Privacy policy: Kayabyte add-ons for Google Workspace
Last updated: 15 October 2026
This policy explains what data the Google Workspace add-ons published by Kayabyte, the trading name of Caner Kaya, Stasjonsveien 64, 0771 Oslo, Norway (we, us), access and how they use it. Where an add-on uses data in a way this page does not cover, that add-on’s own page lists it, and this page is updated before the add-on is published.
Google user data the add-ons access
Each add-on asks only for the narrowest Google permissions (OAuth scopes) it needs, and shows them on the Google consent screen before you install it. We never request full access to your Google Drive or read your Gmail.
| Scope | Why it is used |
|---|---|
script.container.ui |
To show the add-on’s sidebar and menus inside the document or spreadsheet. |
spreadsheets.currentonly |
To read and write the spreadsheet in which you open the add-on, and only that spreadsheet. |
documents.currentonly |
To read and write the document in which you open the add-on, and only that document (Docs add-ons). |
presentations.currentonly |
To read and change the presentation in which you open the add-on, and only that presentation (Slides add-ons). |
forms.currentonly |
To read and change the form in which you open the add-on (Forms add-ons). |
drive.file |
To open or create only the files you pick or the add-on creates, for example the tagged PDF the Accessibility Checker saves in your Drive. |
calendar.events |
To create, update and delete the calendar events you ask the add-on to manage, and to read events for import, two-way sync and timesheets (Calendar add-ons). |
calendar.calendarlist.readonly |
To list your calendars so you can choose which ones to use (Calendar add-ons). |
script.scriptapp |
To run scheduled tasks you switch on, such as hourly automatic sync. |
userinfo.email |
To know your email address so we can apply your plan (free or paid). |
script.external_request |
To check your plan with our licence service (hosted on Cloudflare). |
Each add-on’s page lists which of these scopes it uses.
How we use the data
- Document content (cells, text, images, form questions, slides) is processed inside Google Apps Script only to perform the function you start, and is not sent to us or anyone else.
- Accessibility checks, fixes and PDF export run inside Google Apps Script. The tagged PDF is saved only in your own Google Drive.
- Calendar events (titles, times, locations, descriptions, guests) are read and written only to do what you start: syncing your rows, importing events into your spreadsheet, or building a timesheet there. They are processed inside Google Apps Script and stored only in your own spreadsheet and calendars. To avoid duplicates, an add-on may store event IDs and a short fingerprint of each synced row in a hidden sheet of the same spreadsheet, and tags the events it creates with that spreadsheet’s ID. None of this is sent to us.
- Your email address and your Google Workspace domain are sent to our licence service to look up whether you or your organisation has a paid plan. We store them with the plan state only while you have, or recently had, a paid plan.
- Add-on settings are stored in Google’s own storage for the document or for your user (Apps Script properties).
Limited Use
Kayabyte’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not let humans read it except with your consent for support, for security or legal reasons, and we do not use it to train AI or machine learning models.
Payments
Paid plans are billed through Stripe, which processes payment details under its own privacy policy. We receive your email address, billing country, plan and subscription status, never your full card details. We keep invoices and payment records as Norwegian bookkeeping law requires.
Sub-processors
- Google LLC: runs the add-ons (Apps Script) and stores add-on settings.
- Cloudflare, Inc.: hosts kayabyte.dev and the licence service that stores plan state.
- Stripe Payments Europe, Ltd.: checkout, billing and tax calculation.
Retention and deletion
Document content is not retained by us. Plan records are kept while a subscription is active and deleted 24 months after it ends, unless law requires longer retention for accounting. When you uninstall an add-on, settings stored in your Google account stay under your control in Google and can be removed by deleting the document or revoking access at myaccount.google.com/permissions. To delete everything we hold about you, email support@kayabyte.dev and we will do so within 30 days.
Sharing
We do not sell, rent or share Google user data. We disclose data only to the sub-processors above to provide the service, or when law requires it.
Security
Data in transit is protected with TLS. Access to the licence service is limited to Kayabyte.
Your rights
You have the right to access, correct and delete your personal data and to complain to the Norwegian Data Protection Authority (Datatilsynet). For questions about this policy, or to exercise your rights under the GDPR, contact support@kayabyte.dev.
Changes
We will update this page if our data handling changes. The date at the top shows the latest version.