Privacy Policy

← Bulk Editor for Stripe

Bulk Editor for Stripe, published by Cody Labs. Effective 14 November 2026 (draft).

Bulk Editor for Stripe (the "add-on") reads and updates objects in your own Stripe account from your own Google Sheet. Your data flows directly between Stripe and your spreadsheet. Cody Labs operates no servers and never receives, stores, or transmits your Stripe data or your Stripe key.

Information the add-on accesses

• The Stripe restricted key you provide, used to authenticate to the Stripe API on your behalf.
• Stripe data: customers (including names, emails, phone numbers and addresses), subscriptions, prices, products, coupons and promotion codes returned or changed when you pull, dry run or apply.
• Tabs the add-on creates in your spreadsheet: your job tabs, a hidden dry-run plan tab (row numbers and a hash of each approved row, no Stripe data) and a hidden backup tab (the prior values of any object it changed, so a run can be undone). They live in your own spreadsheet and are visible to anyone you share it with.
• The active Google Spreadsheet, through the restricted spreadsheets.currentonly scope. The add-on cannot see your other files in Google Drive.

Where your data goes

All processing happens inside Google's Apps Script runtime, in your Google account. Requests are sent to api.stripe.com only. Stripe data is not sent to Cody Labs or any third party. We have no database and no server that could receive it.

How your key is stored

Your Stripe key is stored with Google's PropertiesService (user properties), scoped to your Google account. It is never written into the spreadsheet and is not visible to people you share the sheet with. Disconnecting or uninstalling removes it. The add-on does not log keys, and error messages from Stripe are stripped of key text before they are shown.

License verification

If you enter a license key to unlock paid features, the add-on sends only that key and the Cody Labs organization identifier to our payment processor, Polar, to confirm it is valid. No Stripe data or Stripe key is involved. See Polar's privacy policy.

How the add-on uses Google user data

The only Google user data the add-on accesses is the content of the single spreadsheet you open it in. It uses it for one purpose: to read the rows you enter so it can validate them and apply them to Stripe, and to write results, plans and backups back into that spreadsheet. The add-on never uses Google user data for advertising, profiling or model training, never sells or shares it, and never sends it to Cody Labs. Its use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Data protection and security

• Encryption in transit: every request to Stripe and Polar uses HTTPS/TLS.
• Least privilege: the add-on asks for spreadsheets.currentonly, script.container.ui, script.external_request and script.scriptapp (for continuation triggers), and its URL allowlist names only api.stripe.com and api.polar.sh. You are told to give the Stripe key write access to seven resources and nothing else.
• Safety checks: no change is written without a dry run on the same rows, live mode needs a typed row count, and requests carry idempotency keys.
• No developer-side attack surface: there is no Cody Labs back end to breach.

Data retention and deletion

We store nothing, so there is nothing for us to retain or delete. The key and settings are removed when you disconnect or uninstall. The plan and backup tabs are yours to delete at any time.

Third-party services

• Stripe: your own Stripe account, accessed with the key you supply.
• Polar: handles paid subscriptions and verifies license keys.

Changes

We may update this policy; material changes will be reflected by the effective date above.

Contact

[email protected].

Stripe is a trademark of Stripe, Inc. Google Sheets is a trademark of Google LLC. This add-on is independent and not affiliated with or endorsed by either.