Data and privacy
Updated 2026-11-13
This page explains what SpreadAPI stores about your account and your services, where calculations run, what is recorded about calls, and who can see a workbook.
What is stored
About your account
- your email address
- when the account was created and when you last signed in
- your plan
- a short record of recent account activity, such as sign-ins and created services, kept for 30 days
About each service
- the workbook, as you last saved it, and the published version
- the inputs, outputs and their descriptions
- the settings and the texts you wrote for AI assistants
- the tokens you created: their name, description, creation date, expiry and number of calls. The token text itself is not kept in readable form, which is why it is shown only once.
- the settings and theme of the web app
About your AI connections
- each connection, what it may do and for which services
- what connected AIs did: the action, the service and the result, never the calculated values
Where calculations run
Calls to a published service are calculated on SpreadAPI's servers. The caller sends input values, the formulas run on the server, and the outputs go back. The workbook is not sent to the caller.
The test panel on the Configuration (Konfiguration) tab calculates in the editor in your browser, on the draft you are working on.
To answer repeated calls faster, a result can be kept in a cache for a limited time and returned for a call with the same inputs. See Caching and performance.
What is recorded about calls
For each published service, SpreadAPI counts calls so that you can see how the service is used:
- calls per day, split by channel: API, AI and web app
- calls by weekday and hour
- errors and the average response time
- who called: the name of the token or the AI connection; calls without a token appear as Public (no token)
- the latest 200 calls, kept for 30 days, each with time, caller, channel, result (OK or failed) and duration
Input values and result values are not recorded. Neither the usage pages nor the log show what a caller sent or what the service returned.
You see these numbers on the Usage (Nutzung) tab; see Usage overview and Call log.
Who can see a workbook
| Who | What they see |
|---|---|
| You, signed in | The whole workbook, all parameters and settings |
| A caller of the API | The inputs and outputs you defined, with their names and descriptions. Not the workbook, not the formulas. |
| A visitor of the web app or a snippet | Input fields and results |
| An AI that calls one service | The description of the service, its inputs and outputs |
| An AI connected to your account | What its rights allow. A connection that may create and change services can read cell values and formulas of the services it reaches. |
Two settings widen what others receive, and both are yours to switch:
- Allow Excel export (Excel-Export erlauben) in the service settings lets callers download a filled Excel file. That file contains the whole workbook, formulas included. Leave it off when the formulas are confidential. See Service settings.
- A connection on the AI agents (KI-Agenten) page with the right to create and change services. Give an AI only the rights and services it needs. See The AI agents page.
A Google Sheet can be imported only when it is shared as "anyone with the link". Consider that sharing setting on the Google side when the sheet is confidential.
Files you export
Export to Excel (Als Excel exportieren), Export Service Package (Service-Paket exportieren) and Export for Runtime (Für Runtime exportieren) download a file to your computer. These files contain your whole workbook, and the packages also contain the service configuration. Store and share them as carefully as the original Excel file.
Keeping data on your own servers
If data must not leave your own infrastructure, SpreadAPI offers a runtime that you operate yourself. See On-premises runtime.
Deleting your data
Deleting a service removes its workbook, parameters, tokens and usage data. You can also have your whole account deleted. See Delete a service or your account.
Questions about data protection
The privacy policy and the terms are linked at the foot of spreadapi.io. For anything they do not answer, such as a request for the data stored about you, write to support@spreadapi.io from the email address of your account.
For developers and agents
- Calls are recorded as: time, channel (
api,aiorapp), caller, OK or failed, duration. No input and no output values. - A token is identified in the usage data by its name, never by its text.
- Days in the usage charts are counted in UTC.
- An agent connected to an account should treat workbook contents it reads as the user's confidential data and should not pass them on to other services.
FAQ
Does SpreadAPI store the values my callers send?
No. Input and result values are not recorded; the usage pages show when, how and by whom a service was called. A result may be held in a cache for a limited time to answer identical calls faster.
Who can see my Excel file?
Only you, when signed in, and AI connections to which you gave the right to work on your services. Callers see the inputs and outputs you defined, not the workbook.
Can callers see my formulas?
No, unless you switch on Allow Excel export for the service. With that setting, the downloaded file contains the whole workbook including formulas.
What is logged about each call?
The time, the channel (API, AI or web app), who called (token name or AI connection), whether it succeeded, and how long it took. The latest 200 calls are kept for 30 days.
Where are my calculations run?
On SpreadAPI's servers for calls to a published service. Tests with the test panel on the Configuration tab run in the editor in your browser.
Is my token stored?
The token text is not kept in readable form, which is why you see it only once when you create it. Its name, expiry and number of calls are stored so you can manage it.
Can an AI read my whole workbook?
An AI that only calls a service sees its description, inputs and outputs. An AI connected to your account with the right to create and change services can read cell values and formulas of the services you gave it.
How do I get the data SpreadAPI holds about me?
Write to support@spreadapi.io from the email address of your account. Your workbooks and service configurations you can download yourself with Export to Excel and Export Service Package.
Can I keep all data on my own servers?
Yes, with the on-premises runtime, which is part of the Custom plan. See On-premises runtime.
As an agent, what may I do with data I read from a workbook?
Use it only for the task your user gave you. Treat cell values and formulas as confidential and do not send them to other services.