Privacy Policy

Last updated: October 2026

Fresh Sheets is a product of Virgo Analytics Ltd, which operates the service and is the data controller for the personal data described in this policy. This policy explains what data Fresh Sheets accesses through your Google account and the other accounts you connect, why, and what happens to it.

What Fresh Sheets does

Fresh Sheets is a Google Sheets add-on and a website, freshsheets.uk, that reads reporting data from Google Analytics 4, Google Ads, Google Search Console, Klaviyo, Shopify, Mailchimp, TikTok Ads, Meta Ads, Apple Ads and Microsoft Advertising, and writes it, on a schedule you set, into a Google Sheets spreadsheet you choose or ask it to create, into a Microsoft Excel workbook in your own OneDrive, or into your own BigQuery dataset. It never posts to, changes or deletes anything in the sources it reads from. Every connector Fresh Sheets ships is read-only, permanently. This is a design decision, not a current limitation.

Google API Services User Data Policy

Fresh Sheets's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. In practice, that means: Fresh Sheets only uses the data it accesses to provide the features you're using it for, which are your reports and, if you connect an AI tool, answering that tool's requests for your data. It does not sell your data, does not use it for advertising, and does not share it with any third party except where necessary to run the service itself (see "Sub-processors" below), or with an AI tool you connect, which receives what it asks Fresh Sheets for.

Fresh Sheets does not use any data it receives from Google APIs, including Google Workspace APIs, to develop, improve or train artificial intelligence or machine learning models.

The exact OAuth scopes Fresh Sheets requests, and why

From Google, Fresh Sheets asks for nine permissions in total, listed in full below, and never asks for anything beyond them. When you add Fresh Sheets from the Google Workspace Marketplace, Google asks you to authorize all of them on one consent screen. The first time you connect your Google account, in Google Sheets or on freshsheets.uk, Google shows a consent screen for the permissions connecting uses, and this is what lets Fresh Sheets refresh your reports while you are away. Signing in to your Fresh Sheets account on the web asks only for permissions already listed here. That is true of signing in with Google. Signing in with Microsoft asks Microsoft for openid, email and profile, as described below. If you connect a Microsoft account for Excel, Fresh Sheets asks Microsoft for three more, listed under "Connecting Microsoft for Excel" below.

When you add Fresh Sheets to a spreadsheet

These are the permissions you authorize when you install Fresh Sheets. Only the two Google Sheets permissions are used by the add-on inside your spreadsheet; the reporting permissions are used by Fresh Sheets after you connect your Google account, in Google Sheets or on freshsheets.uk, as the next section explains.

When you connect your Google account

From Google Sheets, connecting opens in a new browser tab; on freshsheets.uk, it starts from your account. The first time you connect, Google shows its own consent screen for the permissions below, and this is where Fresh Sheets is given access it keeps, so it can refresh your reports on schedule while you are away. When you connect again afterwards, from another spreadsheet, another browser or the website, Fresh Sheets uses the access it already has, and Google's consent screen is not normally shown again. On freshsheets.uk you connect the Google account you signed in to Fresh Sheets with; if you choose a different Google account, it is refused and nothing is saved.

What Fresh Sheets does inside the spreadsheet you connect. Each report that writes to the spreadsheet has a tab of its own: either a new tab Fresh Sheets creates, or an existing tab you point the report at. When you choose an existing tab for a report in the report builder and Fresh Sheets finds something in it, you are asked to confirm before the report is saved. On every refresh, everything in a report's tab is replaced with the new figures. Apart from creating a report's tab, nothing else in the spreadsheet is changed. If you ask Fresh Sheets to create a new spreadsheet for a report, it creates it at the top level of your Google Drive, with one tab for that report. To do this, Fresh Sheets reads:

• the spreadsheet's title, and the name and size of each tab;
• when you choose or change a report's tab, the first 200 rows and 26 columns (A1 to Z200) of every tab, only to tell whether a tab already has something in it. Nothing read this way is stored;
• if a report takes its date range from cells, the values of those cells each time the report runs or is previewed.

Fresh Sheets never requests broader Google Drive access, such as drive or drive.readonly. It only ever requests drive.file, scoped to the spreadsheets you choose through Google's file picker and the ones it creates for you.

Signing in to your Fresh Sheets account on the web uses the same openid and email permissions listed above and asks for nothing further. You can also sign in with a work or school Microsoft account. Fresh Sheets asks Microsoft for openid, email and profile, which confirm who you are and give no access to your files or data. We keep your account's object ID, your organisation's tenant ID and when you first and last signed in, plus your email address only when your organisation has verified it.

Connecting a source that uses an API key

Not every source Fresh Sheets reads is a Google one. Klaviyo is connected by creating a private API key in Klaviyo and pasting it into the Sources page in your Fresh Sheets account, rather than through a Google consent screen. There is no Google permission involved, and nothing about this changes what Fresh Sheets can reach in your Google account.

You choose what the key can do when you create it in Klaviyo. Fresh Sheets asks for read access to accounts, campaigns, flows and metrics, and checks the key against Klaviyo before saving it: if the key does not work, or cannot read all four of those, it is refused and nothing is stored. After that, the key is used when you are choosing which Klaviyo account a report reads from, when you pick the event that counts as a conversion, when you preview a report, each time one of your reports refreshes, and when an AI tool you connected lists your sources or asks for your Klaviyo data. It is not used at any other time.

Fresh Sheets only ever reads from Klaviyo. It never creates, edits, sends or deletes a campaign, a list, a profile or anything else in your Klaviyo account.

Fresh Sheets does not sell what it reads from Klaviyo, does not use it for advertising, and does not use it to develop, improve or train artificial intelligence or machine learning models.

You can replace the key or remove it at any time on the Sources page. Removing it stops the reports that read through it, and leaves everything they have already written into your spreadsheets as it is. Removing it here does not delete the key inside Klaviyo, which is yours to delete there.

Shopify is connected with app credentials rather than a key. The store owner, or a member of staff allowed to develop apps, creates an app for the store in Shopify's Dev Dashboard with the access scopes read_orders and read_all_orders, installs it on the store, and pastes the store's myshopify.com address and the app's client ID and client secret into the Sources page. Fresh Sheets checks them against Shopify before saving them: if Shopify will not give access with them, or the app cannot read orders from any date, they are refused and nothing is stored. Each time they are used, which is that check, when you are choosing the store a report reads from, when you preview a report, each time one of your reports refreshes, and when an AI tool you connected lists your sources or asks for your Shopify data, Fresh Sheets exchanges them with Shopify for an access token that lasts 24 hours, uses it for that check, choice, preview, refresh or request, and does not keep it.

From Shopify, Fresh Sheets reads your store's name, time zone and currency, and your orders: when each was placed, its order number, the sales channel it came through, its payment and fulfilment status, whether it was cancelled, its amounts, and the products, variants, SKUs, vendors and quantities on it. It never asks Shopify for a customer's name, email address, postal address or phone number. It never creates, edits or deletes an order, a product or anything else in your Shopify store.

Fresh Sheets does not sell what it reads from Shopify, does not use it for advertising, and does not use it to develop, improve or train artificial intelligence or machine learning models.

You can replace the app credentials or remove them at any time on the Sources page. Removing them stops the reports that read through them, and leaves everything they have already written into your spreadsheets as it is. Removing them here does not uninstall the app from your store, which is yours to uninstall there.

Mailchimp is connected with an API key you create in Mailchimp, under your profile, then Extras, then API keys, and paste into the Sources page. Mailchimp does not offer read-only API keys: a key can do anything through Mailchimp's API that the user who created it is allowed to do, which can include sending campaigns and changing audiences. Fresh Sheets checks the key against Mailchimp before saving it: if Mailchimp will not accept it, or it cannot read your campaign reports, it is refused and nothing is stored. After that, the key is used when you build or open a Mailchimp report in the report builder, to show which Mailchimp account it reads from and to preview the report, each time one of your reports refreshes, and when an AI tool you connected lists your sources or asks for your Mailchimp data. It is not used at any other time.

From Mailchimp, Fresh Sheets asks only for your account's name, identifier and time zone, and, for each campaign sent in the date range of a report, or of a request from an AI tool you connected, the fields it uses from: its identifier, title, subject line, send time, type and the name of the audience it went to, and its counts of emails sent, opens, clicks, bounces, unsubscribes, spam complaints and forwards, and its open and click rates. It never asks Mailchimp for your subscribers' names or email addresses. It only ever reads from Mailchimp, and never sends a campaign, changes an audience or edits anything else in your Mailchimp account.

Fresh Sheets does not sell what it reads from Mailchimp, does not use it for advertising, and does not use it to develop, improve or train artificial intelligence or machine learning models.

You can replace the key or remove it at any time on the Sources page. Removing it stops the reports that read through it, and leaves everything they have already written into your spreadsheets as it is. Removing it here does not delete the key inside Mailchimp, which is yours to delete there.

Connecting a source by signing in with it

TikTok Ads is connected by signing in on TikTok's own page, which you open from the Sources page, and choosing there which of your ad accounts Fresh Sheets can read. There is no key to create or paste, and no Google permission is involved. The app Fresh Sheets signs in with asks TikTok for ad account information and reporting only. TikTok then gives Fresh Sheets access that lasts until it is ended, which is stored encrypted, the same way as your Google refresh token, and used when you connect, to read your ad account names, when you are choosing which ad account a report reads from, when you preview a report, each time one of your reports refreshes, and when an AI tool you connected lists your sources or asks for data from TikTok. It is also sent back to TikTok when you remove the connection or delete your account, to end the access. It is not used at any other time.

From TikTok, Fresh Sheets reads which ad accounts you chose, by name and identifier, and, for each report, or each request from an AI tool you connected, only the fields it uses: the day, the ad account, campaign, ad group and ad each row belongs to, the account's currency, and impressions, clicks, reach, conversions, spend, cost per click, cost per thousand impressions and cost per conversion. It only ever reads from TikTok, and never creates, edits or pauses a campaign, an ad group or an ad.

Fresh Sheets does not sell what it reads from TikTok, does not use it for advertising, and does not use it to develop, improve or train artificial intelligence or machine learning models.

You can remove the connection at any time on the Sources page. Removing it asks TikTok to end Fresh Sheets' access, stops the reports that read through it, and leaves everything they have already written into your spreadsheets as it is. You can also end it in your TikTok for Business settings. Deleting your Fresh Sheets account sends TikTok the same request.

Meta Ads is connected by signing in with Facebook on Meta's own page, which you open from the Sources page. There is no key to create or paste, and no Google permission is involved. Fresh Sheets asks Meta for one permission, ads_read, which lets it read your ads reporting. Meta then gives Fresh Sheets access, which is stored encrypted, the same way as your Google refresh token, with the time it ends where Meta gives one. It is used when you connect, to read the names of your ad accounts, when you are choosing which ad account a report reads from, when you preview a report, each time one of your reports refreshes, and when an AI tool you connected lists your sources or asks for your Meta Ads data. It is also sent back to Meta when you remove the connection or delete your account, to end the access. It is not used at any other time. Meta's access has no fixed end date. It lasts until you remove it on the Sources page, or until Meta ends it, for example if you change your Facebook password or for security reasons (Meta for Developers). If that happens, your Meta reports stop at their next run and, if any are scheduled, we email you. Choose Reconnect Meta on the Sources page with the same Facebook account and they start again.

From Meta, Fresh Sheets reads the ad accounts your Facebook account can reach, by name and identifier, and, for each report, or each request from an AI tool you connected, only the fields it uses: the day, the ad account, campaign, ad set and ad each report row belongs to, the account's currency, and impressions, reach, frequency, clicks, amount spent, cost per click and cost per thousand impressions. It only ever reads from Meta, and never creates, edits or pauses a campaign, an ad set or an ad.

Fresh Sheets does not sell what it reads from Meta, does not use it for advertising, and does not use it to develop, improve or train artificial intelligence or machine learning models.

You can remove the connection at any time on the Sources page. Removing it asks Meta to end Fresh Sheets' access, stops the reports that read through it, and leaves everything they have already written into your spreadsheets as it is. Deleting your Fresh Sheets account sends Meta the same request.

Apple Ads

When you sign in with Apple, Apple gives Fresh Sheets two tokens: one that reads your Apple Ads data, and one that renews it. We store both encrypted, with the names of the ad accounts your Apple account reaches. We use them to list your ad accounts and campaigns, show previews while you build a report, run your reports, and answer requests from an AI tool you connect.

Fresh Sheets does not sell what it reads from Apple Ads, does not use it for advertising, and does not use it to develop, improve or train artificial intelligence or machine learning models.

Removing Apple Ads in Fresh Sheets deletes both tokens straight away. Apple documents no way for us to end the access at their end, so to do that too, use Revoke Access in Apple Ads.

Connecting Microsoft Advertising

When you connect Microsoft Advertising, Microsoft asks you to grant Fresh Sheets its advertising permission (msads.manage). That permission allows changes as well as reading. Our code only uses it to list the advertising accounts you can see and to request reports for the ones you choose, or that an AI tool you connected asks for. We store the access and refresh tokens Microsoft returns, encrypted; a label for the connection naming up to two of your accounts and how many others there are; and, on each report, its account's ID, name and number.

Fresh Sheets does not sell what it reads from Microsoft Advertising, does not use it for advertising, and does not use it to develop, improve or train artificial intelligence or machine learning models.

Choosing Remove on Sources deletes both tokens. Microsoft isn't told. To remove Fresh Sheets from your Microsoft account too, go to account.live.com/consent/Manage for a personal account. For a work account, use myapps.microsoft.com, or ask your administrator to remove it in Microsoft Entra. Removing it at Microsoft may also end Fresh Sheets' Excel connection for that account. Microsoft Advertising is where your data already is. It isn't a sub-processor of ours.

Connecting Microsoft for Excel

You can send a report to a Microsoft Excel workbook in your own OneDrive. To do that, you connect a Microsoft account, on the Destinations page or from the report builder, by signing in on Microsoft's own page. Only work or school Microsoft accounts can be connected, not personal ones. An organisation may require its administrator to approve Fresh Sheets before anyone there can connect.

While you choose where a report goes, Fresh Sheets reads the names of the files and folders in the OneDrive folders you open or search, and shows you only folders and Excel workbooks, and it reads the names of a workbook's worksheets. When you choose an existing worksheet, it reads how many rows and columns hold values, and, if only one cell does, that cell's value, only to tell whether it already has something in it; if it does, you are asked to confirm before the report is saved. It never opens a file someone has shared with you, or a file in a SharePoint team site or Teams library.

Each report that writes to a workbook has a worksheet of its own: a new worksheet Fresh Sheets adds, or an existing one you choose. On every refresh, Fresh Sheets reads everything in that worksheet, replaces all of it with the new figures, and, where Excel allows, sizes its columns to fit. Apart from adding the report's worksheet, nothing else in the workbook is changed. If you ask Fresh Sheets to create a new workbook, it creates it in My files in your OneDrive, with one worksheet for that report, and never replaces a file that already has that name.

The access Microsoft gives Fresh Sheets is stored encrypted, the same way as your Google refresh token, with a short-lived access token, also encrypted, kept between refreshes. It is used once when you connect, to read which account you connected; when you choose or save a report's workbook; and each time a report that writes to a workbook refreshes. It is not used at any other time.

Fresh Sheets does not sell anything it reads from your Microsoft account, does not use it for advertising, and does not use it to develop, improve or train artificial intelligence or machine learning models.

You can remove the connection at any time on the Destinations page. Removing it deletes the access Fresh Sheets stored and stops it writing to the workbooks it reached; a report that also writes to a spreadsheet keeps refreshing that. Your workbooks, and everything already written in them, stay as they are. Nothing is sent to Microsoft when you remove it. To end Fresh Sheets' access on Microsoft's side too, go to myapps.microsoft.com, open the menu on Fresh Sheets, choose Manage your application, then Revoke consent. If Fresh Sheets isn't listed there, ask your organisation's Microsoft administrator to remove it.

Connecting an AI tool

On a plan that includes it, you can connect an AI tool, such as Claude, to your Fresh Sheets account. An AI tool is a third party, not part of Fresh Sheets.

Before an AI tool connects, Fresh Sheets shows you which of your accounts it will be able to read and asks you to confirm. By confirming, you direct Fresh Sheets to share data from those accounts, and from accounts you connect later on a source AI tools can read, with that tool, and you authorise that transfer. The tool receives what it asks Fresh Sheets for. Its own terms and privacy policy cover that data, not this policy.

Fresh Sheets keeps a record of each confirmation, and a log of each request for data that reached a source, with the account it read. Neither holds your figures. To stop a tool, remove it on the Destinations page.

What Fresh Sheets stores, and what it doesn't

Fresh Sheets stores:

• Your Google account identity (a stable account identifier, your email address, and when it was first and last used). If you sign in with Microsoft: your account's object ID, your organisation's tenant ID, your verified email address, and when you first and last signed in.
• An encrypted copy of your OAuth refresh token, so Fresh Sheets can access your data on your behalf without asking you to sign in every time. This is encrypted at rest; the encryption key is never stored in the same place as the data it protects.
• If you connect a source that uses an API key or app credentials rather than a Google sign-in, an encrypted copy of what you paste in, and the name and identifier of the account or store it belongs to, which we read back from that source when you save it. What you paste in is encrypted the same way as the token above, and it is never shown back to you, written into a link, or included in an email. You can replace or remove it at any time on the Sources page.
• If you connect TikTok, an encrypted copy of the access TikTok gives Fresh Sheets when you sign in, the names of the ad accounts it reaches, which we read back from TikTok then, and which permissions TikTok reports you granted, apart from any permission number too long to store exactly. You can remove it at any time on the Sources page.
• If you connect Meta, an encrypted copy of the access Meta gives Fresh Sheets when you sign in, when that access ends where Meta gives a time, and the names of the ad accounts it reaches, which we read back from Meta then. You can remove it at any time on the Sources page.

• Apple Ads: two encrypted tokens and the names of the ad accounts your Apple account reaches. Removing Apple Ads deletes the tokens.

• If you connect Microsoft Advertising: two encrypted tokens, a label naming up to two of your accounts, and on each report its account's ID, name and number.

• Which permissions Google reports you granted when you connected, and a short-lived access token, also encrypted, kept between refreshes so Fresh Sheets does not have to ask Google for a new one every time. The access token is cleared when you disconnect.
• The report configurations you build: each report's name, and the fields, date range, filters (including the values you enter in them) and schedule you've chosen for it, and, where the source offers a choice, which kind of report it is and which Klaviyo event counts as a conversion, and whether a report is paused because your plan runs fewer scheduled reports, with when we told you so.
• A log of when each report ran and whether it succeeded, of each request for data an AI tool you connected sent to a source and the account it read, and of each AI tool request our usage limits refused, for troubleshooting.
• A record of each time you allowed an AI tool to connect: when, the accounts you were shown and which version of the wording you saw, as proof of what you agreed to. Deleted with your account.
• If you send reports to BigQuery, the datasets you've added (their project, name and location), your account's freshsheets label value, which table each report writes to with its column names and types, and whether each write worked, how many rows it sent, and any error text.
• For each report, the title of the spreadsheet it writes to, the name of its tab, and the name of the Google Analytics property, Google Ads account, Search Console site, Klaviyo account, Shopify store, Mailchimp account, TikTok ad account, Meta ad account, Apple Ads account or Microsoft Advertising account it reads from, so your reports can be listed and labelled without asking the source each time.
• A record that lets the sidebar recognise your connection when you reopen it: a one-way fingerprint of the credential kept in your browser, when it was created and last used, and when it expires. It is deleted when you disconnect.
• When the sidebar is opened in a spreadsheet: a one-way fingerprint of that spreadsheet's ID, and when it was first and last opened. If people with Fresh Sheets accounts use the sidebar there, the record is linked to one of their accounts. We use it to count how many installs reach a working report. It holds no name, email address or report content, but it can be matched to a spreadsheet one of your reports writes to. How long this is kept after you delete your account is on the Data deletion page.
• For each report, when we last emailed you about it failing, and for your account, when we last told you that you had reached your plan's allowance or were on course to, and which plan that was, and, until it clears, that we told you your scheduled reports could not refresh because Google stopped accepting access to your Google account, another account you connected stopped accepting Fresh Sheets' access, Microsoft stopped accepting access to the Microsoft account a workbook is written through, or a Google usage limit was holding them back, with which connection or Google Analytics property it was about, so the same alert is not sent twice.
• For your account, when your 30 days of free Plus started and when they end, whether a paid plan has started and ended them, which scheduled report you chose to keep running on the Free plan, and which reminders about the end of your free Plus we have already sent, so none is sent twice.
• Whether you asked for product news by email: each time you answer the question, or skip it in the sidebar, what you chose, where, which version of the wording you saw, and when.
• A daily count of how many times you started a report by hand, for the fair use limit on manual refreshes.
• Whether your account's creation still needs to be reported to Google Analytics, so it is reported at most once.
• When you first saw a preview of your own data in the report builder, whether you have finished the setup steps on Home, and whether we have sent you the reminder to connect a source, so it is sent once.
• If you created your account on freshsheets.uk, whether you had allowed advertising cookies at that moment. It is deleted with your account.
• Where your account came from, if you created it on freshsheets.uk after following a link that carries campaign details, such as one of our ads: the source, medium, campaign, keyword and content tags in that link's address, and Microsoft's or Google's ad click identifier. They reach your account in the page address and through the sign-in, not in a cookie or your browser's storage, so they are saved whatever you chose about cookies. We keep them, on the basis of our legitimate interest in knowing which of our ads and keywords lead to accounts and paid plans, and use them only for that. The copy saved on your account is not sent to anyone, and it is deleted with your account.
• Counts of the report previews you've run, by minute and by day (UTC), per account and per Klaviyo connection, the time of your last Klaviyo preview, and how many requests your connected AI tools made in each hour (UTC), to apply those limits. Older counts are removed the next time you preview or an AI tool makes a request, and all of it is deleted with your account.
• A single-use sign-in code for the report builder in your spreadsheet, stored scrambled. It stops working after two minutes.
• When an account deletion goes ahead, a record that the deletion ran: the account's internal identifier, when the deletion ran, and the outcome of each step, as a record of whether the deletion was carried out. It holds no email address and nothing about your reports. How long this is kept after you delete your account is on the Data deletion page.
• Your billing records: a reference to your customer record at Stripe, your subscription status, and a record of each billing event Stripe sends us, cut down to identifiers and status. Your name, email address, postal address and card details are not kept in it. How long this is kept after you delete your account is on the Data deletion page.
• If you subscribe to a paid plan, which version of our Terms of Service you accepted at checkout, and when.
• If you joined the waitlist before the product opened: the email address you gave, and the company name and message you chose to add.
• A cached list of the fields your Google Analytics property offers, so the field picker does not have to ask Google every time you open it. Each Google Analytics property defines its own custom dimensions and metrics, so this list can only come from your property. There is no background job fetching it. The copy is replaced when it is more than a day old and you next open the field picker, so a list you have not opened for a while can be considerably older than a day. If Google cannot be reached at that moment, we keep using the copy we already have rather than showing you an empty picker. One consequence worth knowing: a dimension or metric you have just created in Google Analytics may not appear straight away, and the refresh button in the field picker fetches it immediately. The list holds field names, descriptions and categories as Google supplies them, and none of your figures. It is deleted when you disconnect that Google account. This is set out in more detail on the data deletion page.
• A cached list of the events your Klaviyo account records, so the conversion metric picker does not have to ask Klaviyo every time you open a report. Klaviyo counts a conversion against an event you choose, and every Klaviyo account defines its own events, so this list can only come from your account. There is no background job fetching it. The copy is replaced when it is more than a day old and you next open a Klaviyo report, and if Klaviyo cannot be reached at that moment we keep using the copy we already have rather than showing you an empty picker, and tell you the list may be out of date. It holds Klaviyo's own identifier for each event, its name and which integration records it, as Klaviyo supplies them, and none of your figures. It is deleted when you remove or replace that Klaviyo key, and when your account is deleted. This is set out in more detail on the data deletion page.

• If you connect Microsoft for Excel, an encrypted copy of the access Microsoft gives Fresh Sheets when you sign in and a short-lived access token, also encrypted; the address and identifier of the Microsoft account, read from Microsoft then; and which permissions Microsoft reported you granted. You can remove it at any time on the Destinations page.
• If you send reports to an Excel workbook, for each report the workbook and worksheet it writes to, by Microsoft's identifiers and by name, the workbook's web address, the Microsoft connection and account it was chosen under, and whether each write worked, how many rows it wrote, and any error text.

Fresh Sheets does not store the marketing data it retrieves from Google Analytics, Google Ads, Search Console, Klaviyo, Shopify, Mailchimp, TikTok, Meta, Apple Ads or Microsoft Advertising. That data is read from the account you connected and written directly into your spreadsheet, your Excel workbook, your BigQuery dataset, or more than one of them, on each refresh; it isn't kept in Fresh Sheets's own systems afterward.

In a dataset you share with us, Fresh Sheets creates and writes only tables it labels as its own, plus a temporary table that is deleted after each write. It never reads the contents of any other table, or changes or deletes one; to check a table is its own, it looks only at the table's labels. The BigQuery Data Editor role you give it would allow more; our code doesn't use it.

If we open your account's reports, connections or run history in our support tools to answer a question or fix a problem, we record that we did, and when. That record is kept for 90 days and is deleted with your account.

When a sign-in comes back from Google or Microsoft with an error, or fails as we finish it, we record when it happened, which provider it was, the stage it stopped at, the error if it is one on our fixed list or a numeric Microsoft sign-in code, and whether the sign-in appears to have started on our page. That record holds nothing that identifies a person and is deleted after 90 days.

How your data is protected

All data in transit is encrypted (HTTPS). Your OAuth refresh token is encrypted at rest using a separate encryption key that's never stored alongside the data it protects. Access to production systems and data is limited to the developer.

Where your data is processed

The database is hosted by Neon on Amazon Web Services in the London region (eu-west-2). The application runs on Vercel, and the functions for this project execute in London.

That is not the whole picture, so here is the rest of it. Neon, Vercel, Stripe, Resend and Google are all part of groups headquartered in the United States, and so is Microsoft, where your Excel workbooks are kept if you send reports to them. United States law can reach a company wherever its servers happen to be, so choosing London infrastructure reduces how far your data travels but does not put it beyond that reach. This is true of nearly every product built the way this one is, and you should be able to weigh it rather than find it out later.

Cookies and tracking

The banner. The first time you visit freshsheets.uk, whether you arrive on the public site or in your account, you are asked whether to allow cookies for two purposes: analytics, which is Google Analytics, and advertising, which is Microsoft Advertising. You can accept both, reject both, or choose each one. Nothing is stored for either until you answer, apart from the marker described under "Excluding our own traffic" below. Your answer is remembered so you are not asked again, and you can change it at any time with the Cookie settings link in the footer of the public site or on the Settings page of your account. If you accepted analytics cookies before we asked about advertising, you are asked once more.

What is set if you accept.

The Google Analytics rows are set only if you allow analytics, and the Microsoft rows only if you allow advertising.

What is set if you reject. On the marketing site, no cookies at all. The only thing stored is fs-consent, recording the rejection.

Customer visits. If you have accepted and are signed in, requests to Google Analytics also carry your Fresh Sheets account's internal identifier, a random code that is not your email address, so we can tell which visits came from customers. If you reject, it is not sent. How long Google Analytics keeps it is on the Data deletion page.

Excluding our own traffic. Our team's browsers hold fs-internal in local storage, which marks our own visits so they are left out of the figures. It is set by opening a page of this site through a link we use ourselves, and any browser that opens that link has its visits left out in the same way.

Before you answer. The Google Analytics script loads on every page of this site, including your account area, in a mode where all of its storage is switched off by default. So before you touch the banner, requests reach Google when you open a page and when you take one of the actions listed below, carrying the page you are on, the page you came from, your browser and device details, and your IP address. In your account area the page is recorded by its kind rather than its address, for example a report page rather than which report. These requests set no cookie and carry no identifier of their own. If you reject, it stays in that mode on this visit and on later ones. If you have accepted, your choice applies from the first request.

Microsoft Advertising's tag works the same way on the public site. It loads on every page there, with its storage switched off until you allow advertising. So before you answer, or if you do not allow advertising, requests reach Microsoft when you open a page, carrying that page's full address, including any campaign details in it such as Microsoft's ad click identifier, a random code for that page load, your browser and device details, and your IP address. They set no cookie and store nothing in your browser. Microsoft's tag also contacts www.clarity.ms on each page, while Microsoft Clarity is switched off for our tag: that request sets no cookie and returns nothing, whatever you choose. In your account area the tag loads only once, when your new account is reported, and only on a page whose address identifies nothing. From there it sends your cookie choice and that your account was created.

What we measure. On the public site and in your account area: which page you open, whether you scroll to near the bottom of it, and how long it stays open. On the public site, also: whether you click an Add to Google Sheets button or a button that starts on freshsheets.uk, and which one; whether you open the pricing page, the security page or a connector page, and which connector; whether you switch between monthly and annual prices; which questions you open in a list of questions; and, if the address of a page carries a search term, that term. In your account area, also: which sign-in button you press; when your account is created, and whether you signed in with Google or Microsoft; when you connect a source, and which one; when a preview of your data loads in the report builder, when you save a new report and when you turn on a report's schedule; when you click to open a report's spreadsheet, workbook or BigQuery dataset from your account, which kind it is and where on the page the link was; and when you buy a plan, with its price and currency and, if you have accepted analytics cookies, a code for that purchase so it is counted once. No name of a report, spreadsheet, workbook or connected account, and no identifier of any of them, is sent. Nothing you type is measured. Microsoft Advertising is told which pages of the public site you open and, once, that your account was created, so we can see which of our ads lead to sign-ups.

Elsewhere in the product. Google Analytics does not run in the Fresh Sheets sidebar or in the report builder inside Google Sheets. Nothing below is used for analytics. These are needed for Fresh Sheets to work, so they are set whatever you answered on the banner.

Emails we send you

Fresh Sheets sends you service emails, and marketing email only if you ask for it.

Service emails are about your account and your reports, such as an alert when a scheduled report fails, notices about your plan's allowance, a reminder if you haven't connected a source within a day of signing up, and a reminder before your free Plus ends and an email when it ends. They are part of the service, and you get them whether or not you ask for anything else.

Marketing email is about Fresh Sheets itself: product news, including new sources, features and plan offers. We only send it if you ask for it, by ticking the box offered in the sidebar or on the Settings page in your Fresh Sheets account. The box is never ticked for you. We keep a record of each choice you make, what you chose, where, which wording you were shown and when, so we can show that you asked.

To stop product news, untick the box on the Settings page. Every product news email will also include a link that stops it. Stopping product news does not stop service emails.

We record whether the emails we send you are delivered, bounce or are marked as spam. If an address bounces permanently or marks our email as spam, we stop emailing it. We keep these records for 90 days, except the ones that stop us emailing an address, which we keep until you delete your account.

Sub-processors

These are the companies involved in running Fresh Sheets. Apart from Stripe, for what it collects when you pay (see "Stripe, which sells paid plans" below), and WorkOS, whose terms let it also use what it holds to improve its service and to detect security incidents, fraud and illegal activity, none of them is permitted to use your data for their own purposes. That sentence does not cover Microsoft Advertising: Microsoft's privacy statement describes how Microsoft handles personal data.

Google also appears in this policy in a different role, and the two are worth separating. Google is where your reporting data comes from, not a company we pass it to. Fresh Sheets reads your Google Analytics, Google Ads and Search Console data using the permissions you granted, and writes the results to the spreadsheet, workbook or dataset you choose. That is your relationship with Google, operating under the permissions listed above. Google Analytics in the table is a separate matter and concerns visits to freshsheets.uk, including your account area, not your reporting data. Google has one more role: our mailboxes run on Google Workspace, so any email you send us, including a reply to an email Fresh Sheets sent you, with your email address and anything you include in it, is held by Google.

Microsoft appears in the same role for Excel. If you send reports to an Excel workbook, Microsoft is where that workbook is, not a company we pass your data to: Fresh Sheets writes your reports into your own workbook using the permissions you granted, and that is your relationship with Microsoft.

Stripe, which sells paid plans

Paid plans are sold by Link, part of Stripe, as the seller. Stripe plays two parts, and they are worth separating. For the customer record Fresh Sheets creates for you at Stripe, listed in the table above, Stripe acts for us as a processor. For what you give it when you pay, such as your card details and billing address, Stripe is an independent controller: it uses that data for its own purposes, including tax, fraud prevention, disputes, refunds and your Link account, under Stripe's privacy policy.

Revoking access

You can revoke Fresh Sheets's access to your Google account at any time, in either of two places. On the Sources page in your Fresh Sheets account, choose Disconnect: Fresh Sheets stops using the account straight away and asks Google to revoke the access. Or remove Fresh Sheets at myaccount.google.com/permissions: Google removes the access there, and Fresh Sheets records the connection as ended the next time it asks Google to renew it. Either way, reports that read from Google or write to Google Sheets stop refreshing. The data deletion page sets out exactly what happens in each case.

If you connected Microsoft for Excel, remove the connection on the Destinations page in your Fresh Sheets account. Fresh Sheets stops using it straight away, deletes the access it stored, and stops writing to the workbooks it reached; a report that also writes to a spreadsheet keeps refreshing that. Nothing is sent to Microsoft. To end Fresh Sheets' access on Microsoft's side too, go to myapps.microsoft.com, open the menu on Fresh Sheets, choose Manage your application, then Revoke consent. If Fresh Sheets isn't listed there, ask your organisation's Microsoft administrator to remove it.

How long we keep your data

We keep your account identity, your encrypted refresh token, your report configurations and your run history for as long as your Fresh Sheets account exists. Everything else listed under "What Fresh Sheets stores" is kept for no longer than that, unless a longer period is given beside it. A waitlist entry is kept until you ask us to delete it, or until you delete an account using the same email address, which removes it too. Deleting your account removes what's listed there that belongs to it, almost all of it at once. A few records are kept afterwards, most for a set time and one, the record that the deletion ran, for good, and a few things live at other services where only you can remove them. The Data deletion page lists each one.

Disconnecting your Google account does not delete them. Disconnecting stops Fresh Sheets using your Google account, stops reports that read from Google or write to Google Sheets from refreshing, and deletes the cached field list described above. Your account, your saved reports and your run history stay until you delete your account, on the Settings page. Deleting is a separate action, and the data deletion page explains the difference.

Your run history records when each report ran and whether it worked. Where a run failed it also holds the error text, and that text can quote the name of a tab in your spreadsheet, a message returned by Google, Klaviyo, Shopify, Mailchimp or Meta, or an error code returned by Microsoft.

Resend, which sends the emails described under "Sub-processors", keeps a copy of each email and its delivery log: your email address, and the report name, spreadsheet title, workbook name and links in an alert. The same applies to the alerts it sends to our own support inbox, which are also kept in that inbox, on Google Workspace. How long this is kept after you delete your account is on the Data deletion page.

The short-lived record that links the sidebar to your browser session stops working ten minutes after it is created. It is deleted the next time anyone connects Google, from the sidebar or the website, rather than on a timer, so we will not promise a maximum age for it, only that it is useless once expired.

Fresh Sheets never stores the marketing data itself. As described above, it is written directly to your spreadsheet, Excel workbook or BigQuery dataset on each refresh and not kept in our systems.

Deleting your data

You can delete your account yourself, on the Settings page in your Fresh Sheets account. You confirm by typing your email address, and everything in Fresh Sheets's database about the account is deleted within 30 days and usually at once: your reports and their schedules, your run history, your Google connection and the token it stores, any TikTok or Meta connection, after asking TikTok or Meta to end its access, any Microsoft connection and the access it stores (nothing is sent to Microsoft), and the account itself. The exceptions are the record that the deletion ran (listed above) and the records the data deletion page describes, which either lose their link to the account or are removed separately. To end Fresh Sheets' access on Microsoft's side too, go to myapps.microsoft.com, open the menu on Fresh Sheets, choose Manage your application, then Revoke consent. If Fresh Sheets isn't listed there, ask your organisation's Microsoft administrator to remove it. We send you a confirmation email when it is done, unless your address has bounced permanently or marked our email as spam.

Deleting cancels your subscription immediately. Whether any refund is due is covered by our Terms of Service. Your billing records stay with Stripe.

Deleting your account leaves your spreadsheets, Excel workbooks and BigQuery tables as they are. In BigQuery, you can also remove the Fresh Sheets service account from your dataset, which stops anything being sent to it.

If you want a copy of your data first, or you would rather we deleted it for you, email support@freshsheets.uk from the email address on your account. We respond within 30 days. See Data deletion for exactly which records this covers, and for the difference between revoking access and deleting stored data.

Changes to this policy

If this policy changes in a way that affects how your data is used, we'll update this page and, where the change is material, make a reasonable effort to notify connected users directly.

Contact

Questions about this policy or how Fresh Sheets handles your data: support@freshsheets.uk.