Privacy Policy

1. Data controller

The data controller is Maurizio Bellifemine, who can be reached at maury.bellifemine@gmail.com. No data protection officer has been appointed, as one is not required for a service of this size.

SmartSheet is offered as a free experimental demo. This policy describes what the service does today; if that changes, this page and the date above change with it.

2. What data the service processes

Generating a SmartSheet requires an account, and you sign in with Google: SmartSheet neither creates nor stores passwords. The data processed is this:

• Your Google account details: email address, name and profile picture if you have one, and the identifier Google assigns to your account. This is what reaches us when you press “Sign in with Google”, and it is what lets us recognise you when you come back. We do not receive your password, and we have no access to anything else in your Google account.
• The SmartSheets you generate, with their layout and the options you chose, saved to your account so you can find them again from any device, along with their creation and last-modified dates.
• The content you upload: notes typed in the text box, uploaded files (PDF, images, text) and the options chosen to generate the SmartSheet. If that content contains personal data, it is processed as part of the material.
• Your IP address, used to count requests and stop a single user from saturating the service. It stays in the memory of the server answering your request and is lost on restart: it does not end up in any archive of ours.
• Technical connection data (IP address, date and time, page requested) automatically recorded by the hosting provider in its logs, as any web server does.

SmartSheet uses no profiling cookies, installs no analytics or tracking tools and does not measure which features you use or how often you return. There is no advertising and we sell data to nobody. The only cookies are the ones that keep your session open: without them, signing in would last a single page.

3. Why, and on what legal basis

• Generating the SmartSheet you ask for — legal basis: performance of the service you requested (Art. 6(1)(b) GDPR). Without your content the service cannot work: providing it is your free choice, but it is necessary to get the result.
• Keeping your account open and storing your SmartSheets — legal basis: performance of the service you requested (Art. 6(1)(b)). The account is the condition for generating, and storing the SmartSheets is the reason it exists.
• Keeping the service running and safe (rate limiting, technical logs, defence against abuse) — legal basis: the controller’s legitimate interest in keeping the service available to everyone (Art. 6(1)(f)).
• Answering your emails, if you write to us — legal basis: the legitimate interest in handling correspondence, limited to what you write.

4. Google Gemini: what happens to what you upload

This is the part that matters most, which is why it is written plainly. To generate the SmartSheet, your notes and files are sent to the Google Gemini APIs, provided by Google Ireland Limited and Google LLC.

SmartSheet uses the free tier of those APIs. Under Google’s terms, on the free tier Google uses the content submitted and the responses generated to provide, improve and develop its products and services, and human reviewers may read and annotate them (Google states that it first disconnects them from the account and the API key of whoever made the call). This does not happen on the paid tier, and if SmartSheet moves to it in the future this page will be updated.

Google itself recommends not sending confidential information or personal data to the free tier. That is why SmartSheet warns you before you upload: use it for your study notes, not for confidential documents nor for other people’s personal data.

Google’s terms and privacy policy are on its official pages: Gemini API terms and Google privacy policy.

5. Who else processes the data, and where

Besides Google, the service relies on Vercel Inc. for hosting: it is the provider that receives your browser’s requests and records the technical logs described above.

Your account and saved SmartSheets live on Supabase, in a database hosted in Ireland: that data does not leave the European Economic Area. Each row can be read and deleted only by the account that created it — that is not a promise made by our code, it is a rule the database applies to every request.

Both providers are based in the United States, so data may be transferred outside the European Economic Area. Transfers rely on the instruments set out in Chapter V GDPR — the adequacy decision for the United States and, where applicable, the standard contractual clauses adopted by the European Commission.

6. How long it is kept

• Notes and preferences: they stay in your browser, in the site’s local storage. You delete them whenever you like, by clearing the site data in your browser or using the reset command inside the app.
• Saved SmartSheets and account: they stay as long as you keep them. A SmartSheet is deleted from the archive, one at a time; the account is deleted from the same place, with the Delete account command, and every saved SmartSheet goes with it. Deletion is immediate and cannot be undone.
• Content sent to Google: retention is governed by Google’s terms, not by us. See section 4.
• Request counting: it lives in the server’s memory and resets within a minute, or when the instance restarts.
• Hosting technical logs: kept by the provider under its own policies, for as long as security and diagnostics require.
• Emails you send us: kept for as long as it takes to reply and handle any follow-up.

7. Your rights

You may at any time request access to your data, its rectification, erasure, restriction of processing, portability, and you may object to processing based on legitimate interest (Arts. 15-22 GDPR). Write to maury.bellifemine@gmail.com.

It is worth being honest about what you can do yourself and what you cannot. Erasure you exercise from inside the app, without asking anyone: in the archive you will find Delete account, which deletes your account and every saved SmartSheet. Notes and preferences are in your browser and you clear them from there. For content already sent to Google you must also turn to Google, with the tools it provides: that is no longer within our reach.

If you believe the processing infringes the law, you have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or with the supervisory authority of the country where you live, or to go to court.

8. Minors

SmartSheet is aimed at students, so this needs saying clearly: the service may be used independently by anyone at least 14 years old, the age Italian law sets for consent to information society services. Under 14, a parent or guardian must use the service or authorise its use.

9. Security, and its limits

Communications with the service are encrypted (HTTPS) and the AI-generated content is cleaned before being displayed, to avoid unwanted code. No measure, however, makes safe a piece of content that should never have been uploaded: the most effective protection is still not sending confidential material, as explained in section 4.

10. Contact

For any question about this policy or to exercise your rights: maury.bellifemine@gmail.com.