Privacy Policy
1. The short version
- The free in-browser validator processes your file entirely in your browser. Anonymous validation does not upload your spreadsheet to our servers.
- With an account, we store your rulesets and account details. When you use server-side features (report export, AI drafting), the data needed for that request is processed transiently and not retained as a stored copy of your spreadsheet.
- We never sell your data, and your data is never used to train AI models.
2. What we collect
| Data | When | Why |
|---|---|---|
| Account info (email, name, sign-in identity) | You sign up / sign in | Operate your account |
| Rulesets you save | You save them | The core paid feature (persistence) |
| Spreadsheet data in a request | Server-side export or AI drafting | Generate the report / rule you asked for; processed transiently |
| Billing details | You subscribe | Handled by Stripe — we store the subscription state, never your card |
| Waitlist email | You join a waitlist | To tell you when the feature ships |
| Usage telemetry & logs | Using the Service | Reliability, abuse prevention, and understanding which parts of the product get used (Azure Application Insights). Product usage is recorded as counts only — never your file names, column names or cell values — and without cookies |
3. Subprocessors
Microsoft Azure (hosting, identity, telemetry), Stripe (payments), Anthropic (AI rule drafting — prompts only, no model training on your data).
4. Retention
Account data and rulesets are kept while your account is active. Logs and telemetry are retained for a limited operational window.
Deleting your account removes your account record, your saved rulesets, your AI-drafting usage counts and any waitlist signups, and cancels any active subscription. Two things survive by necessity: Stripe keeps your payment receipts and invoices under its own financial record-keeping obligations, and your sign-in identity is held by Microsoft Entra External ID — email us if you want that removed too.
5. Your rights
You can exercise the main two yourself, immediately, from the Account menu when you are signed in:
- Export my data — downloads everything we store about you as a JSON file.
- Delete my account — erases it, as described in section 4.
For anything else — correction of your details, or a question about what we hold — email hello@9000sheets.com and we will act on it within 30 days. Depending on where you live (for example GDPR or CCPA), you may have these rights as a matter of law; we offer them to everyone regardless.
6. Cookies
We use only the cookies/storage needed for sign-in and session state. No advertising trackers.
7. Security
Data is encrypted in transit (TLS) and at rest. Secrets are managed in Azure Key Vault. Access to production data is limited and audited.
8. Children
The Service is not directed at children under 16.
9. Changes & contact
We will notify material changes in the product or by email. Questions: hello@9000sheets.com · 9000 Spreadsheets, operated by Chad Lomax (sole proprietor), Florida, USA