Add-on Privacy Policy

This policy covers the GSTIN Verifier for Google Sheets add-on specifically. It sits alongside, and does not replace, the GSTIN API privacy policy, which governs your account, your API key and your billing records. Where the two differ on how spreadsheet data is handled, this page is the one that applies to the add-on.

1. Google user data the add-on accesses

The add-on requests three OAuth scopes, all of which Google classes as non-sensitive. It requests no others, and Google will not let it use any it has not declared.

• The spreadsheet you have open (https://www.googleapis.com/auth/spreadsheets.currentonly) — To read the column of GST numbers you select and write the results next to it. This scope grants access to the open spreadsheet only — not to your Drive, not to your other files, not to anything you have not opened the add-on in.
• Show the sidebar and menu (https://www.googleapis.com/auth/script.container.ui) — To add the "GSTIN Verifier" item to your Extensions menu and draw the sidebar you run the verification from.
• Call gstinapi.com (https://www.googleapis.com/auth/script.external_request) — To look up GST numbers against the government register. The add-on manifest restricts outbound requests to https://gstinapi.com/api/ — it cannot call anywhere else.

The first of those deserves emphasis: spreadsheets.currentonly grants access to the single spreadsheet in which you opened the add-on. It does not grant access to your Google Drive, to your other spreadsheets, to files shared with you, or to anything at all once that file is closed. The add-on has no way to enumerate, open or read any document you have not deliberately opened it in.

2. What the add-on reads, and when

Nothing is read in the background. The add-on reads cells only in direct response to something you clicked:

• When you click Validate or Verify, it reads the single column of cells you selected.
• When you use a GSTIN_* formula, Google passes that formula's arguments to it and nothing else.
• It writes results back into the columns immediately to the right of your selection, and nowhere else.

It does not read other columns, other sheets in the file, cell comments, the file name, the revision history, or the identities of your collaborators.

3. What leaves your spreadsheet

The offline pass — every GSTIN_* formula and the Validate button — sends nothing anywhere. Those checks run inside Google's own execution environment. Google's custom function context has no network access whatsoever, which is a property of the platform rather than a promise we are asking you to take on trust.

The Verify pass sends one thing to https://gstinapi.com/api/: the 15-character GST number itself, together with your API key so the request can be attributed and billed. It does not send any other cell, any other column, the spreadsheet's name or identifier, your Google account name, or your email address. The add-on manifest restricts outbound requests to that one URL prefix, so it is technically incapable of transmitting anything to any other destination.

GST numbers are identifiers of registered businesses published by the government, not personal data about you. Requests are logged as described in the main privacy policy so that usage can be billed and abuse investigated.

4. Where your API key is stored

In Google Apps Script user properties, which are scoped to your Google account and to this add-on. Practically, that means:

• It is never written into the spreadsheet, so sharing the file does not share your key.
• Collaborators on the same file cannot see it and must enter their own to run a lookup.
• Removing the key in the sidebar, or uninstalling the add-on, deletes it.

We hold the same key on our side, as we must in order to authenticate your requests. You can revoke and regenerate it at any time from your dashboard, which immediately invalidates the copy stored in the add-on.

5. What we retain

We do not store the contents of your spreadsheet. We retain the record of each lookup — the GST number requested, the API key used, the timestamp and the outcome — because that is what a credit ledger is, and you can see the same record in your dashboard. We do not retain the results we return to you beyond the ordinary caching described in the main privacy policy.

6. Limited Use of Google user data

GSTIN Verifier for Google Sheets's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, and without qualification:

• We do not transfer Google user data to third parties except as necessary to provide or improve the add-on, to comply with applicable law, or as part of a merger or acquisition.
• We do not use Google user data for serving advertising of any kind.
• We do not sell Google user data, under any definition of sale.
• We do not use Google user data to train generalised artificial intelligence or machine learning models.
• No human at our organisation reads Google user data, except with your explicit consent for a specific support request you have raised, where required for security purposes, or to comply with applicable law.

7. Removing the add-on

In the spreadsheet, open Extensions, then Add-ons, then Manage add-ons, and uninstall GSTIN Verifier. To revoke the OAuth grant independently, remove it from your Google account permissions page. Uninstalling deletes the stored API key. Results already written into your spreadsheet remain, because they are ordinary cell values that belong to you — delete them as you would any other cells. Deleting your gstinapi.com account is covered in the main privacy policy.

8. Children

The add-on is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children.

9. Changes and contact

If this policy changes in a way that affects what the add-on accesses or transmits, the change will be reflected on this page and in the add-on's Marketplace listing, and material changes will be notified to account holders by email. Questions about anything above go to contact@gstinapi.com — see also the add-on support page and the add-on terms of use.