Privacy policy

Last updated: 6 October 2026

This policy explains what information Sheets processes, why, and what control you have. Sheets is published by 4Cs BV, Lindekensweg 3, 2160 Wommelgem, Belgium, company number BE 1014.832.509 ("we"), the controller of the personal data described here. Contact: [email protected].

Where Sheets runs

Sheets runs on our own server in the European Union. Your spreadsheets and settings are stored there.

Information we process

  • Your store: when a store manager clicks "Connect your store", the plugin sends the site's address, its REST API address, the store's name and currency, the WooCommerce and plugin versions, a read-only WooCommerce REST API key it creates for Sheets, and a secret of the site's own that signs the links between your WordPress admin and Sheets. We use the key only to read that store's data for its users.
  • Who opens Sheets: the name, e-mail address and WordPress user ID of the user who connects the store or opens Sheets, used to sign you in, apply sharing and send the reports you schedule.
  • Store data: orders (including the customer names, e-mail addresses and addresses on them), order lines, refunds, products, variations, customers, coupons and categories, read with the key through the WooCommerce REST API to compute formulas, pivots, charts, exports and scheduled reports. It is read when needed and kept at most in a short-lived cache (about a minute); it is not otherwise stored, except values a user deliberately writes into a spreadsheet.
  • Spreadsheets: their content, folders, sharing settings and version history.
  • Scheduled reports and alerts: recipients, subject, message, cadence and alert conditions; the report content is generated when it is sent and not kept afterwards.
  • AI assistant connections: which user approved a connection and what it may do (read only, or also edit spreadsheets).

How we use store data

Only to show your store's own data to the people your store lets in. We never share one store's data with another, never sell it, never use it for advertising or to train, fine-tune or improve AI models, and never pass it to third parties except those listed under "Who receives it". Sheets never writes to your store.

Who receives it

  • Our hosting in the EU, which stores Sheets' data.
  • The e-mail provider you choose for scheduled reports and alerts, and the recipients of each report.
  • Authorities, where the law requires it.

How long we keep it

Spreadsheets and settings stay until they are deleted in the app. Disconnecting the store (Plugins → Disconnect, Sheets' account settings, or deactivating or deleting the plugin) deletes the read-only key, and Sheets stops reading the store. Your spreadsheets are kept; to have them and your Sheets account deleted, write to us through the contact form or at [email protected].

Security

Traffic uses HTTPS wherever your store supports it, and we never log credentials or store data. The key Sheets uses can only read.

Why we process it

Only to provide Sheets: show and save spreadsheets, apply sharing and permissions, compute live data, export files, send the scheduled reports you configure and keep the service secure. We do not sell personal data, show advertising or build profiles.

Analytics on this website

The pages of this website (not the Sheets apps) use Google Analytics, provided by Google Ireland Limited, only after you click Accept in the bar shown on your first visit. It then sets the cookies _ga and _ga_X8X11J9M43 (up to two years) to count visits and see which pages are used. Google Analytics does not store IP addresses; Google may process the data outside the EU under the EU Standard Contractual Clauses. Nothing is loaded if you decline, if the page is shown inside another site, or if your browser asks not to be tracked (Do Not Track or Global Privacy Control). You can change your choice at any time with "Cookie settings" at the bottom of every page; declining deletes these cookies.

Your rights

Depending on where you live (for example under the GDPR, the CCPA or PIPEDA) you can ask for access to, correction or deletion of your personal data, object to processing or ask for a copy. Write to [email protected]. For data your organisation's administrator controls, we may refer you to them. You can also complain to your data protection authority (in Belgium: the Gegevensbeschermingsautoriteit / Autorité de protection des données).

Changes

We will update this page when the policy changes and change the date above.