SheetMagic

GDPR overview

GDPR implementation is minimal and never claimed outright. The word appears once on the whole site, in a FAQ entry asking whether SheetMagic is SOC 2 or GDPR compliant; the answer sidesteps the question, argues that the product processes little data, and refers enterprise compliance needs to a sales conversation. There is no Data Processing Agreement, no published subprocessor list, no Article 27 EU representative and no named Data Protection Officer. No legal basis, no retention period and no formal data subject request procedure are documented. The one concrete right offered is account termination, which the privacy policy says removes personal information from the servers permanently. The publisher is a United States company with no declared EU presence, and the privacy policy was last updated on 21 October 2025.

Who owns the data?

Users keep their spreadsheet content: the publisher states it does not store, log or access prompts, responses or sheet data, and describes itself as a bridge between Google Sheets and the chosen AI provider. Very Very Good Ventures, LLC holds only account details voluntarily supplied, namely name and email, plus usage analytics counting function calls rather than their content. API keys sit in Google Apps Script's encrypted Properties Service, tied to the user's Google account and never sent to the publisher. Access is confined to the active spreadsheet, not the wider Drive. Note a genuine tension: the privacy policy also says prompts, logs and API keys are shared with third-party AI tools including OpenAI.

Reuse rights

Nothing on the site restricts what users do with the output. Generated text, images, video, speech and scraped rows land directly in the user's own spreadsheet, and no clause claims a licence over them or requires permission before commercial reuse. The stated limits sit elsewhere. Scraping functions return publicly available data only and never reach content behind a login or paywall, and users alone carry responsibility for honouring each scraped site's terms of use, its robots directives and applicable data protection, copyright and anti-circumvention law. Account data collected by the publisher serves to run the service, answer enquiries, send security alerts and personalise the experience. Under BYOK, the user's own provider settings govern how prompts are handled downstream.

Data retention & training

Hosting summary

The site discloses no hosting information at all. No country, no region and no infrastructure provider is named anywhere in the privacy policy, the terms of service or any product page, and targeted searching for hosting, data residency or server location returned nothing. Only indirect signals exist, and they should be treated as such rather than as vendor statements: the domain resolves to an anycast Google address geolocated in the United States, the add-on itself executes inside Google Apps Script, and API keys remain in Google's Properties Service tied to the user's own account. Prompts travel onward to whichever AI provider the user selects, so part of the processing chain is chosen by the customer rather than the publisher. The company behind the tool, Very Very Good Ventures, LLC, is registered in the United States and declares no European presence. Anyone with data residency obligations should ask the vendor directly before deploying.