Privacy Policy
This document states the lawful basis for processing, what's processed, cookie/consent handling, and where data goes. It's the user-facing counterpart to docs/gdpr/data-inventory.md, which lists every field in schema/log/third-party detail — this page is the plain-language summary of the same processing, not a separate inventory.
Who this covers
You (the reseller) connect your own supplier and public Google Sheets and use this platform to sync prices between them on a schedule. This policy covers the data this platform processes about you and your Google/Stripe accounts in the course of providing that service. It does not cover data inside your own spreadsheets — those remain yours, stored in your own Google account, and this platform only reads/writes them live at sync time (see the data inventory's Google section).
Lawful basis
- **Contract** (GDPR Art. 6(1)(b)): your account, Google connection, sync configuration,
and billing/subscription data are processed because they're necessary to perform the syncing service you've signed up for — without them the product cannot function.
- **Legitimate interest** (GDPR Art. 6(1)(f)): request/business-event logging (#84/#85)
and the threshold-breach email alert are processed to operate, debug, and secure the platform, and to notify you of large price changes you'd reasonably want to know about. This interest is balanced against your privacy via the redaction and 30-day retention policy on logs (#87) — see the data inventory's Logs section for exactly what is/isn't captured.
Neither basis is consent — see the Cookies section for the one place consent could apply and why it doesn't here.
What's processed
Summarized from the data inventory (full field-level detail lives there): your account email and role, an encrypted OAuth refresh token for your connected Google account, which sheets you've chosen to sync (ids/names only, not their contents), your markup/rounding configuration, a history of sync runs and price changes, your Stripe billing status, and minimal request/business-event logs (IDs and event slugs, never bodies/query strings/ secrets — enforced by `tests/logging-minimization.test.ts`).
Cookies and consent
This platform sets exactly one cookie: a signed session cookie (`psp_session`, `src/lib/session.ts`) used solely to keep you logged in. It carries no tracking or advertising purpose and is **strictly necessary** for the service to function (you cannot use an authenticated dashboard without it) — under GDPR/ePrivacy, strictly necessary cookies are exempt from the active-consent requirement that applies to analytics/advertising cookies. This platform sets no other cookies, and does not use any third-party analytics or advertising trackers. If that ever changes, this section and a consent mechanism will be added before any such cookie is set.
Data transfers
- **Google**: your OAuth tokens and sheet access are processed via Google's APIs under
the `drive.file` scope — Google acts as your own storage; this platform never copies sheet contents into its own database (see the data inventory).
- **Stripe**: billing/subscription data is processed by Stripe as a payment processor;
card details never reach this platform's own database (see the data inventory's Stripe section).
- **Resend**: threshold-breach alert emails are sent via Resend, which receives the
recipient email address and the alert content necessary to deliver that one message (see the data inventory's Email notifications section).
No data is sold, and no data is transferred to any other third party beyond the processors named above, all of which exist solely to run this service on your behalf.
Platform operator staff access
This platform's own operator staff have named, password-authenticated accounts (`AdminUser`) separate from reseller accounts, used to support the service (e.g. overriding a trial length or subscription status, or adjusting displayed plan pricing). Every such action is written to an audit trail (`AdminAction`) keyed to the acting admin account, with the recorded detail restricted to a fixed, non-personal whitelist (before/ after values of the config field changed — never a reseller's own data, sheet contents, or credentials). See the data inventory's `AdminUser`/ `AdminAction` rows for full field-level detail.
Your rights
You can export your full data (`GET /api/account/export`) or delete your account outright, which cascades erasure through every related row (`DELETE /api/account`) — see issue #88 and the data inventory for exactly what's covered. Requests to exercise any other GDPR right (rectification, restriction, objection) can be made directly to the platform operator.