Privacy Policy

Last updated: September 10, 2026

1. Introduction & Scope

This Privacy Policy explains how SheetConvert ("SheetConvert," "we," "us," or "our") collects, uses, discloses, and protects information when you use our document extraction platform (the "Service"). SheetConvert is operated from India. This policy is written to address, where applicable, obligations under India's Digital Personal Data Protection Act, 2023 ("DPDPA"), the EU General Data Protection Regulation and UK GDPR ("GDPR"), and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"). It applies regardless of where you access the Service from.

SheetConvert does not currently operate through a separately incorporated legal entity — in this policy, references to "SheetConvert" mean the individual(s) or team currently operating the Service.

2. Definitions

Different privacy laws use different terms for the same underlying concepts. In this policy:

  • "You" / "Data Principal" / "Data Subject" / "Consumer": the individual using the Service, whether described that way under the DPDPA, GDPR, or CCPA/CPRA respectively.
  • "SheetConvert" / "Data Fiduciary" / "Controller" / "Business": us, in our role deciding why and how personal data is processed.
  • "Personal Data" / "Personal Information": any information relating to an identified or identifiable individual.
  • "Subprocessor": a third-party service provider we use to help operate the Service, who processes personal data on our behalf under contractual terms.
  • "Document Data": the files you upload for extraction, and the structured fields, tables, and values our Service extracts from them.

3. Information We Collect

  • Account Data: your name, email address, and authentication identifiers, collected when you sign up (including via Google sign-in, if you choose that option) or sign in.
  • Workspace & Plan Data: your workspace name, team member roles, selected subscription plan, and credit usage. We do not currently collect or store payment card details — see Section 5 of our Terms of Service for how billing actually works today.
  • Document Data: the files you upload (e.g. PDFs, images) and the field/table values our Service extracts from them, which you define via your own extraction schema. If your documents contain personal information about third parties (e.g. an invoice containing a customer's name), we process that data on your behalf, and you are responsible for having a lawful basis to have us do so — see Section 6 of the Terms of Service.
  • Usage & Log Data: processing timestamps, extraction status, confidence scores, and basic technical logs (e.g. request timing) generated as the Service runs.
  • Cookies: a single, strictly-necessary authentication session cookie used to keep you signed in. We do not use advertising, tracking, or third-party analytics cookies — see Section 14.

4. How We Use Your Information & Legal Basis

We use the information above to:

  • Provide the Service — running extraction on your documents against your configured schema, and displaying the results to you;
  • Operate your account and workspace, including authentication, team membership, and plan/credit tracking;
  • Communicate with you about your account or the Service when necessary;
  • Maintain the security and integrity of the Service; and
  • Comply with legal obligations where applicable.

Where GDPR applies, our legal bases are: performance of a contract with you (running the Service you signed up for), our legitimate interests in operating and securing the Service, and, where required, your consent. Where DPDPA applies, we process personal data for the specified purpose of providing the Service you requested, consistent with the notice given at the point of collection.

5. AI Processing & Subprocessors

To operate the Service, we share relevant personal data with trusted third-party subprocessors acting on our behalf:

  • Google LLC (Gemini API): document content is sent to Google's Gemini API for AI extraction and structure analysis. Submitted document content is processed under Google's API terms and is not used to train Google's base AI models.
  • Supabase Inc.: hosts our application database, authentication system, and file storage using encrypted storage and Row-Level Security (RLS) policies to isolate each workspace's data.
  • Dodo Payments Inc.: acts as our Merchant of Record and payment gateway, handling subscription billing, card details, invoicing, and global tax compliance.

We do not use your Document Data to train models for other customers, and we do not sell your personal data or uploaded documents to anyone.

6. Disclosure of Information; No Sale

We do not sell or share (as those terms are defined under CCPA/CPRA) your personal information for cross-context behavioral advertising, and we do not run any advertising or analytics trackers on the Service. We disclose personal data only to: the subprocessors described in Section 5, who process it solely to provide the Service; a party acquiring all or substantially all of our business or assets (subject to this policy continuing to apply to previously collected data); and where required to comply with a valid legal process, protect our rights, or protect the safety of our users or the public.

7. International Data Transfers

Because we and our subprocessors operate across borders, your data may be processed outside the country where you are located, including outside India. Under the DPDPA, cross-border transfers are permitted except to countries restricted by the Government of India. Where GDPR/UK GDPR applies, we rely on the safeguards our subprocessors themselves provide for international transfers (such as standard contractual clauses); we do not separately maintain our own certified transfer mechanism at this time.

8. Data Retention & Deletion

We retain your account and Document Data for as long as your account is active. Uploaded documents and their extracted data are stored for up to 90 days and automatically deleted, or until you manually delete them from your dashboard at any time, which removes them and their extracted data immediately. To delete your entire account or workspace, contact us using the details in Section 15 and we will process the request within a reasonable time.

9. Data Security

Data in transit to and from the Service is encrypted using TLS. Our database and file storage provider encrypts data at rest, and row-level security policies restrict each workspace's data to members of that workspace. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We do not currently hold a formal third-party security certification (such as SOC 2 or ISO 27001) — if that changes, we will update this policy.

10. Your Privacy Rights

Depending on where you are located, you may have the right to:

  • Access the personal data we hold about you;
  • Correct inaccurate personal data;
  • Request erasure of your personal data (subject to Section 8, individual documents can be deleted immediately from your dashboard; account-level erasure is handled via request);
  • Receive a copy of your Document Data in a portable format — the Service already provides real, working CSV and JSON export for this purpose;
  • Object to or restrict certain processing, and, where processing is based on consent, withdraw that consent at any time;
  • Nominate another individual to exercise your rights in the event of death or incapacity (a right specific to the DPDPA); and
  • Lodge a complaint with the relevant supervisory authority — the Data Protection Board of India, your EU member state's data protection authority, the UK Information Commissioner's Office, or the California Privacy Protection Agency, as applicable to you.

To exercise any of these rights, contact us using the details in Section 15.

11. Grievance Redressal

If you have a grievance about how we handle your personal data, contact us at maulik1807@gmail.com and we will make good-faith efforts to respond within the time frames required by applicable law. As SheetConvert formalizes as a registered business, we will designate and publish a specific Grievance Officer contact here as required under the DPDPA.

12. Children's Privacy

The Service is not directed at, and is not intended for use by, anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Cookies & Tracking

We use a single strictly-necessary cookie to keep you signed in between requests. We do not use advertising cookies, third-party analytics scripts, or cross-site tracking of any kind on the Service today. If that changes, we will update this section and, where required, ask for your consent first.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date above when we do, and, for material changes, we will make reasonable efforts to notify you (e.g. via email or an in-app notice).

15. Contact Us

If you have any questions regarding this Privacy Policy or your data, contact us at maulik1807@gmail.com.