Privacy Policy for SheetConnect for Salesforce

Effective date: October 6, 2026

SheetConnect for Salesforce is a Chrome extension that adds a side panel to a Google Sheets spreadsheet the user has open. From that panel the user can import Salesforce object, list view, query and report data into a chosen worksheet, send user-confirmed record changes from a worksheet back to Salesforce, convert values in a worksheet using Salesforce lookups, and add Salesforce's rules to a worksheet's columns. It works only with the Salesforce organization the user is already signed in to and the spreadsheet the user has open.

From version 0.11.0 the extension also includes an optional Agent: a chat that prepares these tasks from a sentence. The Agent is off until the user turns it on and accepts its terms, and it is the only part of SheetConnect that sends data to a server operated by the publisher. Everything below that is not under "The optional Agent" works entirely between the user's browser, Salesforce and Google.

Data SheetConnect for Salesforce handles

The extension may handle the following data only to provide its user-facing features:

• Authentication information: the Salesforce sid session cookie for organizations where the user is already signed in, read locally to authenticate requests to those same organizations; and a Google OAuth access token obtained through Chrome when the user selects Connect Google, with two scopes: drive.file (only the spreadsheets the user picks or the extension creates) and userinfo.email (the user's email address). The token is passed within the browser to the publisher's static Picker page only while the user grants access to a spreadsheet; it is never sent to the publisher's server or stored there. When the Agent is turned on, it uses a separate token of its own that carries the userinfo.email scope alone (see below).
• Google account information: the display name, email address and photo of the connected Google account, read from Google Drive to show which account is connected; and, for the spreadsheets the user has connected, their names, owners and last-modified details, to list them. These are shown in the panel and not stored.
• Salesforce account and identity data: the selected Salesforce host, organization ID, user ID, and the username and display name returned by Salesforce APIs.
• Salesforce website and API content: object and field metadata, list view definitions and queries, report metadata and results, query results, record IDs and field values, and the results of user-confirmed record changes. This content may include personal data if the user's Salesforce organization stores such data and the user chooses to retrieve or update it.
• Google spreadsheet data: the spreadsheet ID and title and the worksheet titles and IDs of the spreadsheet the user has open; the cell values of the worksheet the user selects, read as the input table for update, conversion and validation tools or replaced by an import; and, when the user applies Validate, that worksheet's size and the conditional formatting rules and protected ranges already on it, read so the rules it adds replace its own earlier ones instead of piling up.
• User-provided content: SOQL query text, the selected object, list view or report, data and header ranges, header-to-field mappings, and, when the Agent is on, the messages the user writes to it and the skills they write for it.
• Local preferences and saved work: the selected Salesforce organization, per-organization and per-worksheet source mappings, Apex the user chooses to save as a named template, the flows the user builds and saves, the titles and IDs of spreadsheets and worksheets already opened, Bulk API job records, and, when the Agent is on, its chats for the browser session and the skills the user writes for it.

The extension does not collect browsing history, advertising identifiers, analytics, telemetry, mouse movement, scrolling behavior, or keystroke logs. It contains no ads.

How data is used

Data is used only to run what the user asks for: listing the Salesforce organizations the user is signed in to, listing objects, list views, reports and fields, running the selected query or report, writing the results into the selected worksheet, reading the selected worksheet to validate and submit record changes, looking up Salesforce records to convert values, running a flow the user built (reading the selected worksheet, or the records that conditions, a list view, a report or a query the user chose return, looking records up, creating, updating, upserting or deleting records as its steps say, and starting the autolaunched Salesforce flows its steps name, with values from each row; to build such a step the extension lists the organization's autolaunched flows and their input variables), and adding the rules the user chooses in Validate (picklist dropdowns, checkboxes, length limits, marks on values Salesforce would refuse, highlights, a header filter and an edit warning on the Id column) to the selected worksheet without changing any cell value. Salesforce writes and worksheet replacements require the user to confirm a summary naming the organization, object, worksheet and record count first.

The optional Agent

The Agent is a chat in the side panel. It is off by default. To turn it on, the user reads the Agent terms, ticks that they agree, and connects it, which gives the Agent an email-only Google token; the publisher's server records which version of the terms the user accepted. The user can disconnect the Agent at any time from its account panel.

What the Agent is for. The Agent reads the org and the spreadsheet with a small set of tools and prepares imports, formulas, Write back, Validate and Apex as cards in the chat. It never runs anything itself: every card runs only when the user presses its button, after the same preview and confirmation the extension's own tabs use, and that run goes directly from the browser to Salesforce and Google, not through the publisher's server. Its skills (slash commands such as /import) are messages like any other: they name a playbook the publisher's server keeps for that task, and send the same data as any message.

What is sent, and to whom. When the user sends the Agent a message, the extension sends to the publisher's server, which passes it to OpenAI to produce the reply:

• the message the user wrote, and, when it uses a skill the user wrote, that skill's instructions;
• the names of the Salesforce organization, the spreadsheet and its worksheets, the header row of the open worksheet and how many rows it has;
• the results of the tools the model asks for, run in the user's browser: object, field, list view and report names and labels, and, when the model needs them, field descriptions, help text and active picklist values; how many records a query or an object has, and when an object last changed; each worksheet's size and header row; column statistics and validation reports, which give counts and cell addresses but not cell values; and the checks of the cards it prepares (row counts, header-to-field mappings and error messages). The Agent never receives the value of a record or of a cell;
• until a chat has its main object, the Salesforce objects the user opened in the last 90 days, read from the user's Recently Viewed list without adding to it: their API names, labels, how many of their records the user opened and when last, so the Agent can tell which object a request is about;
• a line for each card the user ran since the last message, and, when a card fails, its error and what the card was set to do (for example its query or formula), so the Agent can say why;
• when a chat fills up and the user continues in a new one, a short summary of the earlier chat written in the browser (its last questions, last answer and cards).

These may include personal data if the user's Salesforce organization or spreadsheet holds it. The extension removes Salesforce session identifiers, access tokens and organization addresses from tool results before they leave the browser, and the server checks for them again. The Salesforce session, the Google Sheets (drive.file) token and full spreadsheets are never sent. The Agent signs in to the publisher's server with its email-only token, which the server checks with Google to learn the user's email address and Google account ID.

The publisher's server is a Google Cloud Function in Tokyo (asia-northeast1), with a Firestore database in the same region. It stores:

• for each user: the Google account ID and email address, which version of the Agent terms they accepted and when, and how much they used, counted in money over a 5-hour and a 30-day window; if an administrator resets a user's allowance, the time and the administrator's email;
• for each chat: counts of messages, tool calls and tokens, the ID of OpenAI's last response and of the tool calls it is waiting on, and the API name and label of the object the chat is about — never the messages or tool results themselves. These records are deleted automatically 30 days after the chat was last used;
• feedback, when a chat fills up and the user chooses to give it: the rating (good, bad or a bug), an optional note the user writes, the chat's message and token counts, the user's email, and the chat's ID only if the user ticks to include it so the publisher can look at it;
• operational logs of errors, and counts of how many words of the Agent's field searches found no field (numbers only, no words, user or organization), kept by Google Cloud for its standard retention period.

User records and feedback are kept while the user uses the Agent and are deleted on request.

OpenAI processes the messages and tool results as the publisher's service provider to produce the Agent's replies, under OpenAI's API terms. OpenAI keeps each conversation for 30 days so the chat can continue and does not use API data to train its models (see OpenAI's API data controls). OpenAI processes data in the United States.

Allowance. The Agent has a free usage allowance that renews over 5 hours and 30 days; each message uses it, skills included, and running a card does not. The allowance may change or stop.

Data sharing and transfers

Without the Agent, requests go only to the Salesforce organization the user selected, the Google Sheets and Drive APIs for spreadsheets the user explicitly grants, and Google's Picker service during that grant; the publisher receives no user data. With the Agent turned on, the data listed under "The optional Agent" also goes to the publisher's server on Google Cloud and to OpenAI, only to produce the Agent's replies. Salesforce data is transferred to the user's own Google spreadsheet, and worksheet data is transferred to the user's own Salesforce organization, in both cases only as the user directs. Before a write-back, unless the user turns it off, and before every flow run that updates, upserts or deletes records, the Salesforce values it is about to change are copied into a new worksheet in the same spreadsheet, with instructions for undoing the change; that worksheet stays in the user's spreadsheet, not in extension storage. When the user creates an ImportSettings tab, each worksheet's import source (the worksheet name, the source type, the object, list view or report name, and the SOQL text or the list view or report ID) is written to that tab in the user's own spreadsheet and read back from it, and a row naming a worksheet that does not exist adds that worksheet; like any worksheet, it can be seen and changed by everyone with access to the spreadsheet. Data is not sold, and is not used for advertising or for training generalized models.

Storage and retention

On the user's device:

• The Google access token stays in Chrome's own token cache. It is never written to extension storage and never passed to the side panel.
• The Agent's email-only token also stays in Chrome's token cache and is never written to extension storage. The side panel receives it only to sign its own requests to the Agent's server.
• The Salesforce sid cookie stays managed by Salesforce and Chrome. It is never copied into extension storage and never returned to the side panel. When a user hides an unusable session, the extension records a SHA-256 fingerprint of that sid so it can stay hidden, keeping at most 50 fingerprints. Hiding a session does not delete the Salesforce cookie or sign the browser out.
• Source mappings — the selected object, list view, report, query text and grouping preference for a worksheet — are stored per organization and worksheet in Chrome extension storage on the user's device, keeping the 80 most recently updated. If the user creates an ImportSettings tab in a spreadsheet, the mappings for that spreadsheet's worksheets are kept in that tab as well, in the user's own spreadsheet, and read from there; Clear removes a worksheet's row, and deleting the tab ends this. The tab is not removed with extension storage.
• Saved Apex templates hold the name the user gave them and the Apex body they wrote, with the time they were saved. They belong to the person rather than to one spreadsheet, and at most 50 are kept. Deleting a template removes it.
• Saved flows hold the name, description, parameters and steps the user builds: object and field API names, the API names of Salesforce flows and their input variables, worksheet column names, filter operators and any fixed values typed into a step, with the time they were saved. They hold no cell values or record values. They belong to the person rather than to one spreadsheet, at most 50 are kept, and deleting a flow removes it. A flow exported to a file is saved where the user chooses. When the panel opens the builder, it hands over the header names in the first row of the open worksheet through Chrome's session storage, so the builder can offer them as columns; they are cleared when the browser closes.
• Spreadsheet shapes — a spreadsheet's ID, title and worksheet titles and IDs — are cached so the panel can be drawn before the live check returns, keeping the 30 most recently opened. They hold no cell values.
• Bulk API job records hold the Salesforce job ID, object, operation, state, record counts, and, when a status column was requested, the target column and source row numbers plus a SHA-256 hash of the source rows used to detect edits. They contain no record field values, and the 20 most recent are kept.
• Agent skills the user writes — a name, what it is for, and instructions — are kept in extension storage, at most 20, until the user deletes them.
• The Agent's cache — the organization's object list, the fields that cards the user ran used on each object, and short-lived counts (the objects the user opened recently, the records of look-alike objects, field descriptions) — is kept in the browser's IndexedDB for each organization and user. It holds no record or cell values; entries unused for 30 days are removed, and all of it when the Agent is disconnected.
• Agent chats — the messages, replies, cards and their results — are kept in Chrome's session storage, at most six chats per organization and spreadsheet, and are gone when the browser closes or the Agent is disconnected. Whether the Agent is turned on, and which version of its terms was accepted, is kept in extension storage until the Agent is disconnected.
• Salesforce result rows, worksheet cell values and generated Bulk CSV uploads are not persisted in extension storage; they are held only for the duration of the operation.
• All of the above is removed when the user clears Chrome extension storage or uninstalls the extension.

On the publisher's server, only what is listed under "The optional Agent", and only for users who turned the Agent on.

User controls

Users choose the Salesforce organization, the spreadsheet, the worksheet, the source or operation, and the rows and columns involved. Google access is requested only when the user selects Connect Google; access to each spreadsheet is granted through Google Picker and can be revoked at any time from the user's Google Account permissions page. Importing replaces a worksheet and updating Salesforce records both require an explicit confirmation naming the destination. Creating an ImportSettings tab also asks first. Writing a status column back into the sheet is off by default. The Agent stays off unless the user turns it on; Disconnect in its account panel deletes its chats from the browser and drops its token. To have the Agent's records deleted from the publisher's server, contact the publisher. Users can remove local data by clearing Chrome extension storage or uninstalling the extension.

Security

The extension uses HTTPS for all network requests and packages its executable JavaScript, HTML and CSS with the extension. A separate static page on google-picker.dina-app.com, a site that serves nothing else, loads Google's official Picker library to let the user grant one spreadsheet at a time (versions up to 0.11.0 use the same page on dina.jp). The Google token stays out of URLs and storage, and the extension accepts Picker messages only from that exact page. The side panel never receives the Salesforce session or the Google Sheets token; the only credential it holds is the Agent's email-only token, for its requests to the Agent's server. The Agent's server accepts browser requests only from this extension's origin, answers only requests that carry a valid email-only token for SheetConnect's OAuth client, and refuses a token that carries Drive or Sheets access.

Limited Use disclosure

SheetConnect for Salesforce's use of information received from Google APIs adheres to the Chrome Web Store User Data Policy and the Google API Services User Data Policy, including the Limited Use requirements. Data is used only to provide the disclosed user-facing import, update, conversion, validation and Agent features. Spreadsheet data is shared with the publisher's server and OpenAI only when the user uses the Agent, only as described above, and only to produce the Agent's replies. Data is not used for advertising, is not sold, is not used to train generalized AI models, and is not made available for human reading except with the user's affirmative agreement for support (such as including a chat with feedback), when necessary for security, to comply with applicable law, or after aggregation and anonymization for internal operations. The extension performs no developer-operated analytics or telemetry.

Changes to this policy

If this policy changes, the effective date above changes with it. A change to what the Agent sends or keeps also changes the Agent terms, which the Agent then asks each user to read and accept again before it can be used.

Independent product

SheetConnect for Salesforce is an independent product and is not affiliated with, endorsed by, or sponsored by Salesforce or Google. Nor is it affiliated with, endorsed by, or sponsored by OpenAI, which the Agent uses as a service provider. Salesforce, Google Sheets, Chrome and OpenAI are trademarks of their respective owners.

Contact

For privacy questions or to have the Agent's records deleted, contact the publisher using the verified contact email shown on the Chrome Web Store listing.