Privacy Policy
1. Introduction & Overview
BulkVAT ("we", "our", or "the add-on") is operated as a UK sole proprietorship. This Privacy Policy describes how BulkVAT accesses, processes, and protects your information when you use our Google Sheets add-on and our website (bulkvat.com).
Core Architecture Principle: Zero Self-Hosted Servers. BulkVAT executes entirely inside your Google Sheets container via Google Apps Script. We do not operate external databases, cloud servers, or user telemetry collectors. Your spreadsheet data never enters our custody.
2. Google API Services User Data Policy & Limited Use Disclosure
BulkVAT's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically:
- We do not transfer user data to third parties, advertising platforms, data brokers, or information resellers.
- We do not use or transfer user data for serving personalized, retargeted, or interest-based advertisements.
- We do not use user data to train generalized artificial intelligence or machine learning models.
- Human personnel cannot read your spreadsheet data, as all operations execute locally within your browser and Google Sheets container.
3. Scopes of Access & Permissions
BulkVAT requests the absolute minimum OAuth scopes necessary to function:
| Scope URI | Purpose | Data Accessed |
|---|---|---|
https://www.googleapis.com/auth/spreadsheets.currentonly |
Read input tax ID numbers and write validation results | Limited exclusively to the open document. Cannot read other files on your Google Drive. |
https://www.googleapis.com/auth/script.container.ui |
Render the sidebar and settings modal | Display interface elements inside the Google Sheets window. |
https://www.googleapis.com/auth/script.external_request |
Query official tax authority APIs and license activation | Outbound HTTPS requests directly to European Commission VIES and Lemon Squeezy. |
4. Third-Party Data Transmissions
When you run a validation or enter a license key, direct encrypted HTTPS calls are initiated from Google's servers:
- European Commission VIES REST API (
ec.europa.eu): When verifying EU VAT numbers, the country code, VAT number, and your optional requester VAT number are transmitted directly to the European Commission to verify registration and retrieve company details. - Lemon Squeezy Public License API (
api.lemonsqueezy.com): When activating or verifying a Lifetime Pro key, your license key is validated against Lemon Squeezy (our Merchant of Record).
5. Data Storage & Retention
- Spreadsheet Content: We store zero spreadsheet rows. Validation results are written directly into your Google Sheet.
- User Settings: Your license key, cached verification status, and optional requester VAT credentials are stored strictly in Google Apps Script
PropertiesService.getUserProperties(), which is encrypted and accessible only to your Google account. - Web Analytics: Our static website (
bulkvat.com) does not use invasive third-party trackers, advertising cookies, or cross-site fingerprinting.
6. Your Rights (GDPR & UK GDPR)
Under UK GDPR and EU GDPR, you have full control over your data:
- Right to Revoke Access: You can disconnect BulkVAT at any time by navigating to Google Account Permissions.
- Right of Erasure: Deleting the add-on or clearing your spreadsheet immediately destroys all local session states. You can clear cached settings in the add-on settings modal.
7. Contact Information
For privacy inquiries, questions regarding data protection, or audit compliance, contact our Data Protection lead at:
Email: [email protected]