Privacy Policy

Effective date: [[EFFECTIVE_DATE]]

This policy explains what personal data is processed when you use the website https://sheettailor.com and the SheetTailor application, and what is not.

Who is responsible

The controller of the personal data described in this policy is:

STOMAČKO DOO BEOGRAD
Borska 13B, 11000 Beograd (Rakovica), Serbia
Company registration number (matični broj): 21977659
Tax identification number (PIB): 114140816

Privacy requests: denis@stomacko.com
Phone: +381 64 157 6685

The short version

The spreadsheets you open are processed in your browser. They are not uploaded to us.
One exception: if you press the AI suggestion button, the first row of your sheet, the sheet name, the number of rows, counts per column, the output column names (which may come from the first row of a sample target file) and the sentence you typed are sent to our server and to our AI provider. The section "AI rule suggestions" lists exactly what is sent.
We do not use analytics, advertising or tracking cookies.
Your saved profiles are stored in your browser, not on our servers.
We process a small amount of personal data when you visit the site, contact us or buy a paid plan. This policy lists all of it below.

Your spreadsheets stay on your device

When you open a file in SheetTailor, it is read and processed by code running in your browser. The file's contents, the preview, the list of findings and the exported file are not sent to us or to anyone else.

The one exception is the optional AI suggestion described in the section "AI rule suggestions". If you press its button, the items listed there are sent to our server and to our AI provider. If they contain personal data, for example because the first row of your sheet holds a person's details instead of column names, we process that data as described in that section.

The loaded file, the preview and the findings exist only in the open browser tab and are gone when you close or reload it. The exported file is downloaded by your browser to your device, normally to your downloads folder. We never receive it.

Because your file is processed in your browser, we do not decide why or how the personal data that stays there is processed, and we do not act as a controller or a processor of that data. You, or the organisation you work for, remain responsible for it.

What is stored in your browser

SheetTailor uses your browser's local storage for five items:

Key	Contents
`sheettailor.profiles.v1`	the profiles you saved or imported: profile name and identifier, input column names and aliases and how they are matched, the input sheet name an imported profile may name, rules, value mappings, checks, parameters with their labels and default values, the names of the built-in reference lists the rules use, and output settings (sheet name, output columns, column widths and whether the first row is frozen)
`sheettailor.profileMeta.v1`	for each saved profile, its identifier and the date and time it was last saved
`sheettailor.resources.v1`	reference lists you imported for your rules (shown as resources in the application), such as a table of postcodes and places or a list of values: the list's name and its entries
`sheettailor.lastProfileId`	the identifier of the profile you last ran, so that it is listed first
`sheettailor.proKey.v1`	your Pro license key, if you entered it in the application or the confirmation page saved it after a purchase

This data stays on your device. It is not sent to us and we cannot read it. Values you type when you run a profile, such as parameters, are not stored.

One exception: when you ask for an AI suggestion, the names of the output columns in the profile you are editing, the names of the reference lists you imported (not their entries) and your license key are sent, as described in the section "AI rule suggestions".

Deleting a profile or a reference list in the application removes it. To remove all SheetTailor data, including the identifier of the profile you last ran, clear the site data for this website in your browser.

Profiles and reference lists are meant to hold rules and lookup values, not data about people. Please do not put personal data into them.

The SheetTailor application does not set cookies, and it does not load scripts, fonts or other content from other companies' servers.

Personal data we process

When	What	Why	Legal basis	How long
You visit the site	IP address, date and time, requested address, browser type	to deliver the site and keep it secure	our legitimate interest in running a secure website	as long as Cloudflare, our hosting provider, keeps them under its privacy policy; we do not keep these logs ourselves
You contact us	your email address or phone number, and what you tell us	to answer you and, if you ask for a refund, to arrange it with Paddle	our legitimate interest in answering requests; steps taken at your request before a contract; for refund requests, performance of a contract	up to 24 months after the last message
You buy a paid plan	your name and email address; your country and, where Paddle asks for them, your postcode or region; for a business purchase, the business name and tax number; the plan, the amount and the status of the order, and the license key issued to you	to provide the paid features and to keep our business records	performance of a contract; for our business records, our legal obligation under Serbian accounting law (for people covered by the GDPR: our legitimate interest in meeting that obligation)	for as long as your license key is valid, and afterwards for as long as Serbian accounting law requires us to keep the records that contain them, which is up to 10 years from the end of the financial year of the order
You make a complaint about a paid feature	your name, contact details, the order, your complaint and our answer	to handle the complaint and keep the record of complaints required by Serbian consumer law	our legal obligation under Serbian consumer protection law (for people covered by the GDPR: our legitimate interest in meeting that obligation)	2 years from the complaint

We receive the purchase details from Paddle, which collects them from you at checkout as a separate controller and passes them to us so that we can provide the paid features. We do not receive your card or bank details.

You are not required by law to give us personal data. Visit data is needed to show you the site. If you contact us, we need an email address or phone number to reply. Paddle asks for the details it needs to complete a purchase; without them you cannot buy a paid plan. You can use the free features without giving us any other personal data.

The one exception is the optional AI suggestion: if you use it, what is listed in "AI rule suggestions" is sent. If you do not use it, nothing from your sheet is sent and all other features work the same.

We do not make decisions about you by automated means, and we do not build profiles of visitors. We do not rely on your consent for any processing described in this policy.

AI rule suggestions

SheetTailor can suggest a draft profile using an AI model. This happens only when you press the button for it. Nothing is sent otherwise.

When you press it, the following is sent from your browser to our server, and from there to the AI provider:

the contents of the first row of the sheet you selected, which SheetTailor treats as column names;
the name of that sheet;
the number of rows below the first row;
for each column: how many cells are filled, how many are empty, how many different values there are, and how many are text, numbers or true/false values;
the names of the output columns in the profile editor, including any read from a sample target file;
the sentence you typed to describe the job;
your Pro license key, so that our server can check it and count the draft; the key is not passed on to the AI provider;
the names of the reference lists you imported into SheetTailor (their names only, not their entries), so that the suggestion can use them;
fixed technical information that is the same for every user: the profile format version and the names of the rules, checks and built-in reference lists SheetTailor supports.

Cells below the first row are not sent. Like any web request, this request also carries your IP address and browser details. Cloudflare records them in its logs, which it keeps as its privacy policy provides, to deliver the request and keep the service secure, on the basis of our legitimate interest in running a secure service. On the same basis, to limit how many requests one address can make, our server function keeps your IP address and the times of your requests from the last 24 hours in its memory; it does not write them anywhere. They are not passed on to the AI provider. So that we can provide what you bought, our server keeps a record per license key for as long as the key is valid: a one-way hash of the key (not the key itself), how many drafts the licence includes, how many are used in total and on the current day, and when the licence started and ends.

Please check three things before you use this feature. First, that the first row of your sheet really contains column names and not a row of data; if it contains data, that data would be sent. Second, that the sheet name, the output column names and the names of your imported reference lists contain no names or other personal data. Third, that the sentence you type contains no personal data.

The AI provider is Anthropic, PBC, a company in the United States. Anthropic processes the request on our behalf under its Commercial Terms and Data Processing Addendum. Under those terms, Anthropic may not train its models on this data. According to Anthropic's published retention policy, it deletes requests and responses within 30 days, unless it must keep them longer to enforce its usage policies or to comply with the law.

Our server passes the request on and returns the answer. It does not save the content of the request or the answer.

Legal basis: performance of our terms, because you asked for this feature. If what you send contains data about other people, the basis is our legitimate interest in providing the feature you asked for; we send the first row, names and counts, never the cells below the first row, to keep the effect on those people small.

Who receives personal data

Cloudflare, Inc. (United States) hosts the website and acts on our behalf. It receives the visit data listed in "Personal data we process".
Cloudflare also runs our server function for AI suggestions and stores the license records described there. It receives the request described in "AI rule suggestions" and the technical data that comes with it.
Anthropic, PBC (United States) is our AI provider and acts on our behalf. It receives what is listed in "AI rule suggestions".
Google (Google Workspace) hosts our support mailbox and acts on our behalf. It receives the messages you send us and our replies.
Resend (Plus Five Five, Inc., United States) sends the email with your license key after a purchase and acts on our behalf. It receives your email address and the content of that email, including the key.
Our accountant receives order details only where our accounting records must contain them.
Paddle is the reseller and Merchant of Record for our orders: Paddle.com Market Limited (United Kingdom), or for buyers in the United States Paddle.com Inc., and for buyers in Canada Paddle.com (Canada) Ltd. Paddle is a separate controller for the data it collects at checkout. It collects that data directly from you and sends us the order details listed in "Personal data we process". If you ask us for a refund, we send Paddle your request and your order details so that it can issue the refund.

Paddle's use of your data, including the cookies its checkout sets, is described in Paddle's privacy policy. The checkout is loaded from Paddle's servers only on pages where you can start a purchase.

We do not sell personal data. We disclose it to authorities only where the law requires it.

Transfers to other countries

We are established in Serbia. When you send us personal data yourself from the European Economic Area, for example when you visit the site or write to us, under the GDPR this is not a transfer to another country, but the GDPR still applies to how we process it. The order details we receive from Paddle are sent to us by Paddle, which is responsible for that transfer. When we pass personal data on to the providers listed below, that can be a transfer, and we explain below why it is allowed.

We send personal data to other countries only as follows. For each transfer we say why it is allowed under the GDPR and under Serbian law.

Cloudflare, Inc. processes the visit data in the United States and in other countries where it runs its network. Cloudflare is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has found an adequate level of protection (Implementing Decision (EU) 2023/1795); for processing in other countries, its data processing addendum contains the standard contractual clauses adopted by the European Commission. Serbian law treats as adequate the sectors for which the EU has found an adequate level of protection (Article 64(2) of the Law on Personal Data Protection).
Google stores the messages you send us in data centres in the European Union, the United States and other countries. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has found an adequate level of protection (Implementing Decision (EU) 2023/1795). Serbian law treats as adequate the countries that are party to Council of Europe Convention 108, which include all EU countries, and the sectors for which the EU has found an adequate level of protection (Article 64(2) of the Law on Personal Data Protection).
Resend sends the license key email from the United States or Ireland and keeps its records of it in the United States. Plus Five Five, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has found an adequate level of protection (Implementing Decision (EU) 2023/1795), and its data processing addendum contains the standard contractual clauses adopted by the European Commission. Serbian law treats as adequate the sectors for which the EU has found an adequate level of protection (Article 64(2) of the Law on Personal Data Protection).
If you ask us for a refund, we send your request and your order details to the Paddle company that sold you the plan. For Paddle.com Market Limited in the United Kingdom: the European Commission has found that the United Kingdom provides an adequate level of protection, and Serbian law treats the United Kingdom as adequate because it is a party to Council of Europe Convention 108. For Paddle.com (Canada) Ltd.: the European Commission has found that Canada provides an adequate level of protection for commercial organisations, and Serbian law treats as adequate the sectors for which the EU has found an adequate level of protection (Article 64(2) of the Law on Personal Data Protection). For Paddle.com Inc. in the United States: the transfer is necessary to carry out the refund you asked for (Article 49(1)(b) of the GDPR, where the GDPR applies, and Article 69(1)(2) of the Law on Personal Data Protection).
Cloudflare also processes AI suggestion requests and stores the license records in the same countries, on the same basis as the visit data.
Anthropic, PBC stores what is listed in "AI rule suggestions" in the United States. The AI model that answers the request may run in the United States or in another country where Anthropic operates. Anthropic is not certified under the EU-U.S. Data Privacy Framework. For data covered by the GDPR, the transfer is covered by the standard contractual clauses adopted by the European Commission, which are part of our contract with Anthropic. Under Serbian law, the data about you is transferred because this is necessary to provide the AI suggestion you ask for under our terms (Article 69(1)(2) of the Law on Personal Data Protection). That provision does not cover data about other people, which is one more reason not to send any.

Paddle's privacy policy describes its own transfers.

Your rights

You have the right to:

ask whether we process data about you and receive a copy of it;
have inaccurate data corrected;
have data erased, where the law allows;
have processing restricted;
receive data you gave us in a portable format, where processing is based on a contract.

Your right to object. Where we rely on our legitimate interest, as shown in this policy, you can object at any time on grounds relating to your particular situation. We will then stop processing that data unless we have compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend legal claims.

To use these rights, write to denis@stomacko.com. We answer without undue delay, at the latest within one month and in any case within 30 days. If a request is complex or we receive many, we may extend this by up to two further months, and in any case by no more than 60 days. If so, we will tell you why within the first period.

You can also complain to a supervisory authority. In Serbia this is the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti), Bulevar kralja Aleksandra 15, 11120 Beograd, www.poverenik.rs. If you live in the European Union, you can also complain to the data protection authority of your country.

Children

SheetTailor is a tool for work. It is not directed at children, and we do not knowingly collect data from anyone under 16.

Security

The website is served only over HTTPS. Because your files are processed on your device, they are not exposed to us or to our providers. We limit access to the personal data listed in "Personal data we process" to what is needed for the purposes stated there.

Our server function for AI suggestions is also served only over HTTPS. What you choose to send for an AI suggestion is the one exception to the statement above that your files are not exposed to us or to our providers.

Changes to this policy

If we change this policy, we will post the new version on this page with a new effective date. If a change affects how we handle data you have already given us, we will tell you before it takes effect where we have your contact details.

Language

This policy is available in English only.

Contact

denis@stomacko.com or +381 64 157 6685.