How SheetAI handles your data

When you upload a file

Files up to 25 MB are accepted. What happens next depends on the kind of file.

Spreadsheets (.xlsx, .xls, .xlsm, .csv)

The file is opened and read in your browser. The original never reaches our servers. If you're signed in, the resulting sheet is saved to your account, the same as a sheet you build by hand. If you're trying SheetAI without an account, it stays in your browser's storage until you sign in.

Documents (PDF, Word, text) attached to a chat

The text is pulled out in your browser and the file stays in your browser's storage. When you send a message, that text travels with it so the assistant can read it. We don't keep the file or its text on our servers; what we save is the conversation itself.

Images

Sent with your message so the assistant can look at them. We don't keep a copy on our servers.

When you ask the assistant

What is sent

Your message, any attachment text, and the parts of your sheet the assistant reads to answer. These go to a third-party AI model provider for that reply and nothing else.

No training

Our providers process your data under API terms that don't allow them to train models on it. They may keep it for a short period for abuse and safety monitoring.

Python analysis

When the assistant runs Python, the code and the data it needs run in an isolated sandbox created for your request and shut down when the reply ends. Excel exports that include charts are built the same way.

Voice input

Audio is sent to a speech-to-text provider to turn it into text. We don't store the recording.

You decide what changes

In Manual mode each edit waits for you to keep or undo it. Ask mode never writes to your sheet. Connected apps follow the same rules: a write to another app waits for your OK in Manual mode and never runs in Ask mode.

Where your data lives

Servers in Europe

Your account, sheets and chats are stored in a database on servers in Europe. The servers accept only web traffic, and administrative access requires an SSH key.

Encrypted in transit

Every connection to SheetAI uses TLS (HTTPS).

Credentials encrypted at rest

API keys and sign-in tokens for apps you connect are encrypted with AES-256-GCM before they're saved. Access tokens you create for SheetAI's own MCP server are stored only as a one-way hash, so even we can't read them back.

No passwords

You sign in with Google, Microsoft, or a one-time code sent to your email. There's no password for us to store or for anyone to steal.

Undo stays on your device

The snapshot behind each reply's Undo button and the log of what the AI changed are kept in your browser, not on our servers.

Inside Google Sheets and Excel

The Google Sheets add-on and the Excel add-in work on a spreadsheet that stays where it is. Here is what crosses over to SheetAI.

What leaves your spreadsheet

Each message sends the cells and formatting of the sheet or workbook you're working in, together with your message and any attachments, to SheetAI for that reply. In Sheets, a =SHEETAI() formula sends the cells it refers to. The spreadsheet file itself stays in Google Sheets or Excel; we don't keep a copy of it.

Chats stay in the add-on

Add-on conversations are stored by the add-on on your device, not in the SheetAI database. What we record is the credits spent on each reply, and the reply text only if you rate it with thumbs up or down.

Edits you can see

Every change the assistant makes lands in your live sheet, is listed under the reply, and can be undone from there. Manual mode asks before each edit; Ask mode never writes.

Google account access

The Sheets add-on asks Google only for the spreadsheet it is open in and your name and email address. Our use of that data follows the Google API Services User Data Policy, including its Limited Use requirements.

Signing in

The Sheets add-on signs you in with the Google account you're using in Sheets. The Excel add-in opens sheetai.co in your browser, where you approve the connection; the add-in never reads your Microsoft account. Both use a token that expires after 7 days and can't open your web account.

How long we keep it

Sheets and chats

For as long as your account exists, or until you delete them.

Deleting a sheet

Removes the sheet and its chats right away. There's no trash folder yet, so export a copy first if you might need it.

Deleting your account

From Settings. Your account, sheets, chats, connected apps and feedback are removed from our database right away. If you have an active subscription, cancel it first so you're not billed again.

Sign-in sessions

You stay signed in while you use SheetAI. A session ends after 3 days without activity, or when you sign out. The Google Sheets add-on and the Excel add-in sign in separately, with a token that expires after 7 days.

Sign-in codes

Expire after 10 minutes and work only once.

Take your data with you

Download any sheet as .xlsx or .csv, or download a copy of all your account data from Settings.

Who can see your sheets

Private by default

A new sheet is visible only to you.

Sharing is your call

Invite people by email with view, comment or edit access, or turn on a view-only public link. You can remove an invite or turn the link off at any time.

Payments, email and analytics

Payments

Handled by our payment provider. We never see or store your card details.

Email

Sign-in codes and account emails are sent through an email delivery provider.

Analytics

We measure page views and feature use to improve the product. The details are in the privacy policy.

What we don't have yet

Teams ask about these, so here is a straight answer.

Certifications

We don't hold a SOC 2 report or ISO 27001 certification yet.

Health data

SheetAI is not HIPAA compliant and we don't sign BAAs. Please don't upload protected health information.

Single sign-on

There's no SAML or SCIM. Sign-in is Google, Microsoft or an email code.

Procurement paperwork

If your process needs a DPA or a security questionnaire filled in, contact us and we'll tell you what we can provide.