Privacy Policy — Planilheo: Sheets Sync

Last updated: 10 November 2026

1. Who we are

"Planilheo: Sheets Sync" (the "App") is provided by Dobeo ("Dobeo", "we", "us"), operated by Ricardo Carapeto (trading as Dobeo), Rua Zamenhof 4, 2.º Dto, 2830-325 Barreiro, Setúbal, Portugal. Ricardo Carapeto, trading as Dobeo, is the controller of the personal data described in this policy.

Contact: support@dobeo.com.

This policy applies to the App and to the pages served at planilheo-sheets.dobeo.com. Our Terms of Service are at https://planilheo-sheets.dobeo.com/terms.

2. Summary

• The App reads products and variants only. It does not access orders or customers.
• We do not store your product catalog on our servers. Product data passes through server memory on its way to Google and is then discarded.
• The App can only reach the one spreadsheet it creates in your Google Drive. It cannot see, list, read or change any other file.
• Shopify and Google tokens are encrypted at rest (AES-256-GCM) and all traffic uses HTTPS/TLS.
• We do not sell data, do not show ads, and do not use your data to train AI or machine-learning models.
• You can disconnect Google or uninstall the App at any time, and your data is deleted as described in section 11.

3. Information we collect

3.1 From your Shopify store (through Shopify APIs)

The App requests one scope: read_products. It does not request Protected Customer Data. The App uses only the store's offline access token. It does not store names, emails or other data of staff accounts.

3.2 From your Google account

The App requests these Google scopes: openid, email and https://www.googleapis.com/auth/drive.file. It never requests the spreadsheets or drive scopes. See section 6 for full details.

We do not read your name or profile photo.

3.3 From you and automatically

4. Information we do not collect

• Customer data of your store
• Orders
• Payment data (billing is handled by Shopify; we do not receive or store payment details)
• Staff account names, emails or other staff data
• The content of other files in your Google Drive
• The content of the cells in your spreadsheet (the App never reads cell contents)

5. How we use information

We use information to:

• provide the service (create and update your spreadsheet);
• show you the status of your connection and syncs in the App;
• schedule syncs (daily on Starter, hourly on Pro, plus manual "Sync now");
• keep the service secure and diagnose problems;
• answer support requests;
• meet legal obligations.

We have no other uses. We do not use information for advertising, we do not build profiles, and we do not make automated decisions that affect you.

6. Google user data

This section is self-contained and describes how the App handles data received from Google APIs.

Data we access. Through the scopes openid, email and drive.file, the App accesses: (a) your Google email address and account identifier; and (b) the spreadsheet the App itself creates in your Drive. With drive.file, the App can only access files it created. It does not see, list, read or change any other file in your Drive.

How we use it.

• Create the spreadsheet (titled Planilheo · <store>, with a tab named Produtos).
• Check that the spreadsheet still exists and is not in the Trash.
• Read the tab properties (ID, title, number of rows).
• Write the product rows and clear leftover rows.
• Show the connected account's email in the App.

The App never reads cell contents and never deletes the spreadsheet.

How we store it. Google access and refresh tokens are encrypted at rest with AES-256-GCM. The email address and Google account identifier are stored in plain text in our database (Cloudflare D1), together with the spreadsheet and tab IDs and the connection status.

Who we share it with. Nobody, other than our hosting provider (Cloudflare) acting as our processor. Product data you ask us to write goes to Google, into your own spreadsheet.

Retention. When you disconnect Google, the App revokes access with Google and immediately deletes the Google tokens and the account email. The Google account identifier and spreadsheet ID are kept so that reconnecting the same account reuses the same spreadsheet; they are removed with the rest of your store's data (see section 11).

How to revoke and delete. See section 7.

Planilheo: Sheets Sync's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In line with that policy:

• We do not transfer Google user data to third parties, except as necessary to provide the feature you use, to comply with applicable law, or for security purposes.
• We do not use Google user data for advertising.
• We do not use Google user data to train artificial intelligence or machine-learning models.
• No person reads your Google user data, except with your express consent, for security purposes, or where required by law. Our logs record only error names and status codes.

7. How to disconnect Google and delete your data

You can do any of the following:

1. Disconnect Google in the App. Click "Disconnect Google". The App revokes access with Google and deletes the Google tokens and account email right away.
2. Revoke access in your Google account. Go to https://myaccount.google.com/connections and remove "Planilheo: Sheets Sync".
3. Uninstall the App from your Shopify admin. See section 11 for what is deleted and when.
4. Email us at support@dobeo.com and ask us to delete your data. We reply within 30 days.

8. Your spreadsheet

The spreadsheet lives in your Google Drive and belongs to you. You control who it is shared with. Dobeo never deletes it, and once access is revoked we can no longer reach it.

On each sync the App rewrites columns A–O of the tab it manages. Anything you type in those columns is replaced. Other tabs, and columns to the right of O, are not touched.

9. Sharing and service providers

We do not sell your data. We do not "share" it in the sense of the CCPA/CPRA (no cross-context behavioral advertising).

No one else receives your data.

10. International transfers

Cloudflare operates a global network and the region of our database is not fixed, so your data may be processed in the United States and in other countries. Transfers are covered by the transfer mechanisms in Cloudflare's data processing agreement (including standard contractual clauses and equivalents). We make no commitment about specific regions. Support emails are stored by Zoho Mail on servers in the United States, under the safeguards in Zoho's data processing terms (including standard contractual clauses).

11. Retention and deletion

12. Security

• Shopify and Google tokens (access and refresh) are encrypted at rest with AES-256-GCM, using a random IV on each write and binding the ciphertext to the store (additional authenticated data). The key is held as a Cloudflare Workers secret and supports rotation.
• All data in transit uses HTTPS/TLS.
• Shopify webhooks are verified by HMAC.
• Google OAuth uses PKCE and a signed, single-use state.
• Tokens, request bodies and product data are never written to logs.

If an incident affects your data, we will notify affected merchants without undue delay.

13. Legal bases

Where the GDPR or UK GDPR applies (and, similarly, the Brazilian LGPD), we rely on:

• Performance of a contract: to provide the service you ask for.
• Legitimate interests: security, diagnostics and preventing abuse.
• Legal obligation: where the law requires us to keep or disclose information.

14. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or port your personal data, and to object to its processing. Under the LGPD and the CCPA/CPRA you have equivalent rights, including the right to know what we hold and to ask us to delete it. You can also lodge a complaint with your data protection authority.

To exercise a right, email support@dobeo.com. We reply within 30 days. We will not discriminate against you for exercising your rights.

15. Customers of merchants

The App does not store data about the customers of the stores that use it. If you are a customer of a store, please contact that store about your data.

When Shopify sends the privacy webhooks customers/data_request and customers/redact, the App acknowledges them. Because it holds no customer data, there is nothing to export or delete. shop/redact is handled as described in section 11.

16. Cookies and tracking

The App sets no cookies and does not use localStorage. Authentication uses Shopify session tokens. There is no analytics, no advertising and no third-party SDK. Pages load scripts and fonts from Shopify's CDN (cdn.shopify.com).

17. Children

The App is a business service and is not directed at children.

18. Changes to this policy

We show the date of the last update at the top of this page. We will tell you in the App about material changes. We will not use Google user data in any new way without your prior consent.

19. Contact

Email: support@dobeo.com
Address: Rua Zamenhof 4, 2.º Dto, 2830-325 Barreiro, Setúbal, Portugal

Terms of Service: https://planilheo-sheets.dobeo.com/terms