Privacy Policy

The data controller is Szabó Gergő (szbdev), sole proprietor (egyéni vállalkozó), established in Hungary, offering the Updevly service.

Privacy requests: info@szbdev.eu. We do not currently appoint a Data Protection Officer. If that changes, we will publish the DPO contact here.

A registered postal address and Hungarian tax identification number will be provided on request, and should be added to this policy as soon as they are confirmed for publication.

We collect:

• Account data from Clerk: email address, user identifier, session and authentication details, and any name or profile fields you provide.
• Formula requests you submit (prompt text, optional existing formula, error text, expected result, selected platform: Excel or Google Sheets).
• Chat transcripts for spreadsheet work in /chat, including guest threads tied to the updevly_anon_id cookie on that browser until you sign in and claim them.
• Workbook files you upload while signed in (.xlsx). Files are stored in Convex storage so the spreadsheet assistant can inspect structure and write formulas. The AI model receives a structural sample (sheet names, headers, used range, and a limited set of sample rows), not a dump of every cell.
• Generated output: formulas, explanations, notes, workbook change summaries, model identifier, and timestamps. Workbook binaries are not stored in the compact formula-history dashboard records.
• Usage and plan data: generation counts, plan (anonymous, free, or Pro), reservation status, and subscription status.
• Billing identifiers from Stripe: customer id, subscription id, price id, subscription status, and current period end. We do not receive or store full payment-card numbers.
• Support communications if you email us.
• Automatic technical data: IP address (for anonymous rate limits and security), browser cookie identifier for anonymous use, and standard server logs.

Please do not put passwords, payment-card numbers, health data, government IDs, or other special-category personal data into a formula request or workbook. We do not intend to collect special-category data under GDPR Article 9, children’s data, or biometric data.

• Directly from you when you start or continue a spreadsheet chat, generate, explain, or fix a formula, upload a workbook, create an account, subscribe, or contact us.
• Automatically when the site runs: necessary cookies, anonymous rate-limit counters, and security logs.
• From processors acting for us: Clerk (sign-in), Stripe (checkout and subscriptions), Convex (database and signed-in workbook storage), UploadThing (administrator files and any remaining UploadThing workbook path), PostHog (product analytics), Umami Cloud (public page analytics), and AI providers that receive the text or structural sample needed to generate a result.

We use personal data to:

• Provide the formula tools, history, and account (contract: GDPR Art. 6(1)(b); for anonymous use, legitimate interests in operating a limited public tool: Art. 6(1)(f)).
• Enforce free, anonymous, and Pro limits and prevent abuse (legitimate interests / contract).
• Process Pro subscriptions, invoices, taxes, and cancellations (contract and legal obligation for tax and accounting).
• Secure the service, debug failures, and defend legal claims (legitimate interests and legal obligation).
• Measure product usage with PostHog (page views, country, signed-in vs guest generations, and similar product events). Formula text and workbook files are not sent as event properties.
• Measure advertising performance and conversions with Google Ads and Google Tag Manager (legitimate interests in promoting the product; where GDPR requires consent for advertising cookies, we rely on that consent). Formula text and chat contents are not sent to these tags as page content.
• Respond to privacy and support requests (legal obligation and legitimate interests).

We do not use formula content for advertising. We do not currently send marketing emails. If we ever do, we will use consent or another lawful basis and provide an unsubscribe option.

We may create aggregated, de-identified statistics about usage (for example, how often a feature is used). Those statistics are not used to identify you.

We share data only with processors and providers needed to operate Updevly:

• Clerk — authentication and sessions.
• Convex — application database for accounts, chat threads, usage, subscription status, and signed-in workbook files.
• Stripe — checkout, subscriptions, invoices, and the billing portal.
• Vercel — website hosting, Web Analytics on public formula pages, and, where configured, AI Gateway routing.
• PostHog — product analytics (page views, visitor country, generation events, and similar product usage). Formula text is not included.
• Umami Cloud — cookieless page-view analytics on public formula pages.
• Google LLC — Google Ads (AW-714265731) and Google Tag Manager (GTM-P75JCHMR) for conversion measurement and advertising tags.
• UploadThing — storage for files administrators upload in the internal workspace, and any remaining UploadThing workbook path.
• Upstash Redis — short-lived anonymous rate-limit counters keyed to a browser id and IP address.
• AI model providers reached through our configured gateway (currently an OpenAI-family model unless we publish a change) — they receive the prompt and related formula text so a result can be generated. For workbook edits they receive a structural sample of the spreadsheet, not the full file.

These providers may store or process data in the United States and other countries. We may also disclose data if required by law, to protect rights and safety, or in a merger, sale, or reorganization, with notice where required.

Updevly is offered from Hungary (EU). Several processors are in the United States or other countries. Where GDPR or UK GDPR applies, transfers rely on an adequacy decision where one exists, or on Standard Contractual Clauses and the provider’s supplementary measures. Details are in each provider’s data processing terms.

• Anonymous rate-limit counters: up to 48 hours.
• Anonymous browser identifier cookie: up to 1 year, or until you clear cookies.
• Account, formula history, chat threads, and usage buckets: for as long as the account exists. Guest chats stay with the anonymous cookie on that browser until claimed on sign-in or the cookie is cleared. After a verified deletion request we aim to delete or anonymize them from live systems within 30 days, except data we must keep.
• Signed-in workbook files in Convex storage: kept with the chat they were uploaded to until the account or thread is deleted. We do not keep a full binary in compact formula-history records. The AI provider still receives only a structural sample.
• Billing and invoice records: as required for tax, accounting, and dispute handling (typically up to 8 years under Hungarian accounting rules, or longer if a claim is pending).
• Support emails: as long as needed to resolve the request, then as required by law.

Depending on where you live, you may have the right to:

• Access a copy of personal data we hold about you.
• Correct inaccurate data.
• Delete data (“erasure”), subject to legal retention.
• Restrict or object to certain processing, including processing based on legitimate interests.
• Receive data you provided in a portable format.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a supervisory authority.
• For California: know, delete, and correct personal information, and opt out of “sale” or “sharing” for cross-context advertising. We do not sell personal information. Google Ads and Tag Manager may use advertising cookies that California law treats as “sharing”; you can opt out with Google Ads Settings, your browser, or by emailing us.

To exercise rights, email info@szbdev.eu from the address on your account when possible. We may need to verify your identity. We aim to respond within 30 days (GDPR) or the time required by local law. You will not be discriminated against for exercising privacy rights.

EEA users may complain to their local authority or to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): naih.hu. UK users may contact the ICO.

Current cookies and similar storage:

• Clerk authentication cookies, set when you sign in — strictly necessary for the account.
• updevly_anon_id, an HTTP-only cookie used to apply the anonymous daily generation limit — strictly necessary for security and fair use of the free public tool.
• Convex/client session storage needed to talk to the backend while you use the product.
• PostHog analytics cookies (for example ph_*), used to count visitors, country, and product events such as generations.

We use PostHog on the product (including chat and account pages) to measure unique visitors, country, and events such as formula generations, checkout, and errors. We do not send formula text or workbook files as PostHog event properties. We do not load PostHog on administrator routes under /app.

We also use Vercel Web Analytics and Umami Cloud on public formula pages (generate, explain, fix, workbook, guides, pricing, and legal). They count page views without advertising cookies and without sending formula text. We do not load these analytics scripts on administrator routes such as /app, account routes such as /dashboard and sign-in, or spreadsheet chat routes under /chat (thread IDs are not sent as page paths).

We load Google Ads (gtag AW-714265731) and Google Tag Manager (GTM-P75JCHMR) so we can measure ad conversions and run tags configured in Tag Manager. Those scripts may set advertising or measurement cookies. They do not receive formula text or workbook files. You can block them with a browser privacy extension or Google’s ads settings.

If we add further cookies that are not strictly necessary, we will update this policy and, where GDPR requires it, ask for consent before setting them.

You can delete cookies in your browser. Clearing the anonymous cookie may reset the anonymous limit identifier.

We use HTTPS in transit, access-controlled cloud providers, authenticated APIs, and least-privilege access to production systems. No method of transmission or storage is perfectly secure. If we become aware of a personal-data breach that must be notified, we will notify the competent authority and affected users as required by law.

Updevly is not directed to children. You must be at least 16 years old, or the age of digital consent in your country if higher, to create an account. We do not knowingly collect personal data from children below that age. If you believe we have, contact us and we will delete it.

The site may link to Stripe Checkout, Clerk, or other sites. Their privacy practices are governed by their own policies.

We may update this policy when the product or the law changes. We will post the new version here and change the effective date. For material changes we will provide additional notice where required (for example, an email to account holders or a notice in the product). Continued use after the effective date means the updated policy applies, except where local law requires a different process.

Szabó Gergő, sole proprietor (egyéni vállalkozó), Hungary. Email: info@szbdev.eu. See also our Terms of Service.