Privacy Policy

• Account data — email, password hash, user ID and, if you sign in with Google, your Google account identifier and profile name.
• Smartsheet data — your OAuth tokens, the sheets and rows you connect, and the cell values processed to fill templates.
• Templates — the Word and PDF files you upload, and Word copies of any Google Docs you import, stored so your workflows can render them.
• Generated documents — not retained. Each document is streamed straight to Smartsheet as an attachment on your row and, if you choose, to a Google Drive folder you pick; we keep only its attachment name and ID (and, for a Google Drive copy, its link) in your run history.
• Usage data — workflow runs, PDF conversion counts, AI call counts, error logs.
• Billing data — handled by Stripe; we store a customer ID and subscription status, not card details.

If you sign in with Google, we receive your Google account's email address, name and account identifier, and use them only to create your account and sign you in.

If you connect Google to import Google Docs (optional), we ask Google for one further permission: access to the specific files you use with That Doc Generator. You choose each document yourself in Google's own file picker; we cannot see or open anything else in your Google Drive. When you import a document, we export a copy of it in Word (.docx) format and store that copy with your other templates so your workflows can generate documents from it. “Refresh from Google” replaces the copy with a new export. Each time a workflow that uses an imported document runs, we first check when that document was last changed and, if it has changed since the copy was made, replace the copy with a new export; we read nothing else from your Google account. We store the OAuth tokens Google issues for the connection on encrypted infrastructure, accessible only to the Service.

If you turn on “Also save to Google Drive” for a workflow (optional), you choose a folder in the same file picker, and each document that workflow generates is also saved in that folder as a new file in your Google Drive. That Doc Generator can open only the folder you picked and the files it creates there.

We use Google user data only to provide these features. We do not sell it, use it for advertising, or use it to train AI or machine-learning models, and no person reads it except with your permission, where needed for security, or to comply with the law. The stored copy is handled only by the providers that run the Service: Supabase (storage), Cloudflare (hosting) and, when PDF conversion is turned on for a workflow, Microsoft (Word-to-PDF conversion). Generated documents are attached to your Smartsheet row and, if you chose a folder, saved in your Google Drive; we do not retain them, as described above.

You can disconnect Google at any time in Settings → Google; that revokes our access at Google, deletes the stored tokens and pauses saving to Google Drive until you reconnect. Imported documents stay in your library until you delete them or your account, or you can choose to remove them when you disconnect; if you reconnect, we restore the copies of documents you removed that way and check each imported document for changes. Deleting your account in Settings also revokes our Google access.

That Doc Generator’s use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

• Cloudflare — application hosting, edge delivery, bot protection, and encrypted backup storage.
• Supabase — database, authentication, and template file storage.
• GitHub — runs the nightly backup job; data is encrypted before it leaves the job runner and no unencrypted copy is kept.
• Smartsheet — source of the row data you connect, and the destination your generated documents are attached to.
• Google (Gemini API) — AI text generation, where a token mapping uses AI.
• Microsoft (Microsoft Graph) — Word-to-PDF conversion.
• Stripe — subscription billing and payment processing.
• Resend — transactional email delivery.
• Sentry — error and performance monitoring.

Account deletion requests are processed promptly. Customer data is typically removed from active systems within 30 days, subject to backup retention schedules, legal obligations, and fraud prevention requirements. Encrypted backups are retained for up to 90 days and are used only for disaster recovery, never to restore an individual account.