rows (Chartlapse may see size for limits)
What the visualization planner does not send
By design and automated regression:
- Original .xlsx bytes
- Sheet rows, cell values, and column header inventories
- File names
- API keys in the browser
What leaves this browser for AI repair
Before consent, Chartlapse shows a value-free preview of the exact outbound field groups and count for each group. The preview is bound to the payload digest and disclosure version; it does not repeat your repair goal or header text.
The schema-only request may send DeepSeek your repair goal, locale, input format, table row/column/sheet counts, bounded issue summaries, opaque candidate and allow-listed operation summaries, and optional column profiles. A column profile includes header text, inferred kind, and missing/numeric/date/distinct ratios—not raw cell values.
Source- and session-specific consent is required for that exact provider, purpose, disclosure version, and payload digest. A source, sheet, session, payload, or disclosure change invalidates the consent before another request.
The repair response is only a proposal. Existing deterministic checks must validate it, and you review and approve any change separately before Chartlapse can alter your copy of the table.
Repair goals, header text, schema summaries, provider response bodies, consent receipts and digests, and local review bindings are not written to logs, metrics, or analytics. The route may retain only content-free operations data: fixed provider, model, and contract labels; metric-window start time; request, outcome, and error-code counts; latency percentiles; provider-attempt and usage-availability counts; aggregate prompt, completion, and cache-token counts; fixed reserved-cost upper-bound buckets; proposed-operation counts; and non-content request ids.
- Not sent: original file bytes, raw table rows, cell values, formulas, comments, hidden sheets, file or sheet name, file path, source URLs, or source identifiers
- Local only: source hash, sheet index, selected local candidate identity, mapping, working recipe, generation, account/session identifiers, and the in-memory consent receipt
- Never sent: browser API keys or server credentials
Public-data research
When you explicitly enable public-data research, Chartlapse may send your sentence and locale to DeepSeek and may use Tavily as a source-link discovery fallback. Search titles and links are leads only: page snippets, model answers, and model-suggested numbers do not become Chartlapse data.
Tavily processes the research query during source discovery. If you separately select discovered URLs in the Beta table-review disclosure and approve a source-specific rights and robots review, Tavily Extract processes those selected URLs and the publisher content it retrieves. Extracted traces remain review-only unless one fully traceable, single-unit, unscaled table passes the deterministic checks and you confirm its exact mapping and missing-value rule. That signed reviewed-web flow may create a local Preview; Publish and Share remain blocked until the source terms receive separate approval.
The main data-research command can also ask DeepSeek to find public sources beyond registered catalogs. With your consent, public source URLs may be read from verified public publishers, Jina Reader or AllOrigins, and retrieved page excerpts and table previews are sent to DeepSeek to select relevant table positions. Chartlapse reads numeric values from those positions, retains source links and content hashes, and asks you to review the meaning and available coverage before making a local chart. Uploaded workbook rows are not included. These collected tables are not labeled as approved official Source Evidence; Publish and Share require a separate redistribution-rights review. Missing values are never silently replaced with zero or interpolation.
Limits and safety
Planning requests are size-limited, rate-limited, and time-limited on the server. Provider error detail is not forwarded verbatim to the browser. Excel safety limits (file size, rows, columns) apply to local parsing independently of AI.
Third-party processing
DeepSeek processes minimized planning or research-intent text under its own terms. Tavily may process bounded search queries during discovery and, only after the separate Beta table-review approval, selected URLs and retrieved publisher content through Tavily Extract. Chartlapse does not use providers to invent dataset values. Numeric acquisition uses registered connectors, signed reviewed-web promotions, or request-driven public-table collection with original cells and source evidence. Reviewed-web and collected-table results are local-Preview only until their source terms are separately approved for Publish and Share.
When AI repair is available and you consent to an exact preview, DeepSeek processes the bounded repair goal and optional header-profile text described above. It does not receive original files, raw rows or cell values, file or sheet names, source URLs, or local source and review bindings. Provider retention and deletion remain governed by DeepSeek’s own terms and privacy policy; Chartlapse does not promise provider-side deletion.