Privacy Policy
This Privacy Policy explains how Aeluka Sheets ("Aeluka Sheets", "we", "us", or "our") collects, uses, and shares information when you use the Aeluka Sheets service at sheets.aeluka.com (the "Service"). It also explains the important distinction between data we hold for our own account owners and data an account owner chooses to collect from their field reps and other people. If you have any questions, contact us at contact@aeluka.com.
Who this policy covers
Two kinds of people interact with the Service:
- Account owners. A person who creates an account, builds spreadsheets, shares Magic Links, and reviews collected data. Owners sign in to use the Service.
- Field reps and other respondents. People an account owner invites to submit data through a Magic Link. Field reps do not create an account and do not sign in. The data they submit is collected by the account owner, using Aeluka Sheets as the tool.
This distinction matters throughout this policy, because for the data an owner collects through their forms, the owner decides what is collected and why, and we act on the owner's behalf. See "Who controls the data" below.
Information we collect
Owner account information
When you create an owner account, we collect your email address and the authentication information needed to sign you in and keep your account secure. Owner sign-in is handled by our authentication provider, Clerk. We do not store your account password ourselves.
Spreadsheet and ledger content
We store the spreadsheets, ledgers, cell values, labels, and related settings you create or import into the Service. This content is stored in our database provider, Neon. You control this content, and you can edit, export, or delete it.
Field rep submissions
When a field rep submits an entry through a Magic Link, we receive and store the values they type and any photo they attach, together with basic technical details of the submission such as timestamps. The fields a rep fills are the fields the account owner defined. If an owner chooses to collect personal information in their form, for example a name, a phone number, a location, or a photo of a person, that information is collected under the owner's control and responsibility.
Uploaded photos
Photos that a field rep uploads are stored using Cloudflare (R2) storage. If the owner has enabled AI photo verification, the photo and the associated typed values are also processed by a third-party AI vision model (Google's Gemini API) to compute a verification verdict, which is returned to the owner alongside the entry.
Payment information
If you subscribe to a paid plan, your payment is processed by our payments provider, Dodo Payments. We receive confirmation of your subscription and plan status. We do not receive or store your full card details. See our Billing and Refund Terms for how billing works.
Usage and technical data
We collect basic usage and technical information needed to operate and protect the Service, such as request logs, general device and browser information, timestamps, and network information used for security and rate limiting. We use this to keep the Service reliable and to prevent abuse.
Why we collect this information
We use the information above only to provide and support the Service, specifically to:
- Authenticate account owners and keep accounts secure.
- Store spreadsheet content and return submitted data to the correct cells.
- Deliver Magic Links and accept submissions from field reps.
- Run AI photo verification when an owner turns it on.
- Process subscription payments and manage plan limits.
- Protect the Service against abuse, including rate limiting and troubleshooting.
- Communicate with account owners about their account and the Service.
Service providers we use
We rely on a small number of third-party providers to run the Service. We share data with them only as needed to provide the Service, and each provider processes data under its own terms and privacy practices:
- Clerk handles owner account authentication, including email and sign-in data.
- Neon provides the PostgreSQL database where spreadsheet content, ledgers, and application data are stored.
- Cloudflare stores uploaded photos in R2 object storage, and serves the application through Cloudflare Pages.
- Dodo Payments processes subscription payments. Full card details are handled by Dodo Payments and are not stored by us.
- Google Gemini API receives an uploaded photo and its associated typed values in order to compute a verification verdict, when AI photo verification is enabled by the owner.
We do not sell personal information, and we do not share it with advertisers. Each provider named above maintains its own data handling and privacy practices for the data it processes on our behalf.
Who controls the data: owners, field reps, and third parties
This is central to how Aeluka Sheets works. When an account owner builds a form and collects data from field reps or other people through a Magic Link, the account owner is the controller of that data. The owner decides what to collect, why, and from whom. Aeluka Sheets processes that data on the owner's behalf, as a tool the owner uses to run their own collection.
Because of this, each account owner is responsible for:
- Having the lawful right, basis, or consent to collect data about their field reps and any other individuals whose information they gather through the Service.
- Telling those individuals how their data will be used, as required by any laws that apply to the owner.
- Only collecting data the owner is permitted to collect, and using it lawfully.
If you are a field rep or another person whose data was collected through a Magic Link and you want to access, correct, or delete that data, please contact the account owner who invited you, since they control it. You may also contact us at contact@aeluka.com and we will assist the relevant owner where appropriate.
Field reps and Magic Links
Field reps use the Service without creating an account and without signing in. A rep opens a Magic Link in a phone or computer browser and submits the fields the owner asked for, optionally with a photo. The rep form can work offline: a rep can open the link once while online, keep filling entries with no connection, and the entries sync to the owner when the device is back online. An owner can revoke or close a Magic Link at any time.
Cookies and sessions
For account owners, we use cookies that are necessary for authentication and to keep you signed in during a session. These are set as part of the sign-in process handled by Clerk. We do not use these cookies for advertising. The field rep form may store data locally on the rep's own device so it can work offline; that local storage is used to queue and send submissions, not to track people across sites.
Data retention and deletion
We retain account and content data for as long as your account is active or as needed to provide the Service. Account owners can delete their own content, including ledgers, Magic Links, entries, and uploaded photos, from within the Service. When you delete content, it is removed from your view and deleted from our storage through our normal deletion processes. You can also request deletion of your account and associated data by emailing contact@aeluka.com. Some limited information may be retained where necessary to comply with legal obligations, resolve disputes, or enforce our agreements.
Your rights and requests
Depending on where you live, you may have rights to access, correct, export, or delete personal data. Account owners can export any ledger to an Excel file at any time, and can edit or delete their content directly. To make a privacy request, email us at contact@aeluka.com. For data an owner collected from field reps or third parties, we will route your request to, or act on the instructions of, the owner who controls that data.
Children's privacy
The Service is not directed to children and is intended for use by businesses and other organizations. We do not knowingly collect personal information from children. Account owners must not use Magic Links to collect data from children unless they have the proper legal authority and consent to do so.
International data transfers
The providers we use may store and process data in different countries. This means that data handled through the Service, including data an owner collects, may be transferred to and processed in countries other than the one you live in. We rely on established providers to handle that data with appropriate safeguards.
Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page, and where a change is material we will make reasonable efforts to provide additional notice. Your continued use of the Service after an update takes effect means you accept the updated policy.
Contact
For any questions about this Privacy Policy or about how your data is handled, contact us at contact@aeluka.com.