Privacy Policy

Introduction

Prudent Autolytics LLP (“Prudent Autolytics”, “we”, “our”, or “us”) is committed to protecting your privacy. This Privacy Policy explains how PA Smartsheet Tools (“the Extension”) collects, processes, stores, and protects information when you use the Chrome extension.

PA Smartsheet Tools is an enterprise productivity extension designed specifically for Smartsheet users. It provides analysis, productivity enhancements, reporting, automation integration, optional AI-powered assistance, and governance tools while operating within authorised Smartsheet workspaces.

Who we are

For the purposes of the UK GDPR, the EU GDPR, and India’s Digital Personal Data Protection Act, the data controller for information processed by the Extension is:

Prudent Autolytics LLP
Gods Grace Building, Plot No. 19, Second Floor
Sector 16, Panvel, Raigad
Maharashtra 410206, India
support@prudentautolytics.com

Where you use the Extension against your employer’s Smartsheet environment, your organisation is generally the controller of the Smartsheet content processed, and Prudent Autolytics acts as a processor in respect of that content.

What the extension does

The Extension enhances Smartsheet by providing features such as:

• Sheet Health Analysis
• Formula Analysis
• Change Impact Analysis
• Data Quality Analysis
• Attachment Management
• Smart Search and Smart Sort
• Flow Buttons
• Report Generation and Export Utilities
• Local Audit History
• Optional AI-powered explanations and recommendations
• Enterprise productivity tools

The Extension only performs actions you request, or actions you have configured yourself (such as scheduled reports or alerts).

Information we process

Smartsheet account information

When you authenticate with Smartsheet, the Extension may access your display name, email address, Smartsheet user ID, account ID, and account name. This information is used only to authenticate you, to validate your licence, and to display your identity within the Extension.

Smartsheet sheet data

When you use the Extension, it may process information from Smartsheet sheets you are authorised to access, including sheet names, column names, row data, cell values, formulas, attachments, reports, and cross-sheet references. This information is processed only to perform the feature you request, and only for as long as that operation takes.

Licensing information

To manage licensing and subscription access, the Extension communicates with Prudent Autolytics licensing services. Depending on your deployment, licensing information may be stored in Microsoft SharePoint Online or other Microsoft Azure services operated by Prudent Autolytics. Licensing records may include your name, email address, Smartsheet user ID, account ID, licence status, trial status, licence activation and expiry, extension version, registration timestamp, and last validation timestamp.

No Smartsheet sheet content, formulas, attachments, reports, or business data are stored for licensing purposes.

AI requests

AI features are optional and are initiated only after an explicit action by you. When you request AI assistance, only the information necessary to complete that request is transmitted.

AI credentials are supplied by you or your organisation and are stored in your browser’s local extension storage. Requests are sent directly from your browser to Anthropic or to the Azure OpenAI endpoint you have configured. No shared Prudent Autolytics AI key is included in the Extension, and your AI requests do not pass through Prudent Autolytics systems.

Prudent Autolytics does not use customer Smartsheet data submitted through AI requests to train AI models. Anthropic and Microsoft Azure OpenAI likewise do not train their models on data submitted through their commercial APIs. Your use of those providers is governed by the terms of the account whose credentials you supply.

Flow Buttons

The Extension allows you to configure custom Flow Buttons. When you activate a Flow Button, the Extension sends only the row information you selected to the HTTP endpoint you configured.

Flow Button destinations are restricted to Microsoft Power Platform and Azure Logic Apps endpoints. The Extension validates the destination against those host families and cannot post to arbitrary addresses. Row data is never transmitted automatically; transmission happens only after you explicitly activate a Flow Button you configured.

Alert rules

You may configure alert rules that generate reports or notifications, including PDF reports and email notifications to recipients you specify. Recipients are entirely under your control.

Legal bases for processing

Where the UK or EU GDPR applies, we rely on the following legal bases:

Local storage

The Extension stores operational information locally using Chrome Extension Storage. This may include authentication tokens, licence information, Flow Button configurations and URLs, alert rules, report schedules, sort profiles, a custom spell-check dictionary, backend configuration, theme preferences, local audit history, notification history, cached analysis results, and recently used features.

This information remains within your browser unless explicitly transmitted as part of an operation you request. Removing the Extension from Chrome deletes this locally stored data.

Authentication

Authentication is performed using Smartsheet OAuth. The Extension never receives or handles your Smartsheet password.

A Prudent Autolytics Azure Function completes the OAuth exchange, converting the authorisation code into an access token and returning it securely to the Extension over HTTPS. The OAuth service does not store user access tokens. Tokens are held only in your browser’s local extension storage.

Third-party services and hosts

The Extension communicates only with the hosts declared in its manifest. Each is listed below with the reason it is required. Broad host access was deliberately removed in version 12.1.3 so that the Extension requests the narrowest access consistent with its functionality.

Amazon S3 appears in this list because Smartsheet itself returns attachment downloads as temporary, pre-signed Amazon S3 URLs. The Extension follows those links to retrieve an attachment you asked for. Prudent Autolytics operates no S3 storage and writes nothing to it.

Chrome extension permissions

The Extension requests only the permissions required to provide its functionality:

Downloads and notifications

You may export Excel files, CSV files, PDF reports, JSON exports, Formula Analysis reports, Change Impact reports, and Audit History. Downloads occur only after an explicit action by you, or on a schedule you configured.

Notifications are used only to report completed operations, deliver alerts you configured, confirm exports, display extension status, and notify you of scheduled operations. Notifications are never used for advertising.

Data sharing

We do not sell or rent user data. Information is shared only with the services necessary to provide the functionality you request: Smartsheet, Microsoft Azure, Microsoft SharePoint Online, Microsoft Power Platform, Azure Logic Apps, Amazon S3 (for Smartsheet attachment delivery), and, where you have supplied credentials and invoked an AI feature, Azure OpenAI or Anthropic.

The Extension does not share information for advertising or marketing purposes.

No analytics or telemetry

PA Smartsheet Tools contains no advertising identifiers, behavioural analytics, usage telemetry, or third-party tracking. We do not monitor browsing activity outside authorised Smartsheet pages.

For clarity: the Extension contacts our licence service periodically to confirm your licence remains valid. Those requests transmit only the licensing identifiers listed above; they do not report which features you used, which sheets you opened, or any sheet content. Records of feature usage remain in your browser and are never transmitted to us.

Data retention

Local extension data remains in Chrome until you remove it. Uninstalling the Extension deletes it.

Information stored for licensing and subscription management is retained while your licence or trial is active. Following expiration or termination, licensing records may be retained for up to 24 months to provide customer support, resolve licensing disputes, prevent fraud, and meet legal or contractual obligations. After this period, records are securely deleted or anonymised unless a longer retention period is required by law.

International transfers

Depending on the services used, information may be processed in:

• Microsoft Azure, including the Central India region
• Microsoft SharePoint Online
• Smartsheet cloud infrastructure
• Microsoft Power Platform and Azure Logic Apps
• Azure OpenAI or Anthropic, where you have configured AI features

Processing locations vary based on your own Microsoft, Smartsheet, and AI provider configuration.

Your business data stays out of our hands

The Extension is built so that your Smartsheet content never reaches us. Row data, cell values, formulas, attachments, reports, and cross-sheet references are exchanged directly between your browser and Smartsheet. AI requests go directly to the provider whose credentials you supplied. Flow Button payloads go directly to the Power Platform or Logic Apps endpoint you configured.

None of that data is transmitted to, routed through, or stored on Prudent Autolytics infrastructure at any point. There is no proxy, no intermediate server, and no copy of your sheets on our side, so there is nothing for us to lose, disclose, or transfer.

The one exception: your licence

Two small services do run on our own infrastructure: the OAuth service that completes the Smartsheet token exchange, and the licence service that confirms your subscription is valid. They handle the account and licensing identifiers described above and nothing else: no Smartsheet business content of any kind. Both are hosted on Microsoft Azure, in Microsoft’s Central India region, and inherit the certifications and security controls of that platform.

Prudent Autolytics LLP is established in India, which is not covered by a European Commission adequacy decision. These licensing identifiers are therefore the only data involved in an international transfer. Customers who require a data processing agreement incorporating the European Commission’s Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 2), or the ICO International Data Transfer Addendum (version B1.0) for UK transfers, can request one from support@prudentautolytics.com.

Security

We protect information using HTTPS encryption in transit, OAuth authentication, secure Microsoft Azure services, Microsoft security controls, and role-based administrative access.

No system can guarantee absolute security; however, we work continuously to protect customer information.

Breach notification

In the event of a personal data breach affecting information we hold, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, as required by Art. 33 GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will notify affected users directly without undue delay.

Children’s privacy

PA Smartsheet Tools is intended for business and professional users. It is not directed toward children under the age of 13, and we do not knowingly collect information from them.

Your rights

Depending on your location, you may have the right to request:

• Access to the personal information we hold about you
• Correction of inaccurate or incomplete information
• Deletion of licensing records
• Restriction of, or objection to, certain processing
• A portable copy of information you provided to us
• Information about how your data is processed

Submit requests to support@prudentautolytics.com. We respond within 30 days. We may need to verify your identity before acting on a request. If you are in the EEA or UK and are unsatisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.

Changes to this policy

We may update this Privacy Policy periodically. The current version is always published at this URL, which is the address referenced by the Chrome Web Store listing. Where changes are material, we will update the effective date above and notify users through the Extension before the changes take effect.

Chrome Web Store compliance

PA Smartsheet Tools complies with the Chrome Web Store Developer Program Policies. Specifically:

• We do not sell user data.
• We do not use user data for advertising.
• We do not transfer user data except as required to provide functionality you requested.
• We collect only the information necessary to operate the Extension.
• AI processing occurs only after an explicit action by you, using credentials you supply.
• Data is transmitted securely using HTTPS.

The use of information received from Google APIs, where applicable, adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Contact

Prudent Autolytics LLP
Gods Grace Building, Plot No. 19, Second Floor
Sector 16, Panvel, Raigad
Maharashtra 410206, India

Website: https://prudentautolytics.com/
Email: support@prudentautolytics.com