Privacy Policy

Who we are

Embed Sheets is a tool for building forms, calculators and widgets and embedding them on a website. This policy covers embedsheets.com and the application at app.embedsheets.com.

Two different sets of people appear in this policy, and they are worth keeping apart:

• You — someone with an Embed Sheets account, who builds tools. We are the controller of your data.
• Your visitors — people who fill in a calculator you built. That data is yours; we hold it on your behalf, as a processor, and act on your instructions about it.

What we collect about you

Only what the product needs to work:

• Account details — your name, email address and a hashed password. If you sign in with Google, we receive your name, email address and profile picture from Google instead of a password.
• What you build — your calculators, formulas, settings, uploaded images and any Google Sheet you connect.
• Billing details — your plan, its status and renewal date. We never see your card. Payments are handled by FastSpring, who take the card details directly; we receive only confirmation that a payment succeeded.
• Sign-in records — the time, IP address and outcome of sign-in attempts, kept so an account can be secured after a suspicious one.
• Usage — how many times your calculators were loaded, and requests you make to the AI builder. Used for limits and for working out what to fix.

We do not buy data about you, and we do not sell or rent anything we hold. There is no advertising on Embed Sheets, and no advertising network is given access to it.

What your visitors give you

When somebody fills in one of your calculators, whatever they enter is stored against your account so you can see it. That is usually a name, an email address, a phone number and the answers they gave.

You decide what to ask for. Because those questions are yours, so are the obligations that come with them:

• Tell your visitors what you are collecting and why — your own privacy notice, on your own site.
• Do not use our fields to collect health records, financial account numbers, government identifiers or anything else needing special protection. The product is not built for it.
• Answer your visitors when they ask you to show or delete what you hold. We will help you do that — write to us and we will act on it.

We do not contact your visitors, and we do not use their answers for anything except delivering them to you.

Google Sheets and Google sign-in

If you connect a Google Sheet, we ask Google for one permission: spreadsheets. It lets us write your visitor’s answers into the cells you nominate and read the results back.

Two things follow from that, and both matter:

• We only ever touch the sheets you connect to a calculator. The permission is broad because Google does not offer a narrower one, not because we look at anything else.
• We do not copy your spreadsheet. Values go in, results come out, and nothing about the sheet is stored here beyond its address and the cells you mapped.

Embed Sheets’ use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. You can withdraw the permission at any time from your Google account or by disconnecting the sheet in the builder.

Cookies

We use cookies for two things:

• Keeping you signed in. A session cookie, removed when you sign out.
• Security. A token that stops a form on another site being submitted as though it were you.

Both are necessary for the application to function, so there is no consent banner asking about them — without them, there is no sign-in. We set no advertising or tracking cookies.

A calculator embedded on your site does not set a cookie on your visitors. If your site needs a cookie banner, ours does not add a reason for one.

Who else sees it

A short list, and every one of them is a supplier doing a specific job:

• FastSpring — takes payments and is the merchant of record. They hold your billing details; we do not.
• Google — only if you connect a sheet, use address lookup, distance, maps or reviews, or sign in with Google.
• Our hosting provider — runs the servers the application sits on.
• Email delivery — sends the results and notifications your calculators trigger. If you configure your own SMTP server, your mail goes through yours instead.

Beyond that, we disclose data only where the law requires it. Were the business ever sold, your data would move with it and you would be told before it did.

How long it is kept

• Your account and your calculators — until you delete them, or until you ask us to close your account.
• Leads — until you delete them. They are yours; we do not clear them out on a schedule.
• Sign-in records — twelve months.
• Billing records — as long as tax law requires, which is generally seven years.

Closing your account deletes your calculators and your leads. That cannot be undone, so export anything you want to keep first.

Your rights

Wherever you live, you can ask us to show you what we hold, correct it, delete it, or send you a copy in a portable form. If you are in the UK, the EU or another region with equivalent law, those are rights rather than courtesies, and they include the right to object to processing and to complain to your data protection authority.

Write to support@embedsheets.com. We will reply within 30 days, and usually much sooner. We do not charge for this and we will not ask you why.

Security

Passwords are hashed, never stored in a readable form. Traffic runs over HTTPS. Access to production data is limited to the people who need it to keep the service running.

No service can promise it will never be breached, and we are not going to. What we can promise is that if data of yours is exposed, we will tell you what happened, what was affected and what to do about it — promptly, and without waiting to be asked.

Changes

If this policy changes in a way that affects you, we will email you before it takes effect. Smaller corrections are made here with the date at the top updated.