Privacy policy

Last updated: 2026-10-12. This policy covers the JSON Importer for Sheets add-on and this website. A Spanish version is available at /es/privacidad/; if they differ, the Spanish text prevails.

Who is responsible

Marc Duran López · tax ID (NIF) 47894988H · Calle Jacinto Verdaguer 13, 08620 Sant Vicenç dels Horts (Barcelona) · contacto@engranalab.com

In short

• Your sheet content, the responses of the APIs you call, and your API keys never reach our servers. The add-on runs inside your Google account.
• We receive one anonymous usage ping per installation per day (random id, version, language and counters). You can turn it off.
• If you join the Pro waitlist on this website, we store your email and the answers you choose to give.

What the add-on processes

• Requests you configure. When you use IMPORTJSON, IMPORTJSONPATH or the request builder, the add-on sends the request you wrote (URL, headers, body) from Google's servers, using your Google account, to the API you chose. That API receives the request and is governed by its own privacy policy, not ours.
• The active spreadsheet. The add-on only asks for access to the spreadsheet where you use it (spreadsheets.currentonly scope) to read the selected cell and to write the imported results. It does not read other files, your Drive, your Gmail or your contacts.
• What it stores, and where. Saved request definitions (without secrets) are stored in the document's properties inside your Google account. API keys and tokens are stored in your user properties in your Google account, never in the sheet. Responses may be cached for a short time in Google's cache service (up to 6 hours). None of this is sent to us.
• Scopes requested: spreadsheets.currentonly, script.external_request (to call the APIs you configure) and script.container.ui (menu, sidebar and dialogs). None of them is a restricted scope.

Anonymous usage ping

• What we receive: once per day at most, per installation: a random installation id, the add-on version, your interface language, and counters (how many times IMPORTJSON and IMPORTJSONPATH ran, how many times the builder and refresh were used, and how many errors occurred). We store a SHA-256 hash of the id (never the id itself), the UTC day and those values.
• What we never receive: URLs, queries, headers, keys, responses, sheet data, your name, your email or your Google account.
• Purpose: to know whether the add-on is used and which version, so we can decide how to keep improving it. Legal basis: our legitimate interest in measuring adoption (art. 6.1.f GDPR) with data that does not identify you.
• IP address: the server uses it only to rate-limit requests, in memory, and it is not stored with the ping.
• How to turn it off: in Google Sheets, open Extensions → JSON Importer → Help → Usage statistics and switch it to off. The add-on stops sending pings.
• Retention: the daily counters are kept while the add-on is offered. Because they do not identify you, we generally cannot link them to you; if you want records removed, turn statistics off and write to us.

Pro waitlist (this website)

• Data: email address, optional answers (what you are interested in, how much you would pay, personal or company use) and proof of your consent.
• Purpose: to confirm your sign-up (double opt-in) and to email you about the launch of Pro, with its price and date. Legal basis: your consent (art. 6.1.a GDPR), which you can withdraw at any time.
• Retention: until you unsubscribe, or 12 months after the waitlist closes; unconfirmed sign-ups are deleted after 30 days.
• Unsubscribe: every email has an unsubscribe link, and you can write to us.

Website

The website uses no advertising or tracking cookies. We measure audience with aggregate statistics that use no cookies or personal identifiers (Cloudflare Web Analytics).

Google API Services User Data Policy

JSON Importer for Sheets's use and transfer to any other app of information received from Google APIs will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements.

In practice: we use the access to your spreadsheet only to provide the features you ask for, directly in your sheet. We do not transfer that data to anyone, we do not use it for advertising, and nobody at our end reads it, because it is never sent to us.

Recipients

Providers acting as data processors under a contract: hosting, email delivery (Resend) and aggregate analytics. We do not sell or share your data with third parties except where the law requires it or you consent. Some providers may transfer data to the United States under the EU-US Data Privacy Framework or standard contractual clauses.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing toprivacidad@engranalab.com. You can also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or your local supervisory authority. General questions: json-sheets@engranalab.com.

Changes

If this policy changes in a relevant way, we will update the date above and, if the change affects what the add-on collects, we will say so in the changelog.