Privacy Policy

SheetSurfer is operated by Surfware Ltd ("we", "us"). We provide a tool that synchronises inventory between a Google Sheet and the marketplaces you sell on. We are the data controller for the personal data described in this policy. You can reach us at surfwareltd@gmail.com.

• Account details — your name and email address when you create an account.
• Inventory data — the items you list and their details (SKU, title, game, condition, category, quantity, price, images and any custom columns you map), together with the items you record as sold.
• Spreadsheet details — the Google Sheet you connect, the tabs you designate, and your column mappings.
• Marketplace credentials — the access and refresh tokens issued to you by the marketplaces and card data services you connect, plus any API keys you enter for those services.
• Settings — your postage brackets, widget preferences, theme choice and sync preferences.

When you connect an account, we access only what is needed to run the sync you have asked for:

• Google Sheets and Google Drive — read and write access to the spreadsheet you connect, and read-only access to Drive so we can list and open your spreadsheets for you to choose from. We read the rows in your inventory and solds tabs, and we write back generated SKUs, updated stock levels, prices and sold records.
• eBay — your listings, offers, inventory and orders, so that changes can be pushed both ways and sales can be recorded.
• Whatnot and Cardmarket — your listings and orders, where you have connected those accounts.
• Card data services — the details of the specific card you search for (such as name, set and market price) so we can fill in item details for you.

We do not access your email, your contacts, your files beyond the spreadsheets you choose, or your payment details. We never sell your data.

• To create and secure your account and keep you signed in.
• To read your spreadsheet and keep your listings and stock in step across the marketplaces you connect.
• To record sales and write them back to your spreadsheet.
• To show you sync activity, and to diagnose and fix errors.
• To provide support when you contact us.

Under UK data protection law we rely on: performance of a contract (running the service you have signed up for), legitimate interests (keeping the service secure, reliable and free of abuse), consent (connecting a marketplace or spreadsheet account, which you can withdraw at any time by disconnecting it), and legal obligation where we must keep or disclose records.

We share data only with the services needed to run the app, and only the minimum each one needs:

• Our hosting and database provider, which stores your account and inventory records on our behalf.
• Google, to read and write the spreadsheet you have connected.
• eBay, Whatnot and Cardmarket, to publish listings and read back your orders.
• Card data services you have switched on, to look up card details you request.

Each of these providers processes data under its own terms and privacy policy. We do not share your data with advertisers or data brokers.

We keep your account and inventory data for as long as your account is open. When you delete your account, we delete or anonymise your personal data within 30 days, except where we must keep records to meet a legal, tax or accounting obligation. Marketplace tokens are revoked or deleted when you disconnect that marketplace. See Data Deletion for the detail.

Data is transmitted over encrypted connections and stored on access-controlled infrastructure. Marketplace tokens are held server-side and are never exposed to your browser. Access to your records is restricted to your own account, and our backend verifies ownership of every item before it is read or changed. No system is perfectly secure, so please use a strong, unique password for your account.

Some of our providers process data outside the UK. Where that happens, transfers are covered by appropriate safeguards such as the UK International Data Transfer Addendum or the provider's approved standard contractual clauses.

You have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• receive your data in a portable format;
• object to, or ask us to restrict, certain processing;
• withdraw consent for a connected account at any time by disconnecting it.

To exercise any of these, email surfwareltd@gmail.com. If you are unhappy with our response you can complain to the Information Commissioner's Office (ico.org.uk).

The app is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.

If we make a material change to this policy we will update the date at the top of the page and, where the change is significant, tell you in the app.

Questions about this policy or your data? Email surfwareltd@gmail.com.