Built to ask for as little as possible.

1. Where your files live

Files you attach through UpSheet are uploaded to your own Google Drive, in folders owned by you. We do not copy, mirror, cache, or host them on our infrastructure, and we do not read their contents.

If you stop using UpSheet, the files stay exactly where they are. Nothing to export, nothing to reclaim — they were never anywhere else.

2. The permissions we ask for

UpSheet requests five OAuth scopes and no others. Four of them Google classifies as non-sensitive, and we request no restricted scopes at all.

Permission	Why we need it
drive.file	Create and manage the attachment files and folders the add-on itself creates, plus files you explicitly open with it. This is per-file access — not access to your Drive.
spreadsheets.currentonly	Read and write only the spreadsheet you currently have open, to place attachments and keep the cell indicators up to date.
script.container.ui	Show the sidebar and dialogs inside Google Sheets™.
script.storage	Store add-on settings. This data stays inside Google, via Apps Script Properties.
userinfo.email	Identify the signed-in user for licensing, and to apply the file sharing you ask for.

3. Google verification

UpSheet Pro has completed Google’s OAuth application verification. In the Google Cloud console, both our branding and our data access show as verified, and the permissions listed on our consent screen match the ones in the table above exactly.

You can install UpSheet from the Google Workspace Marketplace.

4. What we store, and what we never store

What we store

• Your email address — to check your licence and start your trial.
• Licence and billing metadata — plan, status, start and expiry dates, and Stripe reference IDs.
• Support conversations, if you contact us.

What we never store

• The contents of your files. They live in your Drive; we hold links, not copies.
• The contents of your spreadsheets. The add-on reads cells in the sheet you have open only to place and update attachment indicators, and that data stays within Google.
• Card numbers. See “Payments” below.
• We do not sell personal data, and we do not share it beyond the sub-processors listed below.

5. Infrastructure and encryption

• All traffic to our API runs over HTTPS/TLS.
• Our database is reachable only from the server side. Browsers never talk to it directly; our API is the single authenticated gate, and every account endpoint trusts only the identity inside a verified sign-in token — never an email supplied by the caller.
• Secrets live in server environment configuration, never in client code or our source repository.
• The API sets standard security headers, applies a strict cross-origin allow-list, and rate-limits public endpoints.
• Customer email addresses are masked in our application logs.

6. Payments

Payments are handled entirely by Stripe, a PCI-DSS Level 1 service provider. Card details are entered directly into Stripe’s checkout and are never transmitted to, or stored on, UpSheet servers. We receive only Stripe reference identifiers so we can tell which licence belongs to which subscription.

7. Sub-processors

Provider	Purpose	Data involved
Google	Add-on runtime and storage of your files	Runs inside your own Google account
Supabase	Licence and account database	Email and licence metadata
Stripe	Payment processing	Email and payment; card data handled by Stripe

8. Retention and deletion

• Licence records — kept for the subscription period plus a short grace window (up to 30 days).
• Usage analytics — aggregated or de-identified within a limited period (up to 90 days).
• Trials and one-time sign-in codes — short-lived, and they expire automatically.
• Your files — they remain in your Google Drive under your control. Deleting your UpSheet account does not touch them.

To request deletion of your account data, email upsheet-pro@theconductor.co. You can also revoke UpSheet’s access at any time from your Google account permissions.

9. Reporting a vulnerability

If you believe you have found a security issue, please email upsheet-pro@theconductor.co with the subject line “Security”. Include enough detail to reproduce the issue. We will acknowledge your report and keep you updated while we investigate, and we will not pursue action against researchers who report in good faith and avoid privacy violations or service disruption.

10. Independent assessments

We want to be precise here rather than impressive. UpSheet has not completed a third-party security certification such as SOC 2 or the App Defense Alliance CASA assessment, and we do not claim one.

What we do have is the OAuth verification described above, a permission model narrow enough that most of the risky operations are simply not available to us, and an internal security review whose findings we have fixed. If your organisation needs specific documentation for a vendor review, write to upsheet-pro@theconductor.co and we will share what we have.