Privacy Policy

Andolasoft Inc. ("Andolasoft", "we") operates DashboardGPT and is the controller of the personal data described in this policy, except for personal data inside the datasets our customers upload, which we process on their behalf and under their instructions. You can reach our privacy team at info@andolasoft.com.

We collect the following categories of personal data:

• Account data: your name, work email address, password (stored only as a salted hash), organisation name and the workspaces you belong to.
• Customer Data: the files you upload, the datasets derived from them, the questions you ask, and the charts, insights and canvases you create. These may contain personal data about other people; you decide what to upload.
• AI configuration: provider credentials you choose to bring, stored encrypted and never shown back to the browser after saving.
• Usage and device data: IP address, browser type, pages visited, actions taken, timestamps and error reports, collected through server logs and, where you consent, product analytics.
• Communications: messages you send us through the contact form or by email, and our replies.
• Bot-protection signals: when you sign in or sign up, Google reCAPTCHA analyses interaction signals to distinguish people from automated traffic (see the Cookies section).

The public playground is anonymous. It issues a temporary session token that is held in memory, is not linked to an account, and is discarded when you leave.

We use personal data to:

• provide, operate and secure the Service, including authenticating you and preventing fraud and abuse;
• answer the questions you ask, which requires sending the question, a description of the relevant dataset schema with up to five sample values per column, and the aggregated results of the query to the configured AI provider — row-level data is queried in our analytics layer and only aggregates are returned to you;
• respond to your requests and support enquiries;
• understand how the Service is used so we can improve it, using analytics only where you have consented;
• send service messages such as verification emails, security alerts and material changes to our terms;
• comply with legal obligations and enforce our terms.

We do not sell personal data, and we do not use Customer Data to train general-purpose machine-learning models.

An owner or administrator of your organisation can connect a Google account so members can import Google Sheets as datasets. DashboardGPT then asks Google for read-only access with these scopes: "openid" and "email", to identify the connected account; "spreadsheets.readonly", to read the spreadsheets you choose to import; and "drive.metadata.readonly", to list the names and modification dates of your spreadsheets so you can pick one. DashboardGPT never creates, edits or deletes anything in your Google Drive or Google Sheets.

We access and use Google user data as follows:

• The Google account's email address is shown in your organisation's settings so you know which account is connected.
• Spreadsheet names and modification dates are listed when you choose a spreadsheet to import.
• The cell values of the worksheet and range you choose are read when you import it and whenever the dataset is refreshed, by you or on a schedule you set. They are stored as a dataset in your workspace and handled as Customer Data under this policy.
• When you ask a question about an imported sheet, the question, the column names and types, up to five sample values per column and the aggregated results of the query are sent to the AI provider configured for your workspace to produce the answer, as described in section 3.
• Access and refresh tokens are stored encrypted, are never sent to your browser or written to logs, and are used only by our servers to make the requests above.
• Disconnecting the account in DashboardGPT revokes our access at Google and deletes the stored tokens. Datasets already imported stay in your workspace until you delete them. You can also remove our access at any time from your Google Account at https://myaccount.google.com/connections.

DashboardGPT's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

In particular, we use Google user data only to provide and improve the user-facing features described above. We do not use it for advertising, we do not sell it, and we transfer it to others only as needed to provide those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to you. Our staff do not read it unless you give us permission to for support, it is necessary for security purposes such as investigating abuse, or it is required to comply with applicable law. We do not use Google user data to develop, improve or train generalised or non-personalised AI or machine-learning models.

Where the GDPR, the UK GDPR or similar laws apply, we rely on: performance of a contract (providing the Service you signed up for); our legitimate interests (securing the Service, preventing abuse, improving the product) balanced against your rights; your consent (optional cookies and analytics, which you can withdraw at any time); and compliance with legal obligations.

We share personal data only with:

• infrastructure providers that host the Service and store data on our behalf, including cloud compute and object storage;
• AI providers, limited to the prompts needed to answer your questions. Where you bring your own key, the provider you chose receives those prompts under your agreement with it;
• Google, for reCAPTCHA on the sign-in and sign-up forms and, only when you choose a language other than English on this website, for Google Translate, which receives the page text to translate it in your browser;
• email delivery providers, for the service messages described above;
• professional advisers, regulators and law enforcement where required by law or to protect rights, safety and property;
• a successor in the event of a merger, acquisition or asset sale, subject to this policy.

Members of your workspace can see the datasets, canvases and activity you create in it, according to the roles your workspace administrator assigns.

Andolasoft Inc. is based in the United States and processes data there and in the regions where our providers operate. Where we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on recognised safeguards such as the European Commission's Standard Contractual Clauses.

Account data is kept for as long as your account exists and for a short period afterwards to complete deletion and meet legal obligations. Customer Data is kept until you delete it or close your account, after which it is removed from active systems within thirty days and from backups on their normal rotation. Server logs are retained for up to ninety days. Contact-form messages are retained for as long as needed to handle the enquiry.

All traffic is encrypted in transit with TLS. Uploaded files and dataset metadata are encrypted at rest. Every dataset is isolated to the workspace that owns it, enforced in the database as well as the application. Provider credentials are encrypted with keys held apart from the data. Access by our staff is limited, logged and reviewed. No system is perfectly secure, so please report any concern to the security address below.

We use a small number of cookies and browser-storage entries, grouped into the categories you can control from the cookie preferences panel:

• Essential — required for the site to work: the session cookies that keep you signed in to the BI Workspace, the single-use handoff that moves a sign-in from this site to the workspace, the cookie that records your cookie choices, and Google reCAPTCHA, which protects the sign-in and sign-up forms from automated abuse. These cannot be switched off.
• Preferences — remembers choices such as your light or dark theme and the language you read this website in. Off by default until you opt in. Choosing a language other than English sets Google Translate's "googtrans" cookie for the rest of your browser session even without this opt-in, because the translation cannot work without it.
• Analytics — anonymous product analytics that tell us which pages and features are used, so we can improve them, delivered through Google Tag Manager. Off by default until you opt in; the container is not loaded until you do.

You can change your choices at any time from the "Cookie preferences" link in the footer, and your browser lets you delete cookies or block them entirely, though blocking essential cookies will prevent you from signing in. Google's use of information collected by reCAPTCHA is described in Google's Privacy Policy and Terms of Service.

Depending on where you live, you may have the right to access the personal data we hold about you, to correct or delete it, to restrict or object to its processing, to receive a portable copy, and to withdraw consent where processing is based on consent. Residents of California and other US states with comprehensive privacy laws have equivalent rights, including the right to know, delete and correct, and the right not to be discriminated against for exercising them. We do not sell or share personal data for cross-context behavioural advertising.

To exercise any right, email info@andolasoft.com. We will verify your identity and respond within the time the law requires. You also have the right to complain to your local data-protection authority.

Where personal data is inside a customer's dataset, the customer decides how it is used; please direct requests to them, and we will help them respond.

The Service is a business tool and is not directed at children under 16. We do not knowingly collect personal data from children; if you believe a child has provided us with personal data, contact us and we will delete it.

We will post any changes to this policy on this page and update the "last updated" date. For material changes we will notify account holders by email or in the product before they take effect.

Privacy questions and requests, security reports and anything else: info@andolasoft.com, or the contact form on this website. Postal correspondence can be addressed to Andolasoft Inc. at the address published on https://www.andolasoft.com.