Privacy Policy

Google user data accessed: your basic Google profile (email, name, profile picture); the contents of the Google Sheets created by Sheet Flow (website content such as menus, prices and settings, plus submissions from your website visitors such as orders or bookings, which may include their name, phone number or address); and the Apps Script project Sheet Flow creates in that Sheet, only if you choose the Apps Script connection. We do not access any other file in your Drive, your Gmail or any other Google data.

Your website data lives in the Google Sheet in your own Google Drive. You own it and can view, edit, download or delete it at any time in Google Sheets.

The Sheet Flow server only stores what the service needs:

• Account: Google email, name, profile picture, last sign-in time, role, and encrypted Google OAuth tokens.
• Website: name, description, URL, HTML design (a template without customer data), design versions, and your chat history with Sheety.
• Usage balance, payment and top-up records, counts of AI calls (without chat content), and activity logs of administrators and staff.
• Staff invited to co-manage a website (email, invitation status).

We do not keep a copy of your Sheet tables on our server: each time your website is shown, data is read directly from the Sheet and held only in a short in-memory cache (about 30 seconds). Your chat history with Sheety may contain a few values you or Sheety mention during the conversation; it is deleted together with the website.

Sheet Flow does not request access to your whole Drive or all of your Google Sheets. The Apps Script (if you choose it) only has access to the single Sheet that contains it (spreadsheets.currentonly).

Sheet Flow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide and improve the user-facing features you see in Sheet Flow: building and editing your website, showing its content to visitors, saving visitor submissions to your Sheet, and letting you manage orders.

• We do not sell Google user data.
• We do not use or transfer Google user data for advertising (including targeted, personalized or interest-based ads), to determine creditworthiness or for lending, or to data brokers or information resellers.
• We do not transfer Google user data to third parties except as necessary to provide the features (section 4), to comply with applicable law, or with your consent.
• Our staff do not read your data unless you give us permission (for example, a support request), it is needed for security purposes (such as investigating abuse), or it is required by law.

AI/ML: raw or derived Google user data (Sheet contents, scripts) is not used to develop, improve or train generalized AI/ML models, and is not transferred to any AI service that uses it to train models. Sheety sends only the data needed to answer your request to Anthropic's API; under Anthropic's commercial terms, data sent through the API is not used to train their models.

The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

• Anthropic (Claude) — AI processing: when you chat with Sheety or ask for a design, Sheet Flow sends the chat messages, website name and description, website settings, column names and a few sample rows of the Sheet's data tabs (which may include a few visitor submissions) so Sheety can understand the data and edit the right place. Anthropic processes this under its commercial API terms and does not use it to train models.
• Cloud file storage (S3-compatible) — images and files you upload for your website.
• Email provider — only if you turn on notifications: an email with the new visitor submission (including what the visitor entered) is sent to the address you choose. Staff invitations are also sent this way.
• Vercel — only when you click Deploy: your website template and its Google Sheet connection settings are deployed to a dedicated Vercel project in Sheet Flow's Vercel account. Deleting the website deletes that project.
• Google — Google Sheets, Google Drive and Google Apps Script, where your website data lives.
• VietQR (img.vietqr.io) — only if you enable "Show bank transfer QR": after a visitor places an order, their browser loads the QR image from img.vietqr.io; the image URL contains your bank code, account number and name, the amount and the transfer note.
• Google AdSense — the home page, guides, policies and some panels in the management pages show Google AdSense ads, which may use cookies as described in Google's advertising policies. Sheet Flow never sends any data from your Google Sheets, Drive or Apps Script to AdSense or advertisers, and never uses it to select ads. You can turn off personalized ads at adssettings.google.com.

• Google OAuth tokens, Apps Script connection secrets, private Service Account keys and Vercel tokens are encrypted at rest (AES-256-GCM).
• All connections use HTTPS. Sign-in sessions use httpOnly cookies.
• Access to production systems is limited to the Sheet Flow team members who operate the service.
• Data entered by visitors is sanitized before being written to your Sheet.
• If you arrive through a link with a source tag (for example the “Made with Sheet Flow” badge), we store that source name in a cookie for 30 days and record it with your account when you first sign up, only to know how people find Sheet Flow. It contains no personal data.

Data on the Sheet Flow server is kept while your account is active. You can delete any website in Sheet Flow: its design, versions, chat history, uploaded images and Vercel project are deleted immediately. This does not delete the Google Sheet and script in your Drive — you can delete them in Google Drive yourself.

To delete your account and related data on the Sheet Flow server, email contact@l2t-tech.com from your sign-in address. We delete your account, Google tokens and all related data from our servers within 30 days of confirming the request (keeping only top-up payment records for the period required by accounting law). You can also revoke Sheet Flow's access at any time at myaccount.google.com/permissions.

Privacy questions: contact@l2t-tech.com — L2T TECH COMPANY LIMITED, Quảng Trị, Vietnam.

Data controller:

• Tên đơn vị: Công ty TNHH L2T Tech
• Mã số thuế: 3200764664
• Địa chỉ: Quảng Trị
• Điện thoại hỗ trợ: 0365 764 664 (gọi hoặc chat Zalo)
• Email: contact@l2t-tech.com