Bulk Importer for Xero, published by Cody Labs. Effective 14 August 2026.
Bulk Importer for Xero (the “add-on”) imports rows from your Google Sheet into your own Xero organisation. This policy explains what the add-on accesses and how that data is handled. The short version: your data flows directly between your Google Sheet and your Xero organisation — Cody Labs operates no servers and never receives, stores, or transmits your accounting data or your Xero credentials.
spreadsheets.currentonly scope), such as invoices, bills, or contacts you are importing. The add-on cannot see your other files in Google Drive.All processing happens inside Google’s Apps Script runtime, in your Google account. Rows are read from your spreadsheet and sent directly to the Xero API for the organisation you selected. Your data is not sent to Cody Labs or any third party other than Xero. We have no database and no server that could receive it.
OAuth tokens are stored using Google’s PropertiesService (user properties), scoped to your Google account. They are never written into the spreadsheet and are not visible to other people you share the sheet with. Disconnecting or uninstalling the add-on removes them, and you can also revoke the add-on’s access at any time from your Xero account’s connected apps settings.
If you enter a license key to unlock paid features, the add-on sends only that license key and the Cody Labs organisation identifier to Polar to confirm your subscription is active. No accounting data, spreadsheet rows, Google identity, or Xero tokens are involved. See Polar’s privacy policy.
The only Google user data the add-on accesses is the content of the single Google Sheets spreadsheet you run it in, through the spreadsheets.currentonly scope. It reads only the rows you choose to import and uses them for one purpose: to validate and send those rows to the Xero organisation you connect through Xero’s OAuth flow, then write validation and import results back to the same spreadsheet. The script.container.ui scope lets the add-on show its sidebar inside that spreadsheet, and script.external_request lets it send the rows you choose to Xero’s API over HTTPS. The add-on:
spreadsheets.currentonly scope makes this technically impossible);The add-on’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use Google user data for advertising, and we do not sell it or transfer it to third parties except as needed to provide the add-on’s core functionality — importing the rows you choose into the Xero organisation you choose.
We protect your data — including any sensitive data — with the following mechanisms:
PropertiesService per-user Apps Script Properties store — encrypted at rest by Google and scoped to your own Google account. They are never written into the spreadsheet or stored in any Cody Labs database.spreadsheets.currentonly, script.container.ui, and script.external_request scopes, so it can access only the active spreadsheet, display its sidebar, and make the external requests required for the import — never your wider Google Drive or account.We retain nothing, because we receive nothing. Data you import lives in your Xero organisation under Xero’s terms; stored tokens are removed when you disconnect or uninstall the add-on.
Material changes to this policy will be reflected by the effective date above. Questions: [email protected].
Xero is a trademark of Xero Limited. Google Sheets is a trademark of Google LLC. This add-on is independent and not affiliated with or endorsed by either.