Privacy policy

Last updated: 6 October 2026

This policy explains what information Sheets processes, why, and what control you have. Sheets is published by 4Cs BV, Lindekensweg 3, 2160 Wommelgem, Belgium, company number BE 1014.832.509 ("we"), the controller of the personal data described here. Contact: [email protected].

Where Sheets runs

Sheets runs on our own server in the European Union. Your spreadsheets and settings are stored there.

Information we process

  • Who signs in: your Asana user ID, name and e-mail address and the workspaces you belong to, which Asana passes along when you sign in with Asana, used to sign you in, apply sharing and send the reports you schedule.
  • Connection to Asana: when you sign in, Asana issues access and refresh tokens for your own user. We store them encrypted (AES-256) and use them only to read the workspaces you open in Sheets, as you. Every person reads with their own tokens, so nobody sees more in Sheets than they can see in Asana.
  • Asana data: tasks (with their subtasks, sections, tags, custom fields, assignees and dates), projects, sections, tags, the names and e-mail addresses of the people in your workspace, teams, portfolios, goals and time entries, read through Asana's API with read-only permissions to compute formulas, pivots, charts, exports and scheduled reports. It is read when needed and kept at most in a short-lived cache (about a minute); it is not otherwise stored, except values a user deliberately writes into a spreadsheet.
  • Spreadsheets: their content, folders, sharing settings and version history.
  • Scheduled reports and alerts: recipients, subject, message, cadence and alert conditions; the report content is generated when it is sent and not kept afterwards. They read Asana as the person who set them up.
  • AI assistant connections: which user approved a connection and what it may do (read only, or also edit spreadsheets). An assistant reads Asana as that user.

How we use Asana data

Only to show your workspace's data to the people your workspace lets in, each with their own view. We never share one workspace's data with another, never sell it, never use it for advertising or to train, fine-tune or improve AI models, and never pass it to third parties except those listed under "Who receives it". Sheets never writes to Asana.

Who receives it

  • Our hosting in the EU, which stores Sheets' data.
  • The e-mail provider you choose for scheduled reports and alerts, and the recipients of each report.
  • Authorities, where the law requires it.

How long we keep it

Spreadsheets and settings stay until they are deleted in the app. Disconnect (in Sheets' account settings) revokes your tokens with Asana and deletes them; removing the app in your Asana settings ends its access as well. Your spreadsheets are kept; to have them and your Sheets account deleted, write to us through the contact form or at [email protected].

Security

All traffic uses HTTPS, tokens are encrypted at rest, and we never log credentials or Asana data. Sheets asks Asana only for read permissions.

Why we process it

Only to provide Sheets: show and save spreadsheets, apply sharing and permissions, compute live data, export files, send the scheduled reports you configure and keep the service secure. We do not sell personal data, show advertising or build profiles.

Analytics on this website

The pages of this website (not the Sheets apps) use Google Analytics, provided by Google Ireland Limited, only after you click Accept in the bar shown on your first visit. It then sets the cookies _ga and _ga_X8X11J9M43 (up to two years) to count visits and see which pages are used. Google Analytics does not store IP addresses; Google may process the data outside the EU under the EU Standard Contractual Clauses. Nothing is loaded if you decline, if the page is shown inside another site, or if your browser asks not to be tracked (Do Not Track or Global Privacy Control). You can change your choice at any time with "Cookie settings" at the bottom of every page; declining deletes these cookies.

Your rights

Depending on where you live (for example under the GDPR, the CCPA or PIPEDA) you can ask for access to, correction or deletion of your personal data, object to processing or ask for a copy. Write to [email protected]. For data your organisation's administrator controls, we may refer you to them. You can also complain to your data protection authority (in Belgium: the Gegevensbeschermingsautoriteit / Autorité de protection des données).

Changes

We will update this page when the policy changes and change the date above.