Privacy policy

Last updated: 6 October 2026

This policy explains what information Sheets processes, why, and what control you have. Sheets is published by 4Cs BV, Lindekensweg 3, 2160 Wommelgem, Belgium, company number BE 1014.832.509 ("we"), the controller of the personal data described here. Contact: [email protected].

Where Sheets runs

Sheets runs on servers of a hosting provider in the European Union. Your spreadsheets and settings are stored there.

Information we process

  • Who opens Sheets: the HubSpot user ID, name and e-mail address that HubSpot passes along when you open Sheets in HubSpot, used to sign you in, apply sharing and send the reports you schedule.
  • Connection to HubSpot: when a HubSpot account installs Sheets, HubSpot issues access and refresh tokens. We store them encrypted (AES-256), per HubSpot account, and use them only to read that account's CRM data for its users, and to write changes when they are turned on (see below).
  • HubSpot CRM data: contacts, companies, deals, tickets, line items, quotes, custom objects, owners and activities (calls, meetings, notes and tasks), with their properties and the links between them, read through HubSpot's API to compute formulas, pivots, charts, exports and scheduled reports. This includes personal data of the people in your CRM, such as names, e-mail addresses, phone numbers and other contact properties. It is read when needed and kept at most in a short-lived cache (about a minute); it is not otherwise stored, except values a user deliberately writes into a spreadsheet.
  • Spreadsheets: their content, folders, sharing settings and version history.
  • Scheduled reports and alerts: recipients, subject, message, cadence and alert conditions; the report content is generated when it is sent and not kept afterwards.
  • AI assistant connections: which user approved a connection and what it may do (read only, edit spreadsheets, or also change HubSpot data).

How we use HubSpot data

Only to show your account's own CRM data to the people your account lets in. We never share one HubSpot account's data with another, never sell it, never use it for advertising or to train, fine-tune or improve AI models, and never pass it to third parties except those listed under "Who receives it".

Changes to HubSpot data

Sheets is read only by default. It writes to HubSpot only when an admin turns on "Allow changes from Sheets" and grants HubSpot's write permissions separately, and only for HubSpot users who can manage apps (HubSpot's Integrations permission). Sheets then writes the values those users send, refuses read-only and calculated properties, and refuses a change to a record that was changed in HubSpot after the edit. HubSpot shows these changes as made by the app. An AI assistant can change HubSpot data only when the user who connected it allowed that.

Who receives it

  • Our hosting provider in the EU, which stores Sheets' data.
  • The e-mail provider you choose for scheduled reports and alerts, and the recipients of each report.
  • Authorities, where the law requires it.

How long we keep it

Spreadsheets and settings stay until they are deleted in the app. Uninstalling Sheets in HubSpot (Connected apps) ends its access at once. HubSpot does not tell apps when they are uninstalled, so Sheets notices when HubSpot refuses its tokens and then deletes them. Disconnecting in Sheets deletes the tokens as well. To have your Sheets account and its data deleted, write to [email protected].

Security

All traffic uses HTTPS, tokens are encrypted at rest, and we never log credentials or HubSpot data. Sheets asks HubSpot for no sensitive-data permissions.

Why we process it

Only to provide Sheets: show and save spreadsheets, apply sharing and permissions, compute live data, export files, send the scheduled reports you configure and keep the service secure. We do not sell personal data, show advertising or build profiles.

Analytics on this website

The pages of this website (not the Sheets apps) use Google Analytics, provided by Google Ireland Limited, only after you click Accept in the bar shown on your first visit. It then sets the cookies _ga and _ga_X8X11J9M43 (up to two years) to count visits and see which pages are used. Google Analytics does not store IP addresses; Google may process the data outside the EU under the EU Standard Contractual Clauses. Nothing is loaded if you decline, if the page is shown inside another site, or if your browser asks not to be tracked (Do Not Track or Global Privacy Control). You can change your choice at any time with "Cookie settings" at the bottom of every page; declining deletes these cookies.

Your rights

Depending on where you live (for example under the GDPR, the CCPA or PIPEDA) you can ask for access to, correction or deletion of your personal data, object to processing or ask for a copy. Write to [email protected]. For data your organisation's administrator controls, we may refer you to them. You can also complain to your data protection authority (in Belgium: the Gegevensbeschermingsautoriteit / Autorité de protection des données).

Changes

We will update this page when the policy changes and change the date above.