Privacy policy

Effective date: [to be completed]

Templeaf creates documents and e-mails from the rows of your Google Sheets. This policy explains what data Templeaf uses, why, how long it is kept, who else processes it, and your rights. Templeaf is operated by [to be completed], [to be completed] ("we"). For any question about your data, write to [to be completed].

Who decides what

• Your account (your Google identity, your settings, your plan): we decide how this data is used, as described below.
• The data in your sheets and documents (for example the names and addresses of the people you write to): you, or the school or organisation you work for, decide what is in them and why. We process that data only to do what you ask Templeaf to do. If your organisation needs a data processing agreement, contact us.

Google permissions

When you sign in, Templeaf asks Google for these permissions, and no others:

• openid: to confirm who you are when you sign in.
• email: to know the e-mail address of your Google account, which identifies your Templeaf account and receives your notices.
• https://www.googleapis.com/auth/drive.file: to open only the files you choose with Templeaf (your sheet, your template, your output folder) and the files Templeaf creates for you. Templeaf cannot see the other files in your Google Drive.

The Google Sheets add-on asks for the same three permissions. When you open it, Google tells Templeaf who you are and which spreadsheet is open; Templeaf reads that spreadsheet only after you allow it for that file.

Templeaf's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this information, use it for advertising, or use it to train artificial intelligence models.

What we keep, and for how long

• Your account: your Google account identifier, your e-mail address, and an encrypted Google refresh token that lets Templeaf run your merges (including scheduled ones) while you are away. Kept until your account is deleted. You can withdraw Templeaf's access at any time from your Google Account permissions.
• Your sessions: a random session identifier linked to your account, kept until you sign out or it expires (30 days).
• Your merge settings: the identifiers of the sheet, tab, template and folder you chose, your column mapping, filters and file-name pattern, the e-mail text you write (with its field names), your trigger and notification settings. Kept until you delete the merge or your account.
• Cell values: the values of your rows are processed in memory and never stored in our database as a copy of your sheet. To run a merge, the values of each row are kept only while the row is being processed, then erased; this happens when the row is done, needs your attention or has failed.
• Row log: for each row of a run we keep its row number, its status and a short message (for example why a row failed), plus the identifier and link of the document created. The message is erased 90 days after the row ended; the row number and status stay in your run history, with the run's counts, until you delete the merge or your account.
• Automatic triggers: to notice new rows, Templeaf keeps the number of the last row it has seen and a keyed fingerprint of the rows it has read (from which the values cannot be read back), and, for at most 50 rows it skipped, their row numbers and the reason.
• E-mails: the content of each e-mail (recipients, subject and body) is stored only until it is sent, then erased. We keep its delivery status (sent, delivered, bounced) and the provider's message identifier for 90 days, then delete them.
• Pictures: pictures that you put in your documents (from a link in a cell, or a QR code) are stored at an address nobody can guess so that Google Docs can fetch them; they cannot be fetched after 10 minutes and are deleted shortly after.
• Billing: your plan, its state and dates, the number of documents created each month, and the Stripe identifiers of your customer record and subscription. Kept while your account exists and afterwards as long as accounting law requires.
• Support messages: when you use "Contact support", your message, your account identifier, your plan, the merge you chose and, if you tick the box, the log of its latest run (row numbers, statuses and messages, never cell values), the app version and your browser's description are e-mailed to our support mailbox, with your e-mail address as the reply address. They are kept in that mailbox as long as needed to answer you and follow up.
• Technical logs: our servers record errors and events for security and troubleshooting. They are designed not to contain cell values or e-mail content, and secrets are masked before they are written.
• Status page: the public status page shows only the results of our own health checks and the incidents of the last 90 days. It contains no data about you.

Why we use your data

• To provide Templeaf under our terms of service (performance of the contract): sign-in, merges, e-mails, notices, support, billing.
• To keep Templeaf secure and working (our legitimate interest): technical logs, abuse prevention, health checks.
• To meet legal obligations: invoices and accounting records.

Who processes data for us

• Google: sign-in, and the Google Sheets, Docs and Drive services where your files live. Your files stay in your Google account, under your agreement with Google.
• Stripe: payments and invoices. Card details are entered on Stripe's pages; no card data reaches our servers.
• Brevo: sends the e-mails Templeaf sends for you, your notices and support messages.
• Our hosting provider: runs our servers and database in the European Union (Paris, France).

Some of these providers may process data outside the European Union; they do so under the safeguards they offer, such as the European Commission's standard contractual clauses. When you open the editor, your browser also loads the file picker from Google, so Google receives your browser's network address.

Cookies

Templeaf sets two cookies, both needed for sign-in, both HttpOnly, Secure and SameSite=Lax:

• mw_session keeps you signed in, for 30 days or until you sign out.
• mw_oauth exists only while you sign in, for at most 10 minutes, and protects the sign-in against forgery.

There are no tracking or advertising cookies and no analytics.

Your rights

You can ask us to access, correct, delete or export your personal data, to restrict its processing, or object to it. Write to [to be completed] from the address of your account. To delete your account, write to us: we then delete your account, merge settings, run history and sessions; the documents Templeaf created stay in your Google Drive, and Stripe and we keep billing records for as long as accounting law requires. If you think your data is not handled lawfully, you can complain to your data protection authority (in France, the CNIL).

If your account comes from a school or organisation, it may also be able to answer requests about the data it puts in Templeaf.

Children

Templeaf is a tool for businesses, schools and other organisations. Accounts are meant for adults: it is not directed to children under 13, or under 16 in the European Union, as account holders. A school may use Templeaf for documents about its pupils under the school's own agreement with us; the school decides what pupil data it puts in Templeaf and is responsible for informing families as its rules require.

Changes

We may update this policy. The effective date at the top changes with each version. If a change matters for how your data is used, we tell you by e-mail or in the editor before it takes effect.

Contact

[to be completed], [to be completed]. E-mail: [to be completed].