Paid subscriptions are not open. The sample does not extract your selected document or create a paid account. Company and operational service details must be confirmed before purchases open.
Business details are being finalized. Paid subscriptions are not open.
How information moves through SheetSnapshot, what stays on your device, and the choices available to you.
01Scope and current service
This notice covers the SheetSnapshot website, contact messages when enabled, and the local sample workspace. It explains current processing separately from any paid account or hosted extraction service. A sample export does not create a paid account, subscription or hosted document record.
The legal operator, registered contact details and privacy contact are displayed in the business-details notice on this page when confirmed. Paid subscriptions remain disabled until those details and the operational service are verified. No legal entity or address is invented by this notice.
02Information you choose to provide
When you choose a JPG or PNG in the sample, your browser creates a local preview. It does not upload the file or extract its text. Sample edits, history and export selections remain in tab memory until the page is refreshed or closed. XLSX and CSV downloads are created on your device.
The public account-access pages do not collect passwords or run a pretend registration form. When a secure account provider is connected, its destination is identified before you continue and its privacy notice applies to credential handling. This notice must reflect any connected provider before paid access opens.
The contact form, when enabled, collects your name, email address, selected subject and message. Do not include source documents, credentials or card numbers. The form is hidden when delivery is unavailable, so it does not invite you to submit information to a missing endpoint. Its server-side handler sends only the fields needed to the configured support provider.
- For a future account, basic identity and account information may be needed to provide access.
- For a connected contact form, the requested fields are name, email, subject, and message. The form is hidden until a delivery channel is configured.
- For future extraction, document contents and generated table values would be processed to fulfill the requested conversion. Upload only information you are authorized to provide.
03Technical information and website delivery
Cloudflare delivers this website and applies network/security protections. In doing so it can process IP addresses, request URLs, times, browser information and security events under the account configuration and its service terms. The application does not include document contents, credentials or contact messages in request URLs. Application request-body logging is disabled.
The frontend has no advertising pixels, visitor analytics or embedded social tracking widgets. Licensed Pexels photographs and font files are served from this website. External credit or social destinations receive a request only when you choose to open them. Those destinations have their own notices.
04Purposes and applicable grounds
Where the EU GDPR or UK GDPR applies, the controller relies on contractual necessity to provide a requested service or take requested steps before a contract; legitimate interests to answer relevant inquiries, protect the site and prevent abuse; legal obligations for required financial or legal records; and consent for an optional activity that actually requires it. The purpose and basis must correspond to the processing performed, rather than treating consent as permission for everything.
For the current site, technical delivery and proportionate abuse prevention support the legitimate interest in maintaining a usable and secure website. A product or billing inquiry may also be a requested pre-contractual step. A non-contractual privacy or general inquiry is handled under the applicable legal obligation or legitimate interest. No documents are sent for AI training, and no marketing consent is inferred from contacting support.
You can object to processing based on legitimate interests, subject to lawful exceptions, and withdraw any optional consent for future processing. Withdrawing consent does not invalidate earlier lawful processing. If an activity needs consent, it must remain optional and be recorded by the actual service.
05Document ownership and sensitive information
You retain rights in documents and data you supply. Processing permission is limited to carrying out your request and necessary supporting operations. The privacy notice is not permission for the operator to publish your documents or sell their contents.
Remove information that is unnecessary for your task. Do not use the sample to submit government identification, medical records, payment credentials, passwords, or other highly sensitive information. A future service needs additional controls and contractual terms before accepting categories that require special protection. Your authority to handle another person’s information remains your responsibility.
06AI processing and training choices
The local sample does not run an OCR or AI model on your chosen document. Animated walkthroughs contain authored example values, not automated decisions about you. No training toggle is presented as an operational privacy control in the account-access pages.
Before a hosted extraction service accepts personal documents, its actual OCR provider, data locations, retention, training restrictions and relevant processing terms must be disclosed and verified. Any separately optional training use requires its own clear information and legal basis. A request to extract a document is not permission to publish it or reuse it for unrelated model training.
07Sharing and processing providers
Cloudflare is the current website-delivery and security provider. Its network is global; the applicable Cloudflare contracting entity and processing terms follow the operator account agreement. Self-hosted font files and locally served stock photographs are assets, not independent processors receiving a request when the page loads.
A support delivery provider receives contact details and the message only when the form is enabled; its name and privacy link are listed in the provider register on this page. Stripe is used for hosted billing only after live payment links are enabled. No OCR processor is active in the sample. A new account or extraction provider must be added to the register and assessed before it processes personal data.
Data may also be disclosed to comply with a valid legal requirement or address a substantiated security issue. Access must be limited to what the recipient needs. This is not permission to sell documents, disclose them for advertising or expose them to unrelated users.
| Provider | Purpose | Status and notice |
|---|---|---|
| Cloudflare | Website delivery, network security and contact rate limiting | Active. Global delivery network; account-specific processing and security arrangements apply. Provider privacy notice |
Local fonts and photographs are site assets, not third parties receiving embedded requests. Unconnected account, OCR and payment providers are not presented as active processors.
08Retention and deletion
Sample previews and values are held in tab memory and are discarded on refresh or page closure. Downloaded files stay on your device until you delete them. The theme preference stays in local storage until changed or cleared.
Contact messages, when enabled, are kept for the published support-retention period after resolution unless a dispute or legal requirement justifies longer retention. The current Worker does not store message bodies in an application database or application logs. Delivery-provider and mailbox retention must match the configured policy before the form is enabled.
Cloudflare may maintain technical security or operational records under its account settings and contractual documentation. Application request logging is disabled in this deployment. The site does not claim that disabling application logs removes all provider-level security records. If hosted document processing is introduced, its actual retention period, backup expiry and deletion exceptions must be published before documents are uploaded.
09International processing
Local preview does not transfer your selected document across borders. Cloudflare website delivery, support messages and any later enabled payment or account service may involve processing outside your country. The provider register identifies the services actually enabled.
Where EU GDPR or UK GDPR transfer restrictions apply, transfers must use an applicable adequacy decision, approved standard contractual clauses or another valid mechanism, with the UK addendum or other UK mechanism where required and any necessary supplementary safeguards. Provider agreements and actual processing locations must be reviewed by the confirmed operator. A provider brand alone is not evidence that every transfer is permitted.
10Your rights and requests
Subject to applicable law, you may request access, correction, erasure, portability or restriction; object to legitimate-interest processing; and withdraw optional consent. You may complain to the relevant data-protection authority, including the authority where you live, work or believe an infringement occurred. This does not require first giving up other remedies.
Use the privacy contact in the business-details notice or the Privacy and deletion subject on the enabled contact form. Identity checks must be proportionate and must not request confidential original documents without a necessary, secure process. GDPR/UK GDPR requests are normally answered within one month; where a lawful extension is necessary, the reason and extension are communicated within the initial month.
The local sample has no account database to erase. Refresh the page for in-memory values, clear site data for display preferences, and delete downloaded files separately. Paid services do not open before a monitored rights-request route is verified.
11Children and permitted use
SheetSnapshot is intended only for people aged 18 or older who can enter a binding contract. The same minimum applies to account registration, any paid subscription and the local sample. We do not knowingly seek personal information from children.
Do not submit children’s information or sensitive third-party records through the sample or support form. If you believe such information reached an enabled service, contact the privacy channel so the operator can investigate and apply any legally required removal or restriction.
12Security, linked services, and changes
Use the Security page for the current handling model and planned controls. No online service can promise absolute security. Stock photographs, animated examples, and design elements are not certifications or evidence of a security audit.
External social profiles, photographer pages, and future hosted payment pages have their own policies. The policy date will change when this document changes. Material new processing must be explained before it starts, with additional consent where required. Later text does not retroactively provide consent for an earlier optional use.