When AI is used
This beta creates charts from local tables and completed examples. Remote planning, public-data AI research and AI repair are paused. Preparing and copying the Excel instructions does not call an AI service.
If you give the instructions or template to your own AI, that service handles what you share under its own terms. Custom icon URLs are requested by your browser from the image host. The retained remote-AI disclosures below describe the paused capabilities, not an active beta workflow.
AI table conversion for “Upload your own file — as it is” is separate from those paused capabilities: where it is available, it sends table content to our AI provider only after you choose Send to AI, as described next. Pasting or uploading a ready table and the blank template path stay local.
What leaves this browser for AI table conversion
Before the first send of each file in a browser session, the card asks and shows what would be sent. Consent is bound to that file’s content hash, to the exact content shown, and to the disclosure version; another file, a change in what would be sent, or a new disclosure version asks again. Choosing Keep it in this browser sends nothing.
If you choose Send to AI, your table’s content — column names, labels and values — is sent through Chartlapse’s server route to the external AI API, which returns a suggested reading. Small tables are sent in full and labeled Whole table with their row and column counts; for larger tables the header area, first and last rows, and rows that look like totals or notes are sent, and the distinct labels of category columns (up to 40 per column, from any row), together with Chartlapse’s own notes on the table, up to 32 KB in all. The card shows all of it before you choose, and a What was sent receipt shows exactly those rows, labels and notes afterwards. Titles or notes typed inside the sheet are part of the table and are sent like other cells.
Person-name columns (for example Name, Manager, or Contact) are masked by default with placeholder tokens; you can choose Show names to AI for a column. The suggestion is checked against what was sent and applies nothing until you review and apply it.
Nothing from a conversion request is stored on Chartlapse servers or written to logs, metrics, or analytics; the route keeps only content-free counts and error codes. The external AI API provider may process the request under its own terms and privacy policy; Chartlapse does not promise provider-side deletion.
- Sent after consent: column names, labels, values (small tables in full), the distinct labels of category columns (from any row), shape counts, and the local engine’s notes on the table
- Not sent: the file itself, file or sheet names, account or session identifiers, formulas, comments, or workbook metadata
- Masked by default: cells under person-name headers, unless you release a column
What the visualization planner sends
Only a minimized planning request:
- Locale (en-US or ko-KR)
- Still vs animated experience mode
- Requested renderer family
- Input mode (natural-language, Excel, or hybrid)
- Your prompt text
- Bounded recent chat turns
- Boolean hasLocalExcelFile — not original file name, not rows (Chartlapse may see size for limits)
What the visualization planner does not send
By design and automated regression:
- Original .xlsx bytes
- Sheet rows, cell values, and column header inventories
- File names
- API keys in the browser
What leaves this browser for AI repair
Before consent, Chartlapse shows a value-free preview of the exact outbound field groups and count for each group. The preview is bound to the payload digest and disclosure version; it does not repeat your repair goal or header text.
The schema-only request may send the external AI API your repair goal, locale, input format, table row/column/sheet counts, bounded issue summaries, opaque candidate and allow-listed operation summaries, and optional column profiles. A column profile includes header text, inferred kind, and missing/numeric/date/distinct ratios—not raw cell values.
Source- and session-specific consent is required for that exact provider, purpose, disclosure version, and payload digest. A source, sheet, session, payload, or disclosure change invalidates the consent before another request.
The repair response is only a proposal. Existing deterministic checks must validate it, and you review and approve any change separately before Chartlapse can alter your copy of the table.
Repair goals, header text, schema summaries, provider response bodies, consent receipts and digests, and local review bindings are not written to logs, metrics, or analytics. The route may retain only content-free operations data: fixed provider, model, and contract labels; metric-window start time; request, outcome, and error-code counts; latency percentiles; provider-attempt and usage-availability counts; aggregate prompt, completion, and cache-token counts; fixed reserved-cost upper-bound buckets; proposed-operation counts; and non-content request ids.
- Not sent: original file bytes, raw table rows, cell values, formulas, comments, hidden sheets, file or sheet name, file path, source URLs, or source identifiers
- Local only: source hash, sheet index, selected local candidate identity, mapping, working recipe, generation, account/session identifiers, and the in-memory consent receipt
- Never sent: browser API keys or server credentials
Public-data research
When you explicitly enable public-data research, Chartlapse may send your sentence and locale to the external AI API and may use Tavily as a source-link discovery fallback. Search titles and links are leads only: page snippets, model answers, and model-suggested numbers do not become Chartlapse data.
Tavily processes the research query during source discovery. If you separately select discovered URLs in the Beta table-review disclosure and approve a source-specific rights and robots review, Tavily Extract processes those selected URLs and the publisher content it retrieves. Extracted traces remain review-only unless one fully traceable, single-unit, unscaled table passes the deterministic checks and you confirm its exact mapping and missing-value rule. That signed reviewed-web flow may create a local Preview; Publish and Share remain blocked until the source terms receive separate approval.
The main data-research command can also ask the external AI API to find public sources beyond registered catalogs. With your consent, public source URLs may be read from verified public publishers, Jina Reader or AllOrigins, and retrieved page excerpts and table previews are sent to the external AI API to select relevant table positions. Chartlapse reads numeric values from those positions, retains source links and content hashes, and asks you to review the meaning and available coverage before making a local chart. Uploaded workbook rows are not included. These collected tables are not labeled as approved official Source Evidence; Publish and Share require a separate redistribution-rights review. Missing values are never silently replaced with zero or interpolation.
Limits and safety
Planning requests are size-limited, rate-limited, and time-limited on the server. Provider error detail is not forwarded verbatim to the browser. Excel safety limits (file size, rows, columns) apply to local parsing independently of AI.
Third-party processing
The external AI API provider processes minimized planning or research-intent text under its own terms. Tavily may process bounded search queries during discovery and, only after the separate Beta table-review approval, selected URLs and retrieved publisher content through Tavily Extract. Chartlapse does not use providers to invent dataset values. Numeric acquisition uses registered connectors, signed reviewed-web promotions, or request-driven public-table collection with original cells and source evidence. Reviewed-web and collected-table results are local-Preview only until their source terms are separately approved for Publish and Share.
When AI repair is available and you consent to an exact preview, the external AI API provider processes the bounded repair goal and optional header-profile text described above. It does not receive original files, raw rows or cell values, file or sheet names, source URLs, or local source and review bindings. Provider retention and deletion remain governed by the API provider’s own terms and privacy policy; Chartlapse does not promise provider-side deletion.
When AI table conversion is available and you choose Send to AI, the external AI API provider processes the table content described above (column names, labels and values; small tables in full; the distinct labels of category columns; Chartlapse’s notes on the table; person-name columns masked unless you release them) under its own terms. File and sheet names and your account are not sent.