Privacy Policy

Who we are

OmniVectors, a Cloud Labs LLC company, operates the PyExcelAI suite: a family of financial planning and analysis tools delivered as web applications — currently a set of retirement planners, with additional analysis tools rolling out over time — plus the original PyExcelAI add-in for Excel and Google Sheets (Mac support is on the roadmap). The technology behind the suite, including how it's deployed and how AI is routed, is described at Technology & Platform. We are a small, independent software team.

What we collect — and what we don't

We're built around a minimal-data principle. Here is the full picture, by product area:

• Web apps (retirement planners and other analysis tools as they launch) — if you create an account, we store your email address and the plan/portfolio inputs you choose to save (e.g. age, savings, spending targets). Free-tier use of most apps does not require an account at all, and unsaved sessions are not persisted beyond your browser.
• Ticker symbols and filing queries — entered by you, sent to our API to fetch SEC data, and not stored beyond the duration of the request unless you explicitly save a result.
• Server access logs — standard web-server logs (timestamp, IP address, HTTP method, response code) retained for up to 30 days for debugging and abuse prevention, then automatically deleted.
• Authentication — for email/password accounts we store a securely hashed password (never the password itself); for Google sign-in, OAuth tokens are managed by Google and your browser — we never receive or store your Google credentials.
• Billing — subscription and payment processing is handled by Stripe; we do not store your card details ourselves.

Data sources we use

Financial statement data is sourced from the SEC EDGAR public database (sec.gov), freely available to the public. We do not purchase, license, or resell proprietary financial data. Retirement projections are computed entirely from the numbers you enter — we do not pull your real account balances from any external institution.

How your data is used

• To run the calculation or fetch the data you requested.
• To let you return to a saved plan or account.
• To maintain service reliability and diagnose errors using server logs.
• To prevent abuse — rate-limiting and blocking malicious traffic using IP logs.
• To process payments for paid subscriptions, via Stripe.

We do not sell your data, and we do not use it for advertising or profiling.

Legal basis for processing

Where a legal basis is required (for example, under GDPR), we rely on: contract — running a calculation or saving a plan exists because you asked for it, and we can't provide the feature without processing what it needs; consent — optional features such as AI chat, which you can decline or stop using at any time without losing access to the core planning tools; and legitimate interest — fraud prevention and abuse detection via server logs, balanced against your right not to be over-monitored.

Third-party services

The suite relies on the following third-party infrastructure:

• Google Cloud / Google Workspace — for Google sign-in and the Google Sheets add-in, governed by Google's Privacy Policy.
• Anthropic, OpenAI, Google Gemini, Groq, and AWS Bedrock — AI features route your request (e.g. plan numbers, financial statement data, or your question) to whichever of these providers is best suited to it, to generate analysis and explanations. We do not include your name or account credentials in these requests. A response may be cached briefly to avoid re-computing the same request twice — see "Data retention" below.
• Stripe — for billing and subscription management, governed by Stripe's Privacy Policy.
• SEC EDGAR — public government API; no personal data is transmitted.

Google Sheets and Excel add-in — permissions and data access

The PyExcelAI add-in for Google Sheets requests the following Google account permissions when you install or use it. This section exists specifically to describe what each one is used for, in addition to the general description above.

• Read and modify your spreadsheet content — the add-in reads the cells, ranges, and sheets you're actively working with so it can display data, run AI analysis, and write formulas, values, or new sheets back at your request. It does not access spreadsheets you have not opened with the add-in.
• Connect to an external service — the add-in sends the specific text, cell values, or code you submit (e.g. a chat message, a formula input, or a snippet you ask it to run) to our own servers at api.pyexcelai.com to generate a response, exactly as described under "Third-party services" above. It does not make requests to any other external service on your behalf.
• Run when you open a spreadsheet, and manage triggers — the add-in shows its menu when you open a spreadsheet using it, and can create a scheduled daily maintenance trigger (to keep its own setup sheets in a clean state) and a trigger that reacts to your edits (to run cells you've explicitly tagged for Python execution). You can remove these at any time by uninstalling the add-in.
• Display dialogs, sidebars, and menus — the add-in's chat panel, settings panel, and menu items are rendered using Google's own sidebar/dialog UI framework.
• Store your settings — your configured server endpoint and any API keys you provide are stored using Apps Script's private, per-user storage, scoped to your own Google account; we do not have a separate copy of this data outside of what you send us when the add-in makes a request.
• Update its own script project (optional feature) — if you use the add-in's "Reload Server Functions" or "Copy Wrapper Code" feature, it can write generated helper functions into your own copy of the add-in's script project, so that custom functions you've registered on the server become directly callable as spreadsheet formulas. This only happens when you explicitly trigger that feature from the menu.

Enterprise and self-hosted deployments

Enterprise customers can deploy the suite, or the PyExcelAI add-in, on their own infrastructure — with SSO, audit logging, and role-based access control. In a self-hosted deployment, your prompts and data are routed to whichever AI model you configure, including your own internally hosted or air-gapped model, and never reach Anthropic, OpenAI, Google, Groq, AWS, or us. Contact us via our Partners program to discuss a self-hosted or enterprise deployment.

Data retention and deletion

Server access logs are retained for up to 30 days. AI response caching — used to speed up repeated requests and reduce cost — is short-lived, typically well under a day, and is deleted automatically once it expires. Saved retirement plans are encrypted at rest and kept for up to one year from the last time you saved or updated them, then automatically deleted — or sooner, any time you delete a plan or your account yourself. Other account data persists until you delete it or close your account. To request deletion of your account and associated data, contact us at the address below — we will act within 7 business days.

Your rights

Wherever you're located, you can exercise any of the following by contacting us at the address below:

• Access & export — a full copy of everything we hold about your account, including every saved plan, in a structured, machine-readable format.
• Deletion / erasure — permanent removal of your account and everything linked to it.
• Correction / rectification — update your saved information at any time by re-saving a plan or editing your account details.
• Restriction & objection — ask us to pause processing of your data, or object to a specific use of it, pending resolution of a request.
• Portability — the export above is provided in a format you can take to another service.
• Withdraw consent — for anything running on consent, at any time, without affecting the core planning tools.

India (DPDP Act): you may nominate another person to exercise these rights on your behalf if you die or become incapacitated — contact us to register a nominee.

Residents of the EU/UK, US states with a comprehensive privacy law, Canada (including Quebec's Law 25), Singapore, and other jurisdictions with their own data-protection law may have additional or differently-scoped rights under that law, regardless of where our infrastructure is located.

International data transfers

Our infrastructure runs in the United States. If you're accessing the suite from the EU, UK, Canada, Singapore, India, or elsewhere outside the US, your data is transferred to and processed in the US. Where required, we rely on Standard Contractual Clauses or an equivalent approved transfer mechanism to cover that transfer — contact us if you'd like a copy of the relevant safeguard for your region.

Security incidents

If a security incident affects your personal data, we will notify affected users and, where required, the relevant regulator — including the EU/UK's 72-hour authority notification window, Singapore PDPC's 3-day window, and the notice timelines under PIPEDA, the DPDP Act, and applicable US state law — without waiting for the outer edge of whichever deadline is longest.

Cookies and tracking

We use session cookies necessary to keep you signed in. We do not use advertising cookies or tracking pixels that identify you across other sites.

Children's privacy

The PyExcelAI suite is intended for adults managing their own or their clients' finances. We do not knowingly collect information from anyone under 18.

Data Protection Officer

Required for organizations under Singapore's PDPA regardless of size: our Data Protection Officer can be reached at [email protected].

Changes to this policy

If we make material changes, we will update the effective date above. Continued use of the service after a posted change constitutes acceptance.