Data Protection Guide

1. Understand the data flow

Connecting a spreadsheet does not mean its contents remain exclusively inside Google. OceanSheet's servers read values for previews/runs, process them in memory, and write configured outputs to Google Sheets. Previews also reach your browser. Saved configuration and operational records can contain personal information, including column names and filter values.

Read the Privacy Policy for data handling and rights. This guide is practical information, not legal advice, a security certification, or a guarantee that your organisation complies with GDPR, CCPA, or another law by using OceanSheet.

2. Choose data you are allowed to process

• Identify whose information is in the sources and who can see the destination.
• Ensure you have authority, a lawful basis where required, and appropriate notices/permissions to combine and disclose that information.
• Use only necessary columns/ranges. Avoid personal information in file names, descriptions, mappings, and filter values unless needed.
• Do not use this beta for special-category data, criminal records, passwords, payment-card security information, or regulated workloads requiring safeguards not agreed with us.

3. Controller and processor arrangements

You or your organisation generally decide why spreadsheet information is processed; OceanSheet carries out your instructions. We separately determine processing needed for our accounts, security, support, and administration.

Organisational use of other people's personal information may require a binding processor agreement, documented instructions, subprocessor arrangements, and international-transfer safeguards. Contact legal@oceansheet.com and agree the required arrangements before that processing. Neither this guide nor the Privacy Policy is an Article 28 data-processing agreement.

A contract does not replace either party's legal obligations. Check actual providers, configuration, retention, and safeguards; do not assume a cloud location or a “GDPR ready” label answers those questions.

4. Protect accounts and outputs

• Use a strong, unique password where applicable and protect your Google account.
• Authorise the correct account/files and review destination sharing as carefully as source sharing.
• Use a dedicated output tab. Current beta writes rebuild its values; unrelated values/formulas can be cleared even in Append mode.
• Keep independent backups and inspect a manual run before scheduling. A preview is not a destination-write guarantee.
• Review failed-run notifications/history and remove unused workflows/connections.

See How to create a workflow for settings and current limitations.

5. Retention and individual requests

Decide how long your organisation needs source/output data. Account/workflow deletion does not delete Google files or copies shared elsewhere. Clear browser drafts on devices that should no longer hold settings.

For access, correction, or deletion requests concerning data you control, identify relevant source/destination copies and act under applicable law. Contact us about OceanSheet's processing. Send redacted examples or error references to support instead of entire spreadsheets.

6. Incidents and legal questions

If you suspect unauthorised access, disable affected workflows, restrict sharing as appropriate, revoke compromised credentials, and contact legal@oceansheet.com. Do not email passwords/tokens or unnecessary personal data. Your organisation may have notification duties to individuals or regulators; obtaining help does not pause legal deadlines.

Requirements depend on the people, organisations, activities, and jurisdiction involved. Obtain qualified advice for employee/customer information, regulated data, cross-border processing, or special contracts. OceanSheet does not promise a certification, dedicated data-protection officer, or general compliance status.