Privacy notice
What we collect when you use holysheet, why, who else handles it, and your rights.
The short version
- We collect what we need to run your account: your name, email, workspace, and how many rows you use.
- The rows you send are used only to answer your questions. We don’t save them in our database or train models on them.
- We use essential cookies only, for signing in. No advertising or analytics trackers.
- We don’t sell your information.
- Email legal@getholysheet.com to see, correct or delete your information.
1. Who we are
holysheet is provided by holysheet, a sole trader business based in the United Kingdom. For your account and contact information, we are the controller: we decide how and why it’s used. Contact us about anything in this notice at legal@getholysheet.com.
The spreadsheet rows you send are different. For those, your organisation is the controller and we are its processor, acting on its instructions under our data processing agreement. If your information is in a spreadsheet someone else sent to holysheet, contact that organisation first; we’ll help them answer you.
2. What we collect
| Information | What it includes | Where it comes from |
|---|---|---|
| Account | Name, email address, sign-in method, and profile picture if your sign-in provider shares one. Email verification status. | You, or Google or Microsoft if you sign in with them |
| Workspace | Workspace name, members and their roles, pending invitations (the invitee’s email), and who created each API key. | You and your workspace admins |
| Usage | Answers used per workspace and per member each month, plan and limits, API key labels, the last four characters of each key, and when each key was last used. We store a one-way hash of each key, never the key itself. | Generated as you use the service |
| Security and technical | IP address, browser and device details, sign-in events and session identifiers. | Your browser, via our hosting and sign-in providers |
| Pilot requests and support | Name, email, your description of what you want to use holysheet for, and anything you write to us. | You |
| Billing (when paid plans open) | Billing contact, address, VAT number and payment history. Card details go straight to our payment provider; we never see them. | You |
Spreadsheet content. The questions and rows you send pass through our servers to an AI model to produce answers. We don’t save the row text or answers in our database, and our AI gateway is set not to log or cache them. The questions you set up, and any template you pick, are saved in your own browser so they’re there next time.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Creating and running your account and workspace, signing you in, applying plan limits, and providing the service | Contract, or legitimate interests where you use holysheet through your employer’s workspace (giving its members access) |
| Keeping the service and accounts secure, and preventing fraud and abuse | Legitimate interests (protecting you, other customers and the service) |
| Sending service emails: invitations, sign-in codes, security and account notices, changes to terms | Contract and legitimate interests |
| Answering pilot requests and support messages | Legitimate interests (responding to you) |
| Billing, tax and accounting records | Contract and legal obligation |
| Understanding usage in aggregate to improve holysheet | Legitimate interests (improving the product) |
We don’t send marketing emails without your permission, we don’t sell or rent personal information, and we don’t use it for advertising. You can object to any use based on legitimate interests; see section 7.
4. Who we share it with
We use a small number of providers to run holysheet. They process information only on our instructions and under contracts that protect it. The current list, with what each does and where, is on our subprocessors page. In short:
- Cloudflare hosts the site, the API and our database, and runs the AI model through its gateway.
- WorkOS handles sign-in, workspaces, memberships and invitation emails.
- TypeSafe AI provides the model that answers questions, and receives the questions and rows you send.
Fonts. Our pages load fonts from Fontshare (Indian Type Foundry) and Google Fonts. When they do, your browser sends those services your IP address and browser details, as it would for any web request.
Spreadsheet add-ins. If you use holysheet in Google Sheets or Excel, Google or Microsoft run the add-in under your own agreement with them. The Google Sheets add-in stores your API key in the spreadsheet’s document properties and keeps recent answers in Google’s document cache for up to six hours. The Excel add-in stores your API key in Office’s add-in storage on your device.
We may also share information if the law requires it, to protect rights and safety, with professional advisers under confidentiality, or with a company that takes over holysheet (see section 9).
5. International transfers
Our database runs in Cloudflare’s Western Europe region, and Cloudflare serves requests from the data centre nearest to you. WorkOS and Cloudflare are based in the United States, so some information is processed there. Where information leaves the UK or the European Economic Area, we rely on an adequacy decision (including the UK Extension to the EU–US Data Privacy Framework, where the provider is certified) or on the standard contractual clauses with the UK Addendum, as set out in each provider’s data processing terms. Contact us for details.
6. How long we keep it
| Information | How long |
|---|---|
| Row text and answers | Not stored by us. Held in memory only while your request runs. |
| Account, workspace and usage records | While the workspace is active, then deleted within 30 days of it closing or of your request |
| Your membership of someone else’s workspace | Until you leave or an admin removes you |
| Revoked API keys (hash, label, last four characters) | While the workspace exists, as an audit record |
| Pilot requests | Up to 12 months, or until you ask us to delete them |
| Billing and tax records | 6 years after the end of the financial year they relate to, as UK law requires |
| Security logs held by our providers | According to their standard retention, typically days to weeks |
7. Your rights
Under UK data protection law, you can ask us to:
- give you a copy of your personal information (access);
- correct information that’s wrong (rectification);
- delete it (erasure), where we don’t need to keep it;
- restrict how we use it, or object to our use of it based on legitimate interests;
- give you the information you provided in a machine-readable format (portability).
Email legal@getholysheet.com. We’ll reply within one month, and may need to confirm your identity first. You can change your workspace name, members and keys yourself in Account.
If you’re unhappy with how we’ve handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, or to the data protection authority where you live.
8. Cookies and browser storage
We only use cookies and storage that are strictly necessary for the service, so we don’t ask for consent and don’t show a cookie banner. There are no advertising or analytics cookies.
| Name | Purpose | Lasts |
|---|---|---|
hs_session | Keeps you signed in. Encrypted, and can’t be read by page scripts. | 30 days, or until you sign out |
hs_auth | Protects the sign-in process against forged requests. | 10 minutes |
| WorkOS cookies | Set on the sign-in page to manage your sign-in session and security. | See WorkOS |
hs-tasks, hs-template (local storage) | Remember the questions you set up in the workspace. | Until you clear your browser data |
hs-lite (browser storage) | Remembers that the home page animation should run in a lighter mode on your device. | This visit, or until you clear your browser data if your browser has no graphics acceleration |
If we ever add analytics or other non-essential cookies, we’ll ask for your consent first and update this notice.
9. Other things you should know
- Security. Connections are encrypted, API keys are stored only as one-way hashes, session cookies are encrypted, and access to production systems is restricted to us. No system is perfectly secure; if a breach puts your information at risk, we’ll tell you and the ICO as the law requires.
- Automated decisions. We don’t make decisions about you that have legal or similarly significant effects using automated processing. holysheet’s answers are produced automatically, but your organisation decides how to use them.
- Children. holysheet is for business use by people aged 18 or over.
- Business changes. If we set up a company to run holysheet, or the business is sold, your information would move to the new owner, who would have to keep honouring this notice. We’ll tell you if that happens.
- Changes to this notice. We’ll update the date above when we change it, and tell workspace admins by email about significant changes.