Security & privacy#
Document contents are processed in memory and not stored by our servers. We store your account ID, credit balance and usage counts. This page explains what that means in practice. The legal version is our privacy policy.
What the add-ons can access#
The add-ons ask for the narrowest Google permissions that make each feature work:
| Permission | Why | Used by |
|---|---|---|
| The spreadsheet you have open | Read the range you choose and write results | All |
| Files you pick, or files the add-on creates | Read the PDFs you select; save PDFs, CSVs and decks | ParseSheet, BankStmt, ContractSentinel, TimeSheet, SlideSync |
| Your email address and account ID | Identify your account and credit balance | All |
| Events on calendars you own (read-only) | Find billable meetings | TimeSheet Sync |
| Presentations | Insert chart images; only asked for when you turn charts on | SlideSync |
| Run on a schedule | Daily renewal check, overnight translation, scheduled decks | ContractSentinel, LocaleSheet, SlideSync |
No add-on asks for access to your whole Google Drive, all your spreadsheets, or your email.
What happens to your files#
- You pick a file in the Google file picker.
- The add-on downloads it inside Google's own servers and sends it to our server over HTTPS.
- Our server passes it to the AI model, runs the checks and sends the results back to your sheet.
- The file is held in memory only for that request. It isn't written to our database or our logs.
Duplicate-invoice fingerprints are kept in a hidden tab inside your own spreadsheet, not on our servers.
What we store#
- Google account ID, email address and company domain
- Plan, credit balance and a ledger of credit changes
- Usage counts and rate-limit counters
- ContractSentinel: confirmed alert recipients, unsubscribes, Slack/Chat webhook URLs (encrypted) and the daily health check
- Your own Gemini key, if you add one (encrypted)
- Feedback you send us
AI and your data#
We use Google's Gemini models on paid terms, and we don't use your data to train AI models. Document text is treated strictly as data: if a PDF contains text trying to instruct the AI ("ignore your instructions…"), it's flagged and every value from that file is marked for review. Numbers on your sheet are also checked independently of the AI (math checks, balance checks, values matched against the PDF's own text).
Alerts and email#
ContractSentinel only emails you, colleagues on your company domain, and outside people who confirmed by clicking a link. Every alert has a one-click unsubscribe. Slack and Google Chat webhook URLs are stored encrypted on our server; your sheet only shows a masked label.
Shared spreadsheets#
Scheduled jobs (daily checks, overnight translations, scheduled decks) run under the account of the person who set them up. Their settings are stored with that person's account, so other editors of the sheet can't change what the job does. ContractSentinel shows who last changed its settings.
Export or delete your data#
In any add-on sidebar, open Earn credits & settings → Your data:
- Download my data saves a JSON file with your account, credit ledger and feedback.
- Delete account (type
DELETEto confirm) removes your email and every identifying field. Credit ledger rows remain under an anonymous ID because they're accounting records.
Uninstalling an add-on doesn't delete anything in your own spreadsheets.
Reporting a vulnerability#
Please email Contact@novabytelab.in with details and steps to reproduce. See our security.txt. We'll acknowledge reports quickly and keep you updated.