Privacy Policy

Who we are

SheetForge is run by APPS 365 LTD. We are the data controller for the personal data described in this policy.

What we collect and why

• Your spreadsheet while you build - when you only build an app in your browser, the file is processed in your browser. It is not sent to our servers at that stage.
• Shared and saved apps - when you share or save an app, the rows you share are stored on our servers, encrypted at rest, so the link works. They are deleted when the app expires, when you delete it, or when you delete your account. Spreadsheets can contain personal data about other people, so please only share what you are allowed to share.
• Account details - your name, email address, a hashed copy of your password and your two-factor authentication settings, so you can sign in and manage your apps.
• Google account - if you sign in with Google or connect Google Sheets, we receive your name and email address from Google and store your Google OAuth tokens, encrypted. The access we ask for is read and write access to Google Sheets and read-only access to Google Drive. We need this to open private sheets you choose and to write edits back to them (write-back). You can disconnect at any time in your Google account settings.
• Billing - if you buy Pro, Stripe handles your payment. We store your Stripe customer reference, plan and subscription status. We never see or store your full card details.
• Messages - what you send us through the contact form, support tickets or email, and any email address you give us in the app builder.
• Security logs - sign-in events, security events and IP addresses, to protect accounts and investigate misuse.
• Shared app views - when someone opens a shared app, we record the time, browser and device type, country and a one-way hashed version of their IP address, so the app owner can see view counts.

SheetForge does not send your data to any AI service, and no AI or large language model provider processes it - except when you choose to use SheetForge inside ChatGPT: then ChatGPT sends us the spreadsheet you gave it, and we send back the app's name, columns, first five rows and links so ChatGPT can show the app. The ChatGPT plugin privacy notice has the details.

Our legal reasons for using your data

• Contract - to provide your account, your shared apps and your Pro subscription
• Legitimate interests - to keep the Service secure, prevent misuse, answer your messages and improve the Service
• Legal obligation - to keep billing and tax records
• Consent - where we ask for it, for example when you connect your Google account. You can withdraw consent at any time

Who we share data with

We do not sell your data or share it for advertising. We use these sub-processors to run SheetForge:

• Stripe (Stripe Payments Europe, Limited and Stripe, Inc.) - payments, invoices and VAT. Processes data in the EU and the US.
• Google - Google Sheets access, Google OAuth and Google sign-in, if you choose to use them. Processes data in the US and elsewhere.
• Our UK hosting provider - our servers, database and backups are in the UK.

We may also share data if the law requires it, or to protect our rights and the safety of our users.

International transfers

Our servers are in the UK. Stripe and Google may process some data in the United States. Where that happens, the transfer is protected by UK adequacy regulations (such as the UK-US data bridge) or by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

How long we keep data

Cookies

SheetForge only uses essential cookies: a session cookie that keeps you signed in, and a security cookie that protects forms against cross-site request forgery. We do not use analytics or advertising cookies. Your light or dark theme choice is saved in your browser's local storage, not a cookie.

Our pages load fonts from Google Fonts, so your browser connects to Google to fetch them. If you click "Book a demo", the booking calendar is loaded from Calendly, which may set its own cookies. If the owner of a shared app adds their own Google Analytics ID to it, that app will use Google Analytics under the app owner's control.

Google user data

SheetForge's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We only use Google user data to provide the features you ask for: opening the sheets you choose, refreshing your apps from them, and writing your edits back.
• We do not use Google user data for advertising, we do not sell it, and we do not use it to train AI models.
• People at SheetForge do not read your Google data unless you ask us to (for example in a support request), it is needed for security, or the law requires it.

Your rights

Right to complain: if you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

Security

We follow security good practice: HTTPS everywhere, encrypted secrets, two-factor authentication available on every account, and daily backups. See our Security page for more detail.

If your organisation needs a data processing agreement, email hello@sheetforge.ai.

Changes to this policy

We will update this page if the way we handle data changes, and we will email registered users about significant changes. Questions? Email hello@sheetforge.ai.