Privacy Policy

1. About Us

Sheetminer Limited is a company registered in Ireland (Company No: 804493). We operate as a Data Controller under the General Data Protection Regulation (GDPR).

2. Information We Collect

To provide our document extraction services, we collect the following:

• Account Data: Name, email address, and Google profile information provided during sign-in.
• Document Metadata: File names, sizes, and timestamps of documents you select for processing.
• Original Documents and OCR Output: We store a copy of each document you upload, together with the text and layout data produced when it is processed (OCR output). This lets you view the source document from within Sheetminer and verify where extracted values came from. Both are retained until you delete the source document or your account (see Section 5).
• Document Text (Markdown Extraction): When you upload a document, we automatically generate and store a text/markdown representation of it, in addition to the cryptographic hash described below. This representation powers the Document Search feature and is retained until you delete the source document (see Section 5).
• Spreadsheet Content: Where you use features such as Sum Snip or Document Search, we read the cell values or ranges you select in your active spreadsheet in order to perform the requested calculation or match them against your documents, and we write extraction results back into the cells you specify. Sheetminer only accesses the spreadsheet you currently have open.
• Cryptographic Hashes: When a document is processed, we generate a SHA-256 hash of the file and store it with the document record in Google Cloud Platform (GCP). A hash is a non-reversible "fingerprint" that identifies the exact file that was processed; it cannot be used to recreate the original document.
• Usage Data and Session Replays: We use PostHog to understand how the Sheetminer add-on and website are used (e.g., feature usage, extraction frequency) and to record session replays of the add-on interface, so we can improve our service. In the add-on, usage events and session replays are linked to your Sheetminer account, including your account ID, name, and email address. On our website, analytics only run if you accept them. Both are described in Section 10.
• Billing Data (if you subscribe): Billing and contact details, subscription status, and payment-related metadata processed via our payment provider.
• Third-Party Data in Documents: If you upload or select documents containing personal data about other individuals (e.g., customers, suppliers, employees), you are responsible for ensuring you have a lawful basis to share that data with us and for providing any required notices.
• Communications: We may send you transactional emails (such as a welcome email when you sign up, or service-related notifications) using your name and email address. We may also send you marketing emails about Sheetminer, our features, and related products. We only send marketing emails where you have opted in to receive them, or where you are an existing customer and we are marketing products similar to the ones you already use. Every marketing email includes a link you can use to opt out, and you can opt out at any time without losing access to the Service. Transactional and marketing emails are sent via our email delivery provider (Resend).

Providing your Google account information is necessary to use the Service. If you do not provide this data, we cannot provide the Service to you. Providing billing data is necessary only if you subscribe to a paid plan.

3. How We Process Your Documents

Sheetminer integrates with your Google Workspace and Google Drive.

• Access: We access only the files you explicitly select or authorize.
• Processing: Documents are processed using Microsoft Azure AI Document Intelligence to read their text and layout (OCR and parsing). To extract the specific fields you request, the resulting text is then processed by Google's Gemini models through Google Cloud Vertex AI, in the EU (europe-west4). These providers process document content only to return results to us.
• Document Search: When you use the Document Search feature, the spreadsheet values or queries you enter are matched against the stored text/markdown representation of your documents, using our infrastructure on Google Cloud Platform (GCP).
• Storage: All application data, including your original uploaded documents, OCR output, extraction results, metadata, and hashes, is stored securely on Google Cloud Platform (GCP).
• Retention: For every document you upload, we retain the original file and its OCR output so you can view and verify the source, along with a text/markdown representation (used to power Document Search), the extraction results, metadata, and cryptographic hash. The original file, OCR output, and markdown representation are deleted when you delete the source document or your account.

4. Lawful Basis for Processing

Under GDPR, we process your data based on:

• Contractual Necessity: To provide the service you have signed up for.
• Consent (Marketing Emails): To send you marketing emails. We rely on your explicit opt-in, and we do not treat your use of the Service, or your acceptance of the Terms, as consent to marketing. Where we email an existing customer about similar products, we rely on our legitimate interests, and we offer a clear way to opt out both when we collect your details and in every marketing email. You can withdraw your consent, or object to marketing altogether, at any time (see Section 7).
• Legitimate Interests: To keep the Service secure and reliable (e.g., preventing fraud and abuse), and to understand how features are used so we can improve performance and usability, including through session replays of the add-on interface (see Section 10). Where we rely on legitimate interests, we consider the impact on your privacy and use reasonable safeguards (such as limiting the data we collect to what we need and restricting access to it). You may object to processing based on legitimate interests at any time (see Section 7).
• Legal Obligation: Where we are required to maintain records for tax or regulatory purposes.

5. Data Retention

We keep personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law (for example, tax or accounting obligations).

• Document Text (Markdown Extraction): Created automatically for every uploaded document. Deleted immediately when you delete the source document or your account.
• Original Documents and OCR Output: Retained until you delete the source document or your account, at which point they are deleted from our storage.
• Document Metadata, Extraction Results, and Hashes: Retained until you delete the source document or your account (subject to legal obligations and backup retention).
• Account Data: Retained until you delete your account. You can delete your account at any time from your account page on sheetminer.app, or by contacting us.
• Deleted Account Record: When you delete your account, we keep a minimal record to prevent abuse of free usage allowances (for example, repeatedly deleting and recreating an account to reset free credits). This record contains a one-way hash of your email address and Google account ID, your credit usage and allowance, and the date your usage period resets. It does not contain your name, email address, or documents in readable form. If you create a new account with the same email address or Google account, we use it to restore your previous credit usage. We keep this record for as long as it is needed for that purpose, based on our legitimate interest in preventing fraud and abuse.
• Usage Analytics and Session Recordings (PostHog): Retained for up to 24 months, unless we need to retain it longer for security investigations or to comply with legal obligations.
• Marketing Preferences: Retained while your account is active. If you opt out of marketing, we keep a minimal record of that request (your email address and the date) for as long as needed to keep honouring it, including after your account is closed.
• Billing and Transaction Records: Held by our payment provider (Stripe) and retained for as long as required by applicable tax and accounting laws (typically up to 6–7 years), including after your account is deleted.
• Backups and Logs: Copies may persist for a limited period in backups and logs for security and disaster recovery, and are deleted in the ordinary course.

6. Third-Party Processors and International Transfers

We share data with trusted sub-processors only as necessary:

Our systems (and the personal data we process for the Service) are hosted and processed in the European Union / European Economic Area (EEA). We do not intend to transfer your personal data outside the EEA for the provision of the Service.

Where possible, we configure our processors to use EU/EEA regions and storage locations for Service data.

If an international transfer outside the EEA is ever required (for example, due to a change in a provider's infrastructure, legal requirements, or support operations), we will ensure appropriate safeguards are in place such as: (a) adequacy decisions where available; (b) the European Commission's Standard Contractual Clauses (SCCs); and/or (c) other lawful transfer mechanisms with supplemental security measures where appropriate.

7. Your Rights (GDPR)

If you are in the EEA/UK (or where GDPR applies), you have rights that may include access, rectification, erasure, restriction, portability, and the right to object (including to processing based on legitimate interests). You can exercise these rights by contacting us at support@sheetminer.app. You can also delete your account yourself at any time from your account page on sheetminer.app; this immediately deletes your account data and your documents (including original files, OCR output, document text, and extraction results), except for the deleted account record, any marketing opt-out record, and billing records described in Section 5.

You can object to direct marketing at any time and free of charge. If you object, we will stop using your personal data for marketing. You can object by using the unsubscribe link in any marketing email, or by contacting us at support@sheetminer.app. You can also withdraw your consent to marketing at any time. Withdrawing consent does not affect the lawfulness of any marketing we sent before you withdrew it, and it does not affect the transactional emails you need to use the Service.

You also have the right to lodge a complaint with a supervisory authority. In Ireland, the supervisory authority is the Data Protection Commission (DPC): dataprotection.ie.

8. Children's Data

The Service is not intended for children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us and we will take steps to delete it.

9. Automated Decision-Making

We use automation (including AI) to help extract information from Documents. We do not use the Service to make automated decisions that produce legal effects or similarly significant effects about you within the meaning of GDPR Article 22.

10. Cookies and Similar Tracking Technologies

We use a small number of cookies and similar technologies to operate the Service and understand how it is used. On our website (sheetminer.app), non-essential storage is only used after you give consent through our cookie banner. The Sheetminer Google Sheets add-on works differently, as described below.

What we store

• PostHog (website analytics): When you accept analytics cookies, PostHog stores a random distinct_id in a first-party cookie and localStorage entry, plus a session identifier and basic device and referrer information. This allows us to recognise repeat visits, count unique users, and understand feature usage. Session recording is disabled on our website.
• PostHog (add-on analytics and session replays): Inside the Google Sheets add-on, we store an identifier in the add-on's browser storage and use PostHog to record how features are used and to record session replays of the add-on interface. A replay captures how the add-on interface is used, such as clicks, navigation and interface state, together with the browser and device information that accompanies those events. Usage events and replays are linked to your Sheetminer account (account ID, name, and email address) and are retained for the period stated in Section 5. We mask all form inputs, and the document viewer, document filenames in the document list, extracted field values, table previews, AI Snip cards, and spreadsheet cell values shown when linking cells to sources are excluded from recordings, so the rendered contents of your documents are not captured. The website cookie banner does not apply to the add-on; we process this data on the basis of our legitimate interest in maintaining and improving the Service (see Section 4). You can object at any time by contacting support@sheetminer.app.
• Cookie consent preference: We store your accept/reject choice in a first-party localStorage entry (sheetminer_cookie_consent) so we do not show the banner on every visit.
• Strictly necessary cookies: Google Sign-In sets short-lived cookies required to authenticate you. Stripe may set cookies as part of the secure checkout flow. These are strictly necessary to provide the service you request and do not require consent.

How to control cookies

• You can accept or reject website analytics cookies via the consent banner shown on your first visit.
• You can withdraw your choice at any time by clearing your browser's site data for sheetminer.app or by using your browser's privacy controls to block or delete cookies and localStorage.
• Most browsers also offer a "Do Not Track" or "Global Privacy Control" setting; where such a signal is sent, we will treat it as a rejection of analytics storage.

For the full list of cookies and storage entries set by our sub-processors, please refer to their respective documentation.

11. Supplemental Notice to California Residents (CCPA/CPRA)

This section applies solely to residents of the State of California.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. If we make material changes, we will provide reasonable notice (for example, by posting the updated policy on our website and updating the "Last Updated" date above, or by notifying you by email where appropriate).

We encourage you to review this policy periodically. Your continued use of the Service after the updated policy takes effect constitutes acceptance of the changes.