Privacy Policy

Effective date: October 30, 2026 · Controller: Arte Soft EOOD (office@arte-soft.com)

1. Local-First Spreadsheet & Private EU Cloud Workbooks

Arte Sheets works immediately in your browser without requiring registration. When used without an account, your workbooks, formulas, imported .xlsx / .csv files, charts, pivot tables, and macros remain locally in your own browser (IndexedDB / local storage).

If you sign in with a verified email address and use My files, your saved cloud workbooks are stored privately in our dedicated European Union storage (Hetzner Storage Box, Germany) behind authenticated per-user server authorization, not in public buckets. Saving a cloud workbook does not by itself share it with other users or send it to an AI provider. Sharing a document, using an AI assistant, or authorizing a connected application can disclose the data needed for the action you request.

2. Optional Account & Academy Data

If you create an Arte Sheets account to save cloud workbooks, sync Academy progress, or subscribe to Arte Sheets Pro, we process only the minimum necessary data:

• Account credentials: Your email address, a salted cryptographic password hash (never your plain-text password), email verification status, and an HttpOnly, Secure, SameSite=Lax session cookie valid for up to 30 days.
• Cloud workbook metadata: Workbook titles, byte sizes, optimistic concurrency versions, and private storage object keys bound strictly to your account ID.
• Learning records: Verified lesson/step identifiers and any completion certificates you choose to issue (including the recipient name you enter and your public verification code).
• Security logs: Short-lived rate-limiting and operational logs to protect accounts against brute-force and abuse.

3. Payments, Tax & Billing (Stripe)

Paid subscriptions are processed by Stripe. Arte Sheets never receives or stores your payment card number, CVC, or bank credentials. We store Stripe customer, subscription, and invoice references, net/tax/gross plan amounts, billing country/VAT reverse-charge status, currency, and timestamps to verify your Pro entitlement and satisfy statutory EU/Bulgarian accounting and tax obligations.

4. Transactional Email (Amazon SES)

We send transactional emails via Amazon Web Services (SES, EU region) strictly for actions you initiate — such as account email verification and password recovery. We do not send unsolicited marketing emails or sell user addresses.

5. Hosting, Retention & Self-Service Deletion

Account databases and private workbook storage are hosted in the European Union (Hetzner Online GmbH, Germany), with static application assets delivered via AWS CloudFront/S3.

• Download your data & files: Signed-in users can download any cloud workbook as standard .xlsx from My files, and download a machine-readable .json export of their account, subscriptions, payment history, progress, and certificates from the Account dialog.
• Delete your account: Signed-in users can permanently delete their account, personal profile, and private cloud workbooks directly from the Account dialog (after canceling any active auto-renewing subscription). Statutory anonymized payment/invoice audit records are retained strictly as required by tax and accounting law.

6. Connected Applications for ChatGPT and Codex

When available, the optional Arte Sheets connector uses your Arte Sheets sign-in and an authorization screen listing the requested permissions. Depending on the permissions you approve and your document role, a connected application can request workbook titles, selected cell values and formulas, comments, lesson content and learning progress, or make changes and invite collaborators. Local-only workbooks in your browser are not accessible through this connector.

Data returned by a connector tool is sent to the application you connected, such as ChatGPT or Codex, and is handled under that application's terms and privacy settings. The connector does not require a separate Arte-funded model call for ordinary spreadsheet tools. The AI assistant inside Arte Sheets is a separate feature.

We store the connection's client identifier, authorized permissions, account association, expiry and revocation information, and cryptographic hashes of authorization credentials. Document mutations use operation records to prevent duplicate changes on retries; comments, invitations and document history remain part of the applicable document and account records.

You can revoke a connection from the Account dialog. Revocation stops subsequent access through that connection; it does not undo completed document changes, remove invitations already created, or delete data already received by the connected application.

7. Your Rights & Contact

Under the GDPR and applicable data protection laws, you have the right to access, rectify, export, restrict, or erase your personal data, and to lodge a complaint with your supervisory authority. Contact us anytime at office@arte-soft.com.