Privacy Policy
Last updated: 28 October 2026.
Sammanfattning på svenska: Kronkalkyl samlar inte in, säljer eller lagrar dina kalkylarksdata på egna servrar. Kontroller av person-, organisations-, konto-, OCR- och gironummer räknas helt inom Google Apps Script. Endast valutakod och datum skickas till Sveriges riksbank/ECB, momsregistreringsnummer till EU-kommissionens VIES och licensnyckeln till vår betalpartner Polar. Personuppgiftsansvarig: Niklas Bergström, drudleybot+kronkalkyl@mail.grokbot.com.
1. Who we are
Kronkalkyl ("the add-on") is a Google Sheets™ Editor add-on provided by Niklas Bergström, Tråggränd 20, 906 26 Umeå, Sweden ("we"). Contact: drudleybot+kronkalkyl@mail.grokbot.com.
2. What the add-on accesses and why
| Google permission (OAuth scope) | Why it is needed |
|---|---|
spreadsheets.currentonly – view and manage the spreadsheet the add-on is used in | To read the cells you pass to Kronkalkyl formulas or select in the batch-validation tool, and to write validation results into the empty column you choose. The add-on cannot open any other file in your Google Drive. |
script.container.ui – display content in Google Sheets | To show the Kronkalkyl menu and sidebar. |
script.external_request – connect to external services | To fetch exchange rates, check EU VAT numbers and validate your licence key (see section 3). |
We do not request access to your Gmail, Google Drive, contacts, calendar or profile.
3. Data sent to third parties
- Sveriges riksbank (api.riksbank.se) and, as a fallback, the European Central Bank (data-api.ecb.europa.eu): only a currency code and a date range. No spreadsheet content or personal data.
- European Commission VIES (ec.europa.eu): the VAT number you pass to
VAT_VALIDor the batch tool. We read only the valid/not-valid flag from the response; trader names and addresses returned by VIES are discarded and never stored or shown. - Polar Software Inc. (api.polar.sh), our Merchant of Record: your licence key, to check whether your subscription is active. Purchases are made on Polar's checkout, and Polar processes your name, e-mail and payment details under its own privacy policy. We receive order and customer details from Polar to provide support and meet accounting obligations.
Personal identity numbers (personnummer), organisation numbers, bank accounts, OCR, Bankgiro and Plusgiro numbers are validated entirely inside Google Apps Script and are never sent to any external service.
4. Data stored
- In your spreadsheet's add-on storage (Document Properties): your licence key (if you activate one), its last validation status and the start date of your free trial.
- In your Google account's add-on storage (User Properties): your licence key, so you can apply it to other spreadsheets, and the start date of your free trial, so the 14-day trial is used once per account.
- In Google's temporary script cache (max 6 hours): downloaded exchange rates, VAT-number validity results (the VAT number and true/false) and licence validation results keyed by a one-way hash of the key.
- In Google's Apps Script execution logs: when a Kronkalkyl formula returns an error, Google records the error message for the add-on's developer. For invalid input the message can include the value you entered (for example an invalid number). These logs stay within Google Cloud, are used only to diagnose faults, and are deleted automatically under Google's standard log retention.
Apart from the values listed in section 3, no spreadsheet data leaves Google.
We run no servers of our own that receive your spreadsheet data. We do not use analytics or advertising trackers in the add-on. Uninstalling the add-on stops all processing; the cache expires within 6 hours, and "Remove licence" in the sidebar deletes the licence key and its status from that spreadsheet. The copy saved in your Google account's add-on storage is held only by Google for your account and is never sent to us; e-mail drudleybot+kronkalkyl@mail.grokbot.com if you need help removing it.
5. Google API Services User Data Policy
Kronkalkyl's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell user data, do not use it for advertising, do not use it to train AI/ML models, and do not allow humans to read it except with your explicit consent for support, for security purposes, or to comply with law.
6. Legal basis and your rights (GDPR)
We process licence and customer data to perform our contract with you (Art. 6(1)(b) GDPR) and to meet bookkeeping obligations (Art. 6(1)(c)). You may request access, rectification, erasure, restriction or portability, and object to processing, by e-mailing drudleybot+kronkalkyl@mail.grokbot.com. You may lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se.
7. Retention
Customer and order records are kept for as long as required by the Swedish Bookkeeping Act (currently 7 years). Cached data expires within 6 hours.
8. Changes
We will post changes on this page and update the date above. Material changes will be announced in the add-on sidebar.