Privacy Policy & Data Security for tradeGIST Users

Effective Date: August 4, 2026
Last updated: August 4, 2026

Welcome to the tradeGIST Add-on (the "Add-on") for Google Sheets™. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Add-on. By using the Add-on, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Add-on.

Data Controller: The data controller for the personal data described in this policy is Tulsisphere LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States. You can contact the controller using the form on this page or by mail at the address above.

1. Information We Collect

We collect limited personal information to provide and manage the Add-on's services:

Email Address and License Records: When you purchase or activate a license, we store your email address together with your license key, tier, subscription status, and related payment references (such as Creem customer and subscription identifiers) in our license database (Google Firestore, hosted on Google Cloud). When you activate a license in the Add-on, the email address of the Google account you use it with is also recorded, to link your license to that account. We use these records to issue, verify, and recover your license and to send you transactional emails about your account. We do not send marketing communications unless you separately subscribe to product updates.
Contact Form: When you submit the contact form, your name, email address, topic, message, and any attachments you include are delivered to us as an email through our email provider, Resend. They are not published or added to any mailing list.
Newsletter (optional): If you subscribe to product updates — on the website, where the subscription is confirmed by email, or by ticking the option during a purchase — your email address is stored with our newsletter provider, Loops. You can unsubscribe at any time using the link included in every newsletter email.
Trial Eligibility: Each Google account is granted one 14-day Pro trial. So that this holds across reinstalls, the Add-on stores a small record of the trial in our database (Google Firestore): the trial's start and end dates, any extension date, and how many trials have been granted. The record is filed under a keyed hash of your Google account's email address, computed with a secret key that only we hold. Your address itself is never stored, and the hash cannot be reproduced from an email address by anyone without that key. The Add-on looks the record up by that hash when you run it, which is how the one-trial rule survives a reinstall; beyond that we do not use it to identify you, and it is never combined with your license, newsletter, support or feedback records. It holds nothing about your spreadsheet or your portfolio.
Product Feedback (optional): The Add-on has a "Send feedback" menu item, and it occasionally offers a feedback dialog during and at the end of the 14-day Pro trial. Nothing is sent unless you type a message and submit it yourself. When you do, the text you wrote, which dialog it came from, and a timestamp are delivered to us as an email through our email provider, Resend. If — and only if — you tick the box offering to be contacted about your feedback, the email address of the Google account you use the Add-on with is included so that we can reply to you. No spreadsheet or transaction content is ever included, and feedback is not added to any mailing list.
IP Addresses (abuse prevention): Our website backend records the IP address of requests to sensitive endpoints (such as licensing and purchase endpoints) to enforce rate limits and prevent abuse.

Transaction Data: We do not collect or store any transaction data from your Google Sheets™. All transaction data (such as stock, crypto, and options investments) is read into memory, parsed, and rendered directly into your attached Google Sheet™, and is not retained after processing. If the Add-on encounters an error, technical diagnostic logs may be recorded through Google's standard Apps Script logging, with sensitive values such as API keys masked.

External Data Requests (Live Data Fetching): To provide real-time investment tracking, the Add-on makes authorized external requests to fetch current market data. These requests are limited exclusively to the following services approved by Google:

CoinMarketCap (https://pro-api.coinmarketcap.com): Used for fetching live crypto asset prices.
Massive (https://api.massive.com): Used for fetching live option contract data.
ExchangeRate-API (https://v6.exchangerate-api.com, or its open-access endpoint https://open.er-api.com when no key is set): Used for fetching real-time FX rates.

No personal information or specific portfolio quantities are transmitted to these external APIs; we only send the ticker symbols or currency codes required to retrieve current pricing information.

Separately from market data, the Add-on also communicates with our licensing service — the license database described above and our website's API — to verify your license and manage your subscription, and with Google's authentication service. These requests carry your license key and the account-linking information described above, never your portfolio contents.

2. Purposes, Lawful Bases and Retention

We use personal data only for the purposes below. For users in the EU, EEA, or UK, the table also states the lawful basis under Article 6 GDPR we rely on for each purpose, and how long we keep the data.

Purpose	Data	Lawful basis (GDPR)	Retention
Issuing, verifying and recovering licenses; account communications	Email address, license key, tier, subscription status	Contract (Art. 6(1)(b))	Life of the license, then up to 3 years after expiry
Answering support and contact requests	Name, email address, message	Contract or legitimate interest (Art. 6(1)(b), 6(1)(f))	Up to 2 years after our last interaction
Product updates newsletter	Email address	Consent (Art. 6(1)(a))	Until you unsubscribe
Granting one 14-day Pro trial per Google account	A keyed hash of your Google account email address; the trial's start, end and extension dates; the number of trials granted	Legitimate interest (Art. 6(1)(f)): applying the one-trial-per-account rule and preventing repeated trials	Kept for as long as the rule applies: deleting the record would restore trial eligibility and defeat its purpose
Product feedback you choose to send from the Add-on	Your feedback text, the dialog it was sent from, a timestamp, and — only if you consented to be contacted — your Google account email address	Consent (Art. 6(1)(a))	Up to 2 years after receipt
Website analytics	IP address, pseudonymous identifiers, usage data	Consent (Art. 6(1)(a))	Per the retention period configured in Google Analytics (at most 14 months)
Proof of cookie consent	Consent ID, consent status, timestamp	Legal obligation and legitimate interest (Art. 6(1)(c), 6(1)(f))	12 months
Abuse prevention and rate limiting	IP address	Legitimate interest (Art. 6(1)(f)): keeping the service secure	Up to 12 months
Payment processing	Payment and billing details	Processed by Creem as merchant of record under its own privacy policy	Held by Creem under its legal obligations

We do not use your information for advertising, and we do not sell it to anyone.

3. Data Sharing and Disclosure

We do not sell or trade your personal information. It is shared only with the service providers listed in Section 9, which process it on our behalf or, in Creem's case, as an independent controller, and it is not disclosed to anyone else except as required by law (e.g., in response to a subpoena or court order).

4. Payment Processing

If you purchase a paid license, the sale is handled by Creem (creem.io), which acts as merchant of record: Creem is the seller of record for the transaction and processes your payment, invoicing, and applicable taxes such as VAT. We do not collect, process, or store your full payment card details (such as credit card numbers). Your payment information is provided directly to Creem, and their use of your personal information is governed by their Privacy Policy and Buyer Terms. We only receive transaction confirmation, subscription status, and your email address in order to generate your license key and fulfill your order.

5. Cookies and Analytics

Our website uses cookies and similar technologies. Cookie consent is managed through CookieYes, a consent management platform: when you first visit the site, a consent banner asks for your choice, and non-essential cookies (such as analytics cookies) are set only after you consent to them. You can change or withdraw your consent at any time through the cookie settings control that CookieYes provides on the site, which reopens the consent banner.

With your consent, we use Google Analytics to understand how visitors use the website. Google Analytics collects information such as your IP address, pseudonymous identifiers stored in cookies, browser type, pages visited, and the time and date of your visit. Some of this information, including your IP address and those identifiers, is treated as personal data under EU data protection law. You can learn more about how Google uses this data by visiting Google's Privacy & Terms.

As an additional option, you can also install the Google Analytics Opt-out Browser Add-on.

The website also sets a functional cookie used solely to exclude our own internal visits from analytics; it contains no identifier tied to you.

6. Data Security

We implement reasonable security measures to protect your email address from unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet or electronic storage is completely secure, so we cannot guarantee absolute security.

7. Your Rights (Including GDPR)

If you are a resident of the European Economic Area (EEA) or the United Kingdom, you have specific data protection rights under the General Data Protection Regulation (GDPR). We aim to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Data.

You have the right to:

Access, update, or delete the personal information we hold about you.
Rectification: Request correction of any inaccurate or incomplete information.
Object or Restrict: Object to our processing of your data or request that we restrict its processing.
Data Portability: Request a copy of your personal data in a structured, commonly used, and machine-readable format.
Withdraw Consent: Withdraw your consent at any time where we relied on it to process your information. For cookies and analytics, use the cookie settings control that CookieYes provides on the website to change or withdraw your consent.
Lodge a Complaint: Lodge a complaint with a data protection supervisory authority.

To exercise any of these rights, contact us using the form on this page. We will respond to your request within 30 days as required by law.

8. Children's Privacy

The Add-on and this website are intended for adults and are not directed at children. You must be at least 18 years old to use the Add-on. We do not knowingly collect personal information from anyone under 18; if we become aware that we have collected such information, we will delete it.

9. International Users and Third-Party Processors

The Add-on itself operates within Google's ecosystem: your spreadsheet and transaction data are processed by Google Apps Script inside your own Google account and handled on Google's servers. Tulsisphere LLC does not operate servers that store your spreadsheet or transaction data.

Some personal data is, however, processed by the third-party services we use. The third-party processors are:

Creem (creem.io): Merchant of record for paid licenses; processes your payment details and email address (see Section 4).
Google Analytics: Website usage analytics, used with your consent (see Section 5).
CookieYes: Cookie consent management on the website; records your consent choices (see Section 5).
Google Cloud (Firebase / Firestore): Hosts our license database — your email address and license records — and the trial eligibility records described in Section 1.
Resend: Delivers our transactional emails (license keys, confirmation codes), contact form submissions, and any feedback you choose to send from the Add-on.
Loops: Stores and delivers the product updates newsletter, only if you subscribe to it.
Market data APIs — CoinMarketCap, Massive, and ExchangeRate-API (listed in Section 1): these receive only the ticker symbols or currency codes needed to fetch prices, not personal data or portfolio quantities.

Contact form submissions (e.g., support requests) are delivered to us by email through Resend and handled as described in Sections 1 and 2.

10. Google API Services User Data Policy (Limited Use)

The Add-on accesses Google user data — the contents of the spreadsheet where you use it, and the email address of your Google account (used to link your license and, as a keyed hash, to apply the one-trial-per-account rule, both described in Section 1) — through the OAuth scopes you grant when installing it from the Google Workspace Marketplace.

tradeGIST's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google Workspace user data and developer policy, including the Limited Use requirements.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted here, and the effective date will be updated. Your continued use of the Add-on after changes constitutes acceptance of the updated policy. We encourage you to review this page periodically.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us using the form on this page or by mail at:

Tulsisphere LLC
30 N Gould St Ste N
Sheridan, WY 82801

Thank you for using the tradeGIST Add-on.