Privacy Policy

1. Responsibility & Data Minimization Commitment

CropSheet strictly adheres to data minimization principles under the General Data Protection Regulation (GDPR) of the European Union and the California Consumer Privacy Act (CCPA/CPRA), ensuring that only essential technical and accounting information is processed to deliver the service.

2. Account, Billing & Usage Data

We store only your authentication email address, technical installation identifier, and processing quota records. All billing transactions, subscriptions, and statutory tax compliance are managed entirely by Lemon Squeezy acting as Merchant of Record (MoR) under PCI-DSS Level 1 compliance certification.

3. Strictly Ephemeral In-Memory (RAM) Vision Processing & Artificial Intelligence

Screen crops selected by the user (such as accounting tables, ERP views, bank statements, or invoices) are processed strictly ephemerally in volatile RAM memory solely for the brief duration of the inference request required to synthesize structured spreadsheet data (.xlsx). Images are destroyed immediately afterward; CropSheet never persists image files to storage, never logs visual content, and never uses user crops to train public or proprietary machine learning models.

4. Infrastructure Providers & Subprocessors

The platform relies on enterprise cloud infrastructure and verified high-availability external services:

• Edge computing & hosting: Cloudflare.
• Payment processing & tax compliance: Lemon Squeezy.
• Vision model inference: OpenRouter and foundational multimodal API providers (such as Google AI / Gemini), whose commercial agreements stipulate ephemeral request processing with zero persistent retention of visual payloads and explicit prohibition of data usage for model retraining.

5. Notice to California Residents (CCPA / CPRA)

CropSheet does not sell, rent, lease, or share personal data of any user with third-party data brokers or advertisers in exchange for financial compensation or commercial gain.

6. Local Browser Storage

Chrome local storage (chrome.storage) is strictly utilized to retain the active user session token, UI preferences, and cached processing quota balance directly on the user's device.

7. User Rights & Contact

Users maintain full control over their data and may exercise their rights to access, rectify, or request complete erasure of their account and ledger records at any time by contacting our technical support team at: hisperides.dev@gmail.com.

8. Official Language

This Privacy Policy is officially published in English for international commercial and regulatory compliance. In case of any discrepancies arising from automated browser translations, this canonical English version shall govern and prevail.