Privacy Policy

This policy explains what personal data Spreadless AI collects, why, where it is kept and what you can ask us to do with it. It covers the website, the app and the data in the workbooks you upload.

Who we are

Spreadless AI is provided by the company named in our Terms of Service. For your account data we are the controller. For the business data inside the workbooks you upload (for example your customers' names and contact details), you are the controller and we process it on your behalf, as described in our Data Processing Agreement. Contact: hello@spreadless.ai.

What we collect

• Your account. If you try Spreadless AI without signing up, we create an account without an email address so your app has a place to live. When you save the app or sign in, we store your email address and send you a sign-in code or link by email; where it is offered you can sign in with Google or Microsoft instead, and we get your email address from them. We don't use passwords.
• Your workbooks. The Excel or CSV files you upload, kept in private storage that only your workspace can open, and the note you write next to an upload.
• Your app's records. The rows imported from your workbook and everything you add, change or delete in the app afterwards.
• Your team. The members of a workspace and their roles. An invite link can carry the email address it was meant for, if the person inviting typed one.
• Billing. For paid plans, Stripe collects the paying company's billing name, email, address, tax ID and card. We store the Stripe customer and subscription ids, the plan and its status, and a ledger of AI uses; we never see full card numbers.
• Emails sent from your app. When someone in your team emails a record, Resend delivers it; we log who sent which record and count the emails per month, but don't keep the message.
• Activity records. We log uploads, each run that builds an app (including the AI usage it caused), and when records are created, changed or deleted, with your account and the time. To see how the product is used we also record a few events with your account and the time: an upload, a finished build, the first opening of an app, a visit (once a day), a return after a week away, a payment and a cancellation.
• Your decisions on things to check. When you pick an answer to “Which one is right?”, fix, ignore or undo something the app found, we keep which kind of finding it was, what you chose and the column name and values involved, to make the checks better. The column names and values can be removed while the decision itself is kept.
• A fingerprint of your IP address. To limit uploads without an account to 3 an hour, we store a keyed hash of your IP address with the time of each upload, not the address itself. To limit full builds to 10 a day from one device and 30 a day from one email address, we keep a keyed hash of a random id of your browser and of your email address with the time. Our hosting provider also keeps the usual server logs, which include IP addresses.

We count page views with Vercel Web Analytics, without cookies and without storing anything in your browser: which page was seen (addresses that hold a secret, such as share links, are cut before sending), the site you came from, your country, and the kind of device and browser. Visitors are told apart for one day only, by a value Vercel derives from the request and discards after 24 hours. We don't use advertising tools, and we don't sell your data.

How the AI sees your workbook

Building an app from your files uses AI models (Claude, by Anthropic). Anthropic processes this data in the United States, outside the EU. What it is sent:

• To read the layout of your workbook (where its tables, titles and totals are): the contents of every sheet, up to the first 120 and the last 30 filled rows of each, with the row numbers, cut to 40 characters a cell.
• To check your data (sums that don't add up, entries twice, dates that can't be): the rows of your tables, in parts, and up to 2,000 rows a build to tell entries from titles and totals.
• To name and shape your app: the names of the sheets and columns, what kind of values each column holds, a few sample rows, and your note.
• Documents you add (invoices, receipts, photos): their text, or the image itself for a photo or a scan.
• Afterwards only what you ask of it: your message to the assistant with the names of your lists and columns, or a change you ask for.

The AI's answers are pointers that our code checks against your file; every value in your app comes from the file itself, and the import of all your rows happens on our own servers, without the AI. For each build we log which AI steps ran, how many tokens they used and what they cost.

Why we use it

• To provide the service you asked for: building and running your app (performance of our contract with you).
• To understand how the product is used and to make its checks better: the product events and your decisions on things to check (our legitimate interest in improving the service).
• To keep the service safe and working: upload limits, activity records and server logs (our legitimate interest in preventing abuse and fixing problems).
• To send you the sign-in and confirmation emails you request.

Where it is kept and who helps us

We use these providers to run Spreadless AI. They process data only to provide their service to us.

Data sent to providers outside your country (for example to Anthropic in the United States) is covered by the safeguards in those providers' data processing terms, such as the EU Standard Contractual Clauses. Anthropic's commercial terms say that data sent through its API is not used to train its models.

When an owner or admin of a workspace sets up a webhook, an automation that calls a URL or sends an email, or an API key, the app's records go to the addresses and tools they chose. Those receivers are chosen by the workspace, not by us.

When an owner or admin connects another service on the Connections page (Airtable, Google Drive, OneDrive, Stripe, Shopify, WooCommerce, QuickBooks, Xero, HubSpot, Salesforce or Pipedrive), we keep the access they give (a key or a sign-in to that service) encrypted, use it only to read the data they connected into their app, and delete it when the connection is removed. We never write to those services.

When they connect Slack or Microsoft Teams, their automations post the messages they set up to the channel they picked. When they connect Gmail or Outlook, their automations send the emails they set up from that mailbox; we keep the access encrypted and use it only to send those emails. An address for receiving rows adds what other apps send to it to one list of the workspace.

When you write to us with the Help button, we keep your message with your email address, your workspace and app, your plan and the page you were on, to answer you.

How long we keep it

We keep your account, workbooks and records for as long as your account exists. You can delete your files and data yourself at any time in Settings → Your data: the workspaces you own alone go with everything in them, and your account with them. You can also write to hello@spreadless.ai from the account's email address and we will delete it within 30 days. On Pro and Business we also keep a nightly backup of your app for 7 or 30 days. The copies of changed records kept for webhooks and automations are deleted after 30 days, the automation run history after 90 days. Invoices and payment records are kept as long as accounting and tax law requires. Server logs at our hosting provider are kept for the provider's standard period.

Your rights

You can ask for a copy of your personal data, have it corrected or deleted, restrict or object to how we use it, and receive the data you gave us in a portable form. Write to hello@spreadless.ai. If you are in the EU or the UK you may also complain to your data protection authority; in the United Arab Emirates, to the UAE Data Office.

Cookies

We only use the cookies needed to keep you signed in, to remember which workspace you work in and your language, and a random id of your browser for the daily build limit. See Cookies.

Children

Spreadless AI is a tool for businesses and is not meant for anyone under 18.

Changes

When this policy changes, we update it here and change the date at the top. For changes that matter to how we use your data, we will tell signed-in users before they take effect.