Privacy policy

AnyToExcel is built and run by one independent developer, referred to in this policy as “we” or “us”. We decide how the information described below is used.

Operator: [To confirm: legal name of the person or business operating AnyToExcel]. Country of operation: [To confirm: country].

For anything in this policy, write to support.datatoexcel@gmail.com.

When you convert a file — by uploading it, dropping it on the page or pasting data — the file is sent to our server, read in memory, turned into an .xlsx spreadsheet and sent straight back to your browser in the same request. The application does not write your file or the resulting spreadsheet to disk, to file storage or to a database, and it keeps no copy once the response has been sent.

The application does not log file contents. When a file cannot be read, the error log records only that a file of a given type failed — for example “a .csv file” — not its name or what was in it.

CSV, TSV, JSON, HTML and PDF files

These are processed entirely on our own server code. PDFs are read with the open-source pdf.js library running on the server; no third party sees them.

Images (PNG, JPG, WebP)

Reading a table out of a picture requires an AI model. Image files are therefore sent to Google's Gemini API, which returns the text of the table to us. This is the only format that leaves our server to be processed. Google handles that request under its own API terms, which govern whether and how long Google retains the content. [To confirm: which Gemini API tier is used (free or paid), and therefore whether Google may retain or use submitted images to improve its products]

If an image contains information you would not want a third party to process, do not upload it.

Dashboard tools

The Data Cleaner and Data Analyzer send your file to our server once to read it into rows. The rows are returned to your browser, and the cleaning and analysis then happen in your browser. When you download the result, the rows are sent back to our server to build the .xlsx and returned to you. The Table Builder and templates work the same way. None of these steps stores the file or the rows on the server.

Apart from the file being converted, the service handles the following information.

If you sign in

Signing in is only needed for the dashboard; the converters work without an account. You can sign in with Google, in which case Google tells us your name, email address and profile picture (we never receive your Google password). Where email sign-in is offered, you can instead ask for a one-time link sent to your email address.

Your sign-in is kept in an encrypted session cookie in your browser. We use it to show you who you are signed in as, to restrict the dashboard to signed-in users, and to apply per-account usage limits.

When email sign-in is offered, we also keep an account record in our database: your email address, the date it was confirmed, and — if you used Google — your name, profile picture and Google account identifier, so that both sign-in methods open the same account. To send a sign-in link, we store a hashed copy of a one-time code that expires after 15 minutes and is deleted when the link is used.

If you join the mailing list

The sign-up form in the footer stores your email address, the language of the page you signed up from, and the date. Nothing else — no name and no IP address. We use it only to tell you about new formats and features, at most once a month.

If you use the contact form

The form sends your name (if given), email address, message, and optionally where your file came from, as an email to our support inbox, so we can reply. Contact messages are not stored in our database.

Your IP address, for rate limiting

To stop automated abuse, we count how many requests come from each IP address over the last hour — for example, 20 conversions per hour on the free converter. The count is held only in the memory of the server handling the request. It is not written to a database, and it is lost when that server restarts.

Hosting logs

Like any website, the platform that hosts AnyToExcel may record standard request logs, such as IP address, the page requested, browser type and time. [To confirm: hosting provider, and how long its request logs are retained]

What we do not collect

AnyToExcel has no analytics, advertising or tracking scripts. We do not build profiles of visitors, and we do not sell, rent or share personal information with advertisers.

Some features save information in your browser's local storage. It stays on your device and is never sent to our server:

• Conversion history — for your most recent 50 conversions: the file name, format, row and column counts, number of warnings, time, and whether it succeeded or why it failed. The files themselves are not saved.
• Table Builder draft — the table you are working on, so it survives a page reload.
• Output style — whether you chose styled or plain spreadsheets.

You can remove single entries or clear the whole history from the dashboard, or clear all of it through your browser's site-data settings. Because it lives in one browser, it does not follow you to another device. The cookie policy lists every cookie and storage key by name.

We rely on the following providers to run AnyToExcel. Each receives only what it needs for the job listed:

• Google (Gemini API) — reads tables from uploaded images. Receives the image file.
• Google (sign-in) — authenticates you when you sign in with your Google account.
• Neon — hosts the PostgreSQL database that stores the mailing list and, where email sign-in is offered, account records.
• Resend — delivers contact-form messages to our inbox and, where email sign-in is offered, sends sign-in links to the address you enter.
• Gmail — hosts the support inbox where contact messages and emails to us are received.
• Hosting provider — runs the application and serves the website. [To confirm: name of the hosting provider]

These providers may process data in countries other than your own. [To confirm: server regions used for the database and hosting, and any transfer safeguards relied on]

• Uploaded files and converted spreadsheets — not kept. They exist on the server only while your request is being processed.
• Images sent to Gemini — retained by Google according to its Gemini API terms, not by us.
• Session cookie — until you sign out, or until it expires after 30 days without use.
• Account record — where one is kept, until you ask us to delete it. Unused sign-in codes expire after 15 minutes.
• Mailing list — until you ask to be removed.
• Contact messages — in our support inbox. [To confirm: how long support emails are kept before deletion]
• Rate-limit counts — about an hour, in server memory only.
• Browser storage — until you clear it.

Not storing files is the main safeguard: a file that is never saved cannot leak later. The session cookie is signed and encrypted, so its contents cannot be read or altered in your browser. Access to the dashboard tools is checked on the server for every request.

No system is completely secure, and we cannot guarantee that information sent over the internet will never be intercepted or accessed without authorisation. If we learn of a breach that affects your information, we will tell the people affected where we are able to reach them.

You can, at any time:

• Ask what personal information we hold about you, and for a copy of it.
• Ask us to correct it, or to delete it — including removing your address from the mailing list.
• Sign out, which deletes the session cookie from your browser.
• Remove AnyToExcel's access to your Google account from your Google Account security settings.
• Clear your conversion history and other browser storage from the dashboard or your browser settings.

If you have only signed in with Google while email sign-in was not offered, we hold no account record: signing out and revoking Google access removes the link between AnyToExcel and you. If an account record exists, we delete it on request. Account deletion, mailing-list removal and other requests are handled by email — write to support.datatoexcel@gmail.com from the address concerned. We will reply within [To confirm: response time, for example 30 days].

Depending on where you live, data protection law may give you further rights, such as objecting to processing or complaining to your local data protection authority. [To confirm: which data protection laws apply to the operator, and the legal basis relied on for each use of data]

AnyToExcel is a tool for working with business and personal data and is not directed at children. We do not knowingly collect personal information from anyone under [To confirm: minimum age, for example 16]. If you believe a child has given us their information, contact us and we will delete it.

When the way AnyToExcel handles data changes — for example, if file storage, analytics or payments are added — this policy will be updated before the change takes effect, and the date at the top of the page will change. Significant changes will also be announced on the site.

Questions, requests or complaints about privacy go to support.datatoexcel@gmail.com. The person who reads that inbox is the person who built the service.