Contact Get started

Privacy policy

Template. Have a lawyer review it, fill in the bracketed fields, and keep it in sync with what the code actually does.

Last updated: [DATE]. Operator: [LEGAL ENTITY NAME, ADDRESS]. Contact: Contact@novabytelab.in.

Summary

Document contents are processed in memory and not stored by our servers. We store your account ID, credit balance and usage counts.

What the add-ons access

  • The spreadsheet you have open (spreadsheets.currentonly), to read the range you select and write results.
  • Files you pick in the Google file picker, or files the add-on creates (drive.file). We can't see anything else in your Drive.
  • Your Google account email and ID (openid, email), to identify your account and credit balance.
  • TimeSheet Sync only: events on calendars you own, read-only, for the date range you choose.
  • SlideSync only: presentations you pick or that the add-on creates.

What we send to our server and why

When you ask an add-on to read a PDF or translate text, the add-on sends that file or text to our server, which passes it to our AI provider and returns the result to your sheet. The file and text are held in memory for the duration of the request and are not written to our database or logs.

The overnight translation mode uses our AI provider's batch service, which holds the request until the job finishes (up to 48 hours) under the provider's terms. We store only the job name and your account ID.

What we store

  • Google account ID, email address and company domain.
  • Plan, credit balance and a ledger of credit changes (amount, type, time).
  • Usage counts and rate-limit counters.
  • For ContractSentinel: alert recipients who confirmed by email, unsubscribe records, your Slack/Chat webhook URLs (encrypted), and a daily health-check record (sheet name, link, owner and backup email, last check time).
  • If you add your own Gemini API key: the key, encrypted.
  • Feedback you choose to send us.
  • If you enable Workspace Studio events: the fields shown in the event (for example vendor and total), deleted after 24 hours.

Duplicate-invoice fingerprints are stored in a hidden tab inside your own spreadsheet, not on our servers.

AI provider

We use Google's Gemini models on paid terms (through Vertex AI or the paid Gemini API). Google does not use this data to train its models. On the paid Gemini API, Google keeps prompts and responses for up to 55 days solely to detect abuse; Vertex AI is used without data caching. If you choose to use your own Gemini API key, your agreement with Google applies to those requests instead, and you should use a paid-tier key (unpaid keys may be used for training and are not permitted for users in the EEA, UK or Switzerland).

Before a document is sent to the model, we may screen its text for content that tries to manipulate AI systems (prompt injection), using Google Cloud Model Armor or our own checks.

Google API Services User Data Policy

NovaByte Lab's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google user data for advertising, we don't sell it, and we don't use it to train AI models.

Payments

Paddle.com is our Merchant of Record and handles payment details. We receive your email, country, the plan you bought and a Paddle customer ID. We never see card numbers.

Retention and deletion

Account and ledger records are kept while your account is active and for [N] months afterwards for accounting. You can download your data or delete your account from the add-on's settings, or by emailing us. Deleting removes your email and every identifying field; credit ledger rows stay under a pseudonymous ID because they are accounting records. Uninstalling the add-on does not delete data in your own sheets.

Security incidents

If a breach affects your personal data, we will notify the relevant authority within 72 hours where the law requires it, and tell affected users without undue delay. Report vulnerabilities to Contact@novabytelab.in (see /.well-known/security.txt).

Subprocessors

See the subprocessor list.