Privacy Policy

01Overview

APPS 365 LTD ("SheetForge", "we", "us") operates appmysheet.com and the SheetForge application platform. This Privacy Policy applies to all users of our website, platform, and related services.

We act as a data controller for personal data you provide directly (account information). Where you use SheetForge to process your own data, we act as a data processor on your behalf.

02Data Controller

The data controller responsible for your personal data is:

03Data We Collect

3.1 Account Data

• Full name and email address
• Password (stored as cryptographic hash — never plain text)
• Company name and job role (optional)
• Billing name and address (paid tiers)

3.2 Usage Data

• Log data: IP address, browser type, OS, referring URL
• Pages visited, features used, session duration
• Error logs and diagnostic information

3.3 Spreadsheet & Application Data

When you connect a data source, SheetForge reads your schema and caches data to generate your application. This data is encrypted at rest, never shared commercially, and deleted upon account closure.

3.4 Payment Data

Payment processing is handled by Stripe (PCI-DSS compliant). SheetForge does not store card numbers, CVV, or authentication data — only a Stripe token reference and billing metadata.

3.5 Communications

If you contact us via email or support, we retain that correspondence to assist you and improve our service.

04How We Use Your Data

05Legal Basis for Processing

• Contract: Processing necessary to deliver the service you've agreed to use.
• Legitimate Interests: Analytics, security, and fraud prevention, where these do not override your fundamental rights.
• Legal Obligation: Where required by applicable law (e.g., financial record-keeping).
• Consent: For optional marketing communications — you may withdraw at any time.

06Data Sharing

We do not sell your personal data. We share data only in the following circumstances:

6.1 Sub-Processors

• Supabase — Database and storage infrastructure
• Stripe — Payment processing (PCI-DSS Level 1)
• Vercel / AWS / Azure — Hosting and CDN
• Postmark / Resend — Transactional email delivery
• Sentry — Error monitoring (anonymised)

6.2 Microsoft 365 Integration

When you connect OneDrive, your data is processed under your Microsoft 365 tenancy. SheetForge accesses only files and permissions you explicitly authorise via Microsoft OAuth.

6.3 Legal Requirements

We may disclose personal data if required by law, court order, or a competent regulatory authority, and only to the minimum extent necessary.

6.4 Business Transfer

If APPS 365 LTD is acquired or transfers assets, personal data may be transferred. We will notify affected users in advance.

07Data Retention

• Account data: Duration of account plus 90 days after closure, then permanently deleted.
• Spreadsheet / app data: Deleted within 30 days of account closure or data source disconnection.
• Billing records: Retained 7 years under UK financial regulations.
• Log data: Retained 12 months for security purposes, then purged.
• Marketing consent records: Retained until withdrawal, plus 3 years for compliance evidence.

08Your Rights

To exercise any right, email privacy@appmysheet.com. We will respond within 30 days.

09Cookie Policy

We use cookies and similar technologies on appmysheet.com. Manage preferences via the banner on your first visit or via browser settings.

9.1 Essential Cookies

• sf_session — Authentication session token (expires on logout)
• sf_csrf — CSRF protection token (session)
• sf-cookie — Your cookie consent preference (1 year)

9.2 Analytics Cookies (with consent)

Used to understand platform usage. IP addresses are anonymised. We do not use Google Analytics and we do not track users across third-party websites.

9.3 Marketing Cookies (with consent)

Used only with explicit consent to measure campaign performance. No advertising retargeting is used on appmysheet.com.

10Security

• All data in transit encrypted via TLS 1.2 or higher
• Data at rest encrypted using AES-256
• Passwords hashed using bcrypt
• Production access restricted by role and requires multi-factor authentication
• Regular security reviews and dependency audits conducted

In the event of a data breach, we will notify affected users and the ICO within 72 hours as required by UK GDPR.

11International Data Transfers

APPS 365 LTD is a UK-registered company. Some sub-processors operate infrastructure in the US and EEA. Where personal data is transferred outside the UK or EEA, we ensure appropriate safeguards including Standard Contractual Clauses (SCCs) and UK International Data Transfer Agreements (IDTAs). Contact dpo@appmysheet.com for details on any specific transfer mechanism.

12Children's Privacy

SheetForge is not directed at children under 13. We do not knowingly collect personal data from children. Contact privacy@appmysheet.com immediately if you believe a child has provided data and we will delete it promptly.

13Changes to This Policy

We may update this Privacy Policy from time to time. For material changes we will email registered users, display a prominent notice on appmysheet.com for 30 days, and update the "Last updated" date. Continued use after notice constitutes acceptance.

14Contact & DPO

For any privacy-related queries, requests, or complaints: