Privacy Policy

Last Updated: December 20, 2025

Effective Date: December 20, 2025

1. Introduction

Welcome to Cellify, an AI-powered Excel add-in that enables natural language interaction with Microsoft Excel. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

By using Cellify, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our service.

2. Information We Collect

2.1 Personal Information

We collect the following personal information through Azure Active Directory Single Sign-On (SSO):

• User ID (oid): Unique identifier from Azure AD (immutable)
• Email address: Your work or school email
• Display name: Your name as configured in Azure AD
• Azure AD tenant ID: Organization identifier

2.2 Usage Data

We automatically collect the following usage data:

• Chat messages: Natural language requests sent to Cellify
• Excel actions: Operations performed (create table, format cells, etc.)
• Session data: Login timestamps, session duration
• Error logs: Technical errors for debugging purposes
• Performance metrics: Response times, API latency

2.3 Excel Context Data

To perform requested operations, we temporarily process:

• Workbook structure: Sheet names, table names, chart names
• Cell data: Only when explicitly referenced in your request
• Range information: Cell addresses (e.g., A1:B10)

Important: We DO NOT store your Excel file contents. Data is processed in real-time and discarded after each request.

3. How We Use Your Information

We use collected information for the following purposes:

3.1 Service Provision

• Process natural language requests and generate Excel actions
• Authenticate users via Azure AD SSO
• Track subscription usage (message count, billing)
• Provide customer support

3.2 Service Improvement

• Analyze usage patterns to improve AI accuracy
• Monitor system performance and reliability
• Identify and fix bugs
• Develop new features based on user needs

3.3 Legal Compliance

• Comply with GDPR/RODO regulations (EU/Poland)
• Respond to legal requests (court orders, subpoenas)
• Protect against fraud and abuse
• Enforce Terms of Service

4. Data Storage and Security

4.1 Data Location

Your data is stored in the following locations:

• User profiles: Google Cloud Firestore (us-central1, United States)
• Chat history: Google Cloud Firestore (us-central1, United States)
• Backend processing: Google Cloud Run (us-central1, United States)
• AI processing: Google Vertex AI (us-central1, United States)

4.2 Security Measures

We implement industry-standard security measures:

• Encryption in transit: TLS 1.3 (HTTPS) for all connections
• Encryption at rest: AES-256 encryption (Google Cloud default)
• Authentication: Azure AD SSO (no passwords stored)
• Access control: Role-based access control (RBAC)
• Monitoring: 24/7 automated threat detection
• Backups: Daily automated backups (7-day retention)

4.3 Data Retention

We retain your data for the following periods:

• Active account data: Duration of subscription + 90 days
• Chat history: 12 months (rolling window)
• Error logs: 30 days
• Billing records: 7 years (legal requirement)

After retention periods expire, data is permanently deleted using secure deletion methods.

5. Data Sharing and Third Parties

5.1 Service Providers (Subprocessors)

We share data with the following trusted third parties:

Provider	Purpose	Data Shared	Location
Google Cloud Platform	Cloud hosting, database, AI	User profiles, chat history	us-central1 (USA)
Microsoft Azure	Authentication (Azure AD SSO)	User ID, email, display name	Global
Firebase Hosting	Frontend delivery	IP address, browser metadata	Global CDN
Microsoft AppSource	Subscription billing	User ID, subscription status	Global

Note: All subprocessors are GDPR-compliant and have signed Data Processing Agreements (DPAs).

5.2 We DO NOT Share Data With:

• Marketing or advertising companies
• Data brokers or aggregators
• Social media platforms
• Third-party analytics (beyond essential service providers)

5.3 Legal Disclosures

We may disclose your information if required by law:

• Court orders or subpoenas
• Government investigations
• Protection of our legal rights
• Prevention of fraud or illegal activity

6. Your Rights (GDPR/RODO)

Under GDPR and Polish RODO regulations, you have the following rights:

6.1 Right to Access (Article 15 GDPR)

You can request a copy of all personal data we hold about you.

How to exercise: Email [COMPANY_EMAIL] with subject "GDPR Access Request"

6.2 Right to Rectification (Article 16 GDPR)

You can request correction of inaccurate or incomplete data.

How to exercise: Update your profile in Azure AD or contact us

6.3 Right to Erasure / "Right to be Forgotten" (Article 17 GDPR)

You can request deletion of your personal data.

How to exercise: Cancel your subscription and request account deletion

Exceptions: We may retain data for legal compliance (e.g., billing records for 7 years)

6.4 Right to Restriction of Processing (Article 18 GDPR)

You can request limitation of data processing.

6.5 Right to Data Portability (Article 20 GDPR)

You can request your data in machine-readable format (JSON).

6.6 Right to Object (Article 21 GDPR)

You can object to data processing for specific purposes.

6.7 Right to Withdraw Consent (Article 7 GDPR)

You can withdraw consent at any time (does not affect past processing).

6.8 Right to Lodge a Complaint

You can file a complaint with your local Data Protection Authority:

• Poland: Urząd Ochrony Danych Osobowych (UODO) - https://uodo.gov.pl
• EU: Your national DPA - List of EU DPAs

7. Cookies and Tracking

7.1 Essential Cookies

We use the following essential cookies (required for service operation):

• Session cookie: Maintains login state (Azure AD token)
• CSRF token: Security protection against cross-site attacks

7.2 NO Third-Party Tracking

We do NOT use:

• Google Analytics
• Facebook Pixel
• Marketing cookies
• Cross-site tracking

8. Children's Privacy

Cellify is NOT intended for children under 16 years of age. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately.

9. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), specifically the United States (Google Cloud us-central1).

Safeguards:

• Google Cloud Platform complies with GDPR through Standard Contractual Clauses (SCCs)
• Google is EU-U.S. Data Privacy Framework certified
• Encryption in transit and at rest (AES-256)

10. AI and Automated Decision-Making

Cellify uses AI (Google Gemini 2.5 Flash) to process natural language requests and generate Excel actions.

Transparency:

• AI is used for assistance only, not automated decision-making affecting legal rights
• You maintain full control over Excel operations (review before executing)
• No profiling or automated decisions about individuals

11. Data Breach Notification

In the event of a data breach affecting your personal data:

• We will notify you within 72 hours (GDPR requirement)
• Notification will include: nature of breach, affected data, mitigation steps
• We will notify relevant Data Protection Authorities as required by law

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be communicated via:

• Email notification to registered users
• In-app notification (Excel add-in)
• Updated "Last Updated" date on this page

Material changes will require re-acceptance.

13. Contact Us

For privacy-related questions, requests, or concerns:

14. Legal Basis for Processing (GDPR Article 6)

We process your personal data under the following legal bases:

• Contract performance (Article 6(1)(b)): To provide Cellify service as per Terms of Service
• Legitimate interests (Article 6(1)(f)): Service improvement, fraud prevention, security
• Legal obligation (Article 6(1)(c)): Tax records, legal compliance
• Consent (Article 6(1)(a)): Optional features (if any in future)