Draft — review with a lawyer before launch. Last updated: [CONFIRM: date].
Who is responsible
Digital Media Estonia OÜ, registry code 11697004, Järve tn 2-101, 11314 Tallinn, Estonia, is the controller for the personal data described here. Privacy questions: [email protected].
What SheetBlast itself does not collect
SheetBlast runs inside your own copy of the sheet, in your Google account, and sends through your Gmail or, if you connect one, your Hostinger mailbox through Hostinger’s API. We never access your contact lists, your email content, your Gmail or your Hostinger mailbox. [CONFIRM against the product] Once the sheet checks licence keys, it will send your licence key to our server to verify it. [CONFIRM: what else that request contains]
What we collect on this website, and why
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Purchase: name, email, country, amount, currency, checkout session ID, licence key | Deliver SheetBlast, manage your licence, handle refunds and accounting | Contract; legal obligation (accounting) | [CONFIRM: 7 years for accounting records] |
| Payment details | Handled by Stripe/Link. We never see your full card number. | Contract | See Stripe/Link |
| Contact form: name, email, topic, message | Reply to you | Legitimate interest; steps before a contract | [CONFIRM: e.g. 12 months after the conversation] |
| Attribution (Straycy): pages visited, referrer, campaign parameters and ad click IDs, a random visitor ID, a pseudonymised (hashed) IP address, browser and device | Understand which pages and campaigns lead to sales | Consent (marketing cookies) | Visits that don’t lead to a purchase: deleted after 30 days |
| Emails we send you: delivery and update emails | Deliver the product and its updates | Contract | As long as you have a licence |
| Server logs kept by our host | Security and keeping the site running | Legitimate interest | [CONFIRM: host’s retention] |
Cookies are explained in the Cookie Policy.
Who processes data for us
- Stripe and Link (payments). As merchant of record, Link processes purchase data under its own privacy policy. [CONFIRM once Managed Payments is approved]
- [CONFIRM: hosting provider] (website hosting)
- [CONFIRM: SMTP provider] (sending our emails)
- CookieYes (consent management)
- YouTube, only if you press Play on a tutorial video (youtube-nocookie.com)
Some of these providers are outside the EU. Where data leaves the EU, it is protected by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. [CONFIRM per provider]
Your rights
You can ask to see, correct, delete, restrict or move your data, object to processing based on legitimate interest, and withdraw consent at any time. Email [email protected]. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or the data protection authority in your country.
Changes
We will update this page when what we collect changes, and change the date at the top.