Last updated: April 24, 2026 · Effective date: April 24, 2026
This Privacy Policy is published by Cadaero SARL, a French company trading as Umbra Labs, the publisher of the Compliance Scanner Google Workspace Add-on.
Data Controller
Cadaero SARL (Umbra Labs)
Email: umbra.labs.accademy@gmail.com
Société à Responsabilité Limitée de droit français
This policy applies to:
It does not apply to third-party services linked from our website (Google, Stripe, Resend), which have their own privacy policies.
🔒 Your spreadsheet data never leaves Google's infrastructure.
Compliance Scanner processes your Google Sheets data exclusively using Google Apps Script, which runs on Google's servers under your own Google account. At no point is your spreadsheet content transmitted to, stored by, or accessible to Umbra Labs or any third-party server.
Specifically:
We collect only the minimum data required to operate the service.
| Data | Source | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Email address | Stripe (at subscription) | Send license key; subscription notifications | Contract performance (Art. 6.1.b) |
| Anonymous account identifier | Generated locally in your Google account | Bind license key to one Google account (anti-sharing) | Legitimate interest (Art. 6.1.f) |
| License key | Generated by our server on subscription | Authenticate Pro access | Contract performance (Art. 6.1.b) |
| Subscription status & billing events | Stripe (webhooks) | Activate / revoke Pro access | Contract performance (Art. 6.1.b) |
| Browser language preference | Stripe (at checkout) | Send license email in your language | Legitimate interest (Art. 6.1.f) |
| Server function logs | Netlify (automated) | Debugging and service reliability | Legitimate interest (Art. 6.1.f) |
We do not collect: your spreadsheet content, names, PII detected in your sheets, scan results, IP addresses (beyond what Netlify logs automatically), or any behavioral analytics.
We use the data described in Section 4 solely to:
We do not use your data for advertising, profiling, or any purpose unrelated to delivering the Service.
We use the following third-party services, each acting as a data processor under their own privacy policies:
Processes subscription payments and billing. Stores your payment method and billing history. Stripe is PCI-DSS Level 1 certified. Stripe Privacy Policy
Sends the license key email to your address. Resend processes your email address solely to deliver this transactional email. Resend Privacy Policy
Hosts our website and license server functions. Netlify may log request metadata (IP addresses, timestamps) for security purposes. Netlify Privacy Policy
Google provides the Apps Script runtime, Google Sheets API, and Workspace Marketplace. Google's own privacy policy governs the processing of your Google account data. Google Privacy Policy
We do not sell, rent, or share your personal data with any other third parties.
We implement appropriate technical and organizational measures to protect your personal data, including:
In the event of a personal data breach, we will notify affected users and the relevant supervisory authority (CNIL) within 72 hours as required by Article 33 of the GDPR.
If you are located in the European Economic Area (EEA), you have the following rights under the GDPR:
Right of Access (Art. 15)
Request a copy of the personal data we hold about you.
Right to Rectification (Art. 16)
Request correction of inaccurate personal data.
Right to Erasure (Art. 17)
Request deletion of your personal data ("right to be forgotten").
Right to Object (Art. 21)
Object to processing based on legitimate interests.
Right to Portability (Art. 20)
Receive your data in a structured, machine-readable format.
Right to Restrict Processing (Art. 18)
Request restriction of processing in certain circumstances.
To exercise any of these rights, contact us at umbra.labs.accademy@gmail.com. We will respond within 30 days.
You also have the right to lodge a complaint with your national data protection authority. In France, this is the CNIL.
Google API Services User Data Policy
Compliance Scanner's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
This means we only use access to your Google data (Sheets, Drive) to provide features that are visible to and requested by you. We do not use this access for advertising, to create user profiles, or to sell data to third parties.
The Add-on requests the following OAuth scopes:
https://www.googleapis.com/auth/spreadsheets — Read and modify spreadsheet data to perform scanning and anonymization.https://www.googleapis.com/auth/script.container.ui — Display the sidebar interface within Google Sheets.https://www.googleapis.com/auth/script.external_request — Contact our license server to validate Pro subscriptions.https://www.googleapis.com/auth/drive — Create PDF compliance report files in your Google Drive (Pro Plan only).The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and notify active Pro subscribers by email at least 14 days before the changes take effect. We encourage you to review this page periodically.
For any privacy-related question, data subject request, or to reach our Data Protection contact:
Cadaero SARL (trading as Umbra Labs)
Email: umbra.labs.accademy@gmail.com
Website: compliance-scanner.netlify.app
We aim to respond to all privacy requests within 30 days.
You may also contact the French data protection authority (CNIL) at www.cnil.fr if you believe your rights have not been respected.