PRIVACY POLICY

Last updated: April 7, 2026

This Privacy Policy for Datalytics LLC (doing business as PhotoToSheet) (“we,” “us,” or “our”) describes how and why we might collect, store, use, and/or share (“process”) your information when you use our services (“Services”), including when you:

Visit our website at https://phototosheet.com, or any website of ours that links to this Privacy Policy
Use PhotoToSheet to convert photos and PDFs into structured spreadsheet data via AI extraction
Engage with us in other related ways, including customer support

Questions or concerns? Reading this Privacy Policy will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at hello@phototosheet.com.

SUMMARY OF KEY POINTS

What personal information do we process? We process minimal personal information: email addresses (if you purchase credits), uploaded documents (temporarily, in-memory only), device identifiers (for free credit limits), and payment information (handled by Stripe). We do NOT permanently store your uploaded documents or extracted data.

Do we process any sensitive personal information? Your uploaded documents may contain sensitive information (W-2 tax forms, Social Security Numbers, financial data, business information). We process this ONLY temporarily in-memory to perform AI extraction, then immediately discard it. We do not store uploaded documents on our servers.

Do we share information with third parties? Yes. We send uploaded documents to Google Gemini (Google Cloud AI) for AI-powered data extraction. We also use Stripe for payment processing and Vercel for hosting and analytics.

How do we keep your information safe? We use HTTPS encryption, process uploads in-memory only (no persistent storage), and rely on enterprise-grade service providers (Google, Stripe, Vercel). However, no system is 100% secure.

What are your rights? Depending on your location, you may have rights to access, delete, or opt-out of certain data processing.

How do you exercise your rights? Contact us at hello@phototosheet.com. We will respond within the timeframes required by applicable law.

WHAT INFORMATION DO WE COLLECT?
HOW DO WE PROCESS YOUR INFORMATION?
WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
HOW LONG DO WE KEEP YOUR INFORMATION?
HOW DO WE KEEP YOUR INFORMATION SAFE?
DO WE COLLECT INFORMATION FROM MINORS?
WHAT ARE YOUR PRIVACY RIGHTS?
CONTROLS FOR DO-NOT-TRACK FEATURES
DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
DO WE MAKE UPDATES TO THIS POLICY?
HOW CAN YOU CONTACT US ABOUT THIS POLICY?
HOW CAN YOU REVIEW, UPDATE, OR DELETE YOUR DATA?

1. WHAT INFORMATION DO WE COLLECT?

Personal Information You Provide to Us

In Short: We collect information you provide when purchasing credits or contacting us.

We collect the following personal information that you voluntarily provide:

Email addresses — Collected when you purchase credits to create a persistent credit wallet
Payment information — Payment card details, billing addresses (processed and stored by Stripe, not by us)
Device identifiers— A randomly generated ID stored in your browser’s localStorage to manage free credits and prevent abuse

We do NOT require you to create an account. Email addresses are only collected if you choose to purchase credits.

Uploaded Documents (NOT Stored)

In Short: We process your uploads temporarily in-memory only. We do not permanently store uploaded documents or extracted data on our servers.

When you upload a document (photo, screenshot, PDF) to PhotoToSheet:

Your document is sent to Google Gemini (Google Cloud AI) for AI-powered data extraction
The document is processed entirely in-memory — it is never written to disk or stored in a database
Extracted data is returned to your browser and displayed in the results table
Both the uploaded document and extracted data are immediately discarded after processing

What this means:

We cannot recover your uploads or extracted data after you close the page
Your extraction history is stored ONLY in your browser’s localStorage (on your device, not our servers)
If you clear your browser data, your history is permanently deleted

Important: Your uploaded documents may contain sensitive information such as:

Social Security Numbers (SSNs) on W-2 tax forms
Financial account numbers on invoices or receipts
Personal contact information on business cards
Proprietary business data

We process this sensitive information ONLY to perform the AI extraction you requested, and we do not retain it beyond the immediate processing.

Information Automatically Collected

In Short: We collect minimal technical information automatically via Vercel Analytics.

We automatically collect:

IP addresses — Collected by Vercel Analytics for basic traffic analysis (aggregated, not linked to individual users)
Browser and device information — Browser type, operating system, screen resolution (via Vercel Analytics)
Usage data — Which pages you visit, time spent on site (aggregated, privacy-friendly analytics)

Vercel Analytics is cookie-free. It does not set cookies or use persistent identifiers beyond what is necessary for basic analytics.

Anonymous Usage Tracking

We log minimal, anonymized usage data in our database:

Document type processed (W-2, receipt, invoice, business card, table, other)
MIME type (image/jpeg, application/pdf, etc.)
Page count (for multi-page PDFs)
Credit cost (1 credit per page)
Timestamp of extraction

This data contains NO personally identifiable information — no file names, no document contents, no email addresses, no IP addresses. It is used solely for service improvement and usage analytics.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide AI document extraction, process payments, prevent abuse, and improve our service.

We process your personal information for the following purposes:

To provide the PhotoToSheet service:

Send your uploaded documents to Google Gemini for AI extraction
Display extracted data in your browser
Manage your credit balance (free credits and purchased credits)

To process payments:

Securely process credit card payments via Stripe
Grant purchased credits to your wallet (device-based or email-based)
Maintain records of credit purchases for accounting and dispute resolution

To prevent abuse:

Rate-limit free credits by IP address and device ID
Prevent duplicate credit grants from payment retries
Detect and block fraudulent payment attempts

To improve our service:

Analyze aggregated usage data to understand which document types are most popular
Monitor API performance and error rates
Optimize AI extraction prompts based on success rates

To communicate with you:

Respond to customer support inquiries
Send transaction confirmations (payment receipts)
Notify you of service updates or policy changes (if you’ve provided an email)

We do NOT use your information for marketing, advertising, or profiling.

In Short: We share information with Google Gemini (for AI extraction), Stripe (for payments), and Vercel (for hosting/analytics).

We share your personal information with the following third-party service providers:

Google Gemini (Google Cloud AI)

What we share: Uploaded documents (photos, PDFs)
Why: To perform AI-powered data extraction
Data retention: Google may retain data per their Cloud Data Processing Terms. We have configured our Gemini API usage to minimize data retention where possible.
Privacy Policy: https://policies.google.com/privacy

Model Training: Google may use uploaded content to train and improve their AI models. While we use enterprise-grade Google Cloud services designed for business use, we do not have specific control over whether Google uses your uploaded documents for model training purposes. By using PhotoToSheet, you acknowledge and accept that your uploaded documents may be used by Google to improve their AI services.

Important:Your uploaded documents (including W-2s with SSNs, financial data, etc.) are sent to Google’s servers for processing. Google is acting as a data processor on our behalf. We do not control Google’s internal data practices, but we use Google Cloud services that are designed for enterprise customers with strong privacy commitments.

If you are concerned about sensitive data: Do not upload documents containing highly confidential information (SSNs, financial account numbers, trade secrets, proprietary business data) unless you understand and accept the risks of transmitting such data to third-party AI services.

Stripe (Payment Processing)

What we share: Payment card information, billing addresses, email addresses
Why: To process credit card payments securely
Data retention: Stripe retains payment data per their terms
Privacy Policy: https://stripe.com/privacy

Note:Payment card details are entered directly into Stripe’s secure payment form. We never see or store your full card number.

Vercel (Hosting and Analytics)

What we share: IP addresses, browser/device information, usage data
Why: Vercel hosts PhotoToSheet and provides privacy-friendly analytics
Data retention:Per Vercel’s standard analytics retention policies
Privacy Policy: https://vercel.com/legal/privacy-policy

Vercel Analytics is cookie-free and does not track users across websites.

We DO NOT sell your data

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

4. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep information only as long as necessary, and we do NOT store uploaded documents.

Uploaded documents: NOT STORED (processed in-memory only, immediately discarded)

Extracted data:NOT STORED on our servers (saved only in your browser’s localStorage)

Email addresses and credit wallets:

Retained as long as you have a credit balance
Deleted upon request (contact hello@phototosheet.com)
Automatically purged after 2 years of inactivity

Payment records:

Retained for 7 years for accounting, tax, and legal compliance purposes
Includes transaction IDs, amounts, dates (but not full card numbers)

Anonymous usage data (upload_events):

Retained indefinitely for analytics (contains no PII)

IP address rate-limiting data:

Automatically expires after 24 hours

5. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We use industry-standard security practices, but no system is 100% secure.

We implement appropriate technical and organizational measures:

Encryption: All data in transit is encrypted via HTTPS/TLS. Payment data is encrypted by Stripe (PCI-DSS Level 1 compliant).

No persistent storage of uploads: Uploaded documents are processed in-memory only, never written to disk or stored in databases.

Access controls: Database access is restricted to authorized personnel only. API keys and secrets are stored securely in environment variables.

Third-party security: We rely on enterprise-grade providers (Google Cloud, Stripe, Vercel), each maintaining their own security certifications and audits.

However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security. If you become aware of any security vulnerability, please contact us immediately at hello@phototosheet.com.

6. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from children under 18.

PhotoToSheet is not directed at individuals under 18 years of age. We do not knowingly collect personal information from minors. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at hello@phototosheet.com.

7. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on your location, you may have rights to access, delete, or opt-out of certain data processing.

You may have the following rights:

Right to Access: Request a copy of the personal information we hold about you
Right to Deletion: Request that we delete your personal information
Right to Correction: Request that we correct inaccurate personal information
Right to Opt-Out: Opt-out of certain data processing activities

How to exercise your rights:

Email us at hello@phototosheet.com with your request
Include “Privacy Request” in the subject line
Provide sufficient detail for us to verify your identity and locate your data

We will respond within the timeframes required by applicable law (typically 30–45 days).

Note: Because we do not store uploaded documents or extracted data, we cannot provide access to or delete documents you previously uploaded.

8. CONTROLS FOR DO-NOT-TRACK FEATURES

In Short: We do not respond to Do-Not-Track browser signals, but we do not track users for advertising.

We do not currently respond to DNT signals because we do not track users across websites for advertising purposes, we use only first-party privacy-friendly analytics (Vercel Analytics), and we do not sell user data or share it with advertisers.

9. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: If you are a U.S. resident, you may have additional privacy rights under state law.

California Residents (CCPA/CPRA)

Categories of personal information we collect:

Category	Examples	Collected?
Identifiers	Email addresses, device IDs	Yes
Financial information	Payment card data (via Stripe)	Yes (via Stripe)
Internet activity	IP address, browser type, pages visited	Yes (via Vercel)
Sensitive personal information	SSNs, financial account numbers (in uploaded documents)	Yes (processed temporarily, not stored)

How to exercise your CCPA rights: Email hello@phototosheet.com with “CCPA Request” in the subject line.

Colorado Residents (CPA)

Colorado residents have rights similar to California residents, plus the right to opt-out of profiling and the right to appeal privacy request decisions.

How to exercise your CPA rights: Email hello@phototosheet.com with “CPA Request” in the subject line.

Virginia, Connecticut, Utah, and Other States

Residents of other states with comprehensive privacy laws have similar rights. Contact hello@phototosheet.com to exercise these rights.

10. DO WE MAKE UPDATES TO THIS POLICY?

In Short: Yes, we may update this policy from time to time.

We may update this Privacy Policy to reflect changes in our practices or for legal, operational, or regulatory reasons. We will post the updated policy on this page with a new “Last updated” date. Material changes will be communicated via a prominent notice on phototosheet.com or by email.

Your continued use of PhotoToSheet after the effective date of an updated Privacy Policy constitutes acceptance of the new terms.

11. HOW CAN YOU CONTACT US ABOUT THIS POLICY?

Datalytics LLC (doing business as PhotoToSheet)
Email: hello@phototosheet.com
Address: 1905 Sherman Street, Suite 200 #2248, Denver, CO 80203

12. HOW CAN YOU REVIEW, UPDATE, OR DELETE YOUR DATA?

To request review, update, or deletion of your personal information:

Email hello@phototosheet.com
Include “Data Request” in the subject line
Specify the action you want (access, correction, or deletion)
Provide sufficient information for us to verify your identity

What we can delete: Email addresses, credit balance and purchase history, payment transaction records (subject to legal retention).

What we cannot delete: Uploaded documents (not stored), extracted data (stored only in your browser), anonymous usage statistics (no PII).

Processing time: 30–45 days, as required by applicable law.

Last updated: April 7, 2026