Privacy Policy

Last updated: February 3, 2026

This Privacy Policy ("Policy") describes how Fully Indexed LLC, a Wyoming limited liability company, operating as Sheetworks ("we," "us," or "our"), collects, uses, discloses, and protects your personal information when you access or use the Sheetworks platform at sheetworks.ai (the "Service"). The Service is designed exclusively for educators, teachers, and educational professionals. There are no student accounts. By using the Service, you acknowledge that you have read and understood this Policy.

PLEASE READ THIS PRIVACY POLICY CAREFULLY. BY ACCESSING OR USING THE SERVICE, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO BE BOUND BY THIS PRIVACY POLICY. IF YOU DO NOT AGREE, DO NOT ACCESS OR USE THE SERVICE.

1. Definitions

• "Personal Information" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to you, including but not limited to your name, email address, and account credentials.
• "Usage Data" means information collected automatically through operation of the Service, including session recordings, heatmaps, page views, feature usage, and interaction patterns.
• "User Content" means any worksheets, educational materials, text, images, or other content that you create, upload, or store through the Service.
• "Cookies and Local Storage" means small data files or browser storage mechanisms placed on your device to maintain preferences and session state.

2. Information We Collect

2.1 Information You Provide Directly (Educators Only)

Only educators may create accounts on Sheetworks. There are no student accounts, student logins, or student profiles. When you create an educator account or use the Service, we collect the following Personal Information:

• Account Information: Your name, email address, and profile image (avatar). If you authenticate via Google OAuth, we receive your name, email, and profile picture from Google. If you authenticate via Magic Link, we collect your email address.
• User Content: Worksheets, quiz questions, educational materials, and any other content you create, edit, or store using the Service. This includes text inputs, keywords, subject selections, grade levels, and uploaded files (e.g., PDFs) used as source material for worksheet generation.
• Communication Data: Any information you provide when contacting us for support, feedback, or other inquiries.

2.2 Information from Shared Worksheet Visitors (Students and Guests)

Educators may share worksheets with students or other visitors via a link. When a visitor accesses a shared worksheet, they may be asked to enter their first and last name before starting. This name is stored locally in the visitor's browser (via local storage) and is not transmitted to Sheetworks servers or written to our database. The name may persist in the visitor's browser across sessions until the browser storage is cleared. We do not create accounts for visitors to shared worksheets, and we do not collect, store, or process any Personal Information from students or other guests who access shared worksheets on our servers.

2.3 Information Collected Automatically

When you use the Service, certain information is collected automatically:

• Usage Logs: We record your interactions with the Service, including features used, worksheets generated, credit consumption, and timestamps of activity.
• Session and Authentication Data: We maintain session tokens and authentication state to keep you signed in and protect against unauthorized access (CSRF protection). Your IP address and browser user agent are recorded as part of your authentication session for security purposes (e.g., detecting unauthorized access). This data is deleted when your session expires or when you delete your account.
• Analytics Data (Consent Required): If you explicitly consent via our cookie consent banner, we collect session replay recordings and heatmap data through Microsoft Clarity. No analytics data is collected unless you affirmatively click "Accept" on the consent banner. See Section 5 (Cookies and Tracking Technologies) for details.
• Locale Preferences: We store your preferred language setting to deliver the Service in your chosen locale. We support English, Spanish, Portuguese, French, German, Chinese, Japanese, and Korean.

2.4 Information from Third Parties

If you sign in using Google OAuth, we receive your name, email address, and profile picture from Google in accordance with the permissions you grant during the authentication flow. We do not receive or store your Google password.

3. How We Use Your Information

We use your information for the following purposes:

• Service Delivery: To operate, maintain, and provide the features and functionality of the Service, including AI-powered worksheet generation, content editing, PDF export, and image/thumbnail generation.
• AI Processing: Your input prompts (keywords, subject, grade level, learning objectives, and uploaded PDF content) are sent to third-party AI inference providers to generate worksheet content. See Section 4 (Third-Party Service Providers) for details.
• Account Management: To create and manage your account, authenticate your identity, and maintain your session.
• Billing and Subscriptions: To process payments, manage subscription tiers, track credit usage, and provide invoices. Payment processing is handled entirely by our Merchant of Record (see Section 4).
• Transactional Communications: To send you account-related emails, including Magic Link sign-in emails, welcome messages, usage alerts, and payment receipts.
• Service Improvement: To analyze usage patterns (with your consent for analytics tools) and improve the features, performance, and reliability of the Service.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or governmental requests.

4. Third-Party Service Providers

We engage the following categories of third-party service providers to operate the Service. We do not sell your Personal Information to any third party.

Polar.sh as Merchant of Record: Polar.sh acts as the Merchant of Record for all paid subscriptions. This means Polar.sh — not Sheetworks — is the legal entity that processes your payment, handles applicable sales tax and VAT, and issues invoices. Sheetworks does not directly collect, process, or store your credit card number, bank account information, or other payment credentials. Polar.sh's handling of your payment information is governed by Polar.sh's Privacy Policy.

AI Processing Disclosure: When you generate worksheets, the prompts and source material you provide (including text extracted from uploaded PDFs) are transmitted to AI language model providers via OpenRouter for processing. These providers process your data solely for the purpose of returning generated content and do not retain your data for their own training purposes beyond the duration of the request, in accordance with their respective data processing agreements.

Internal Notifications: When you create an account, change your subscription plan, or submit feedback, we send internal notifications to our team via Slack. These notifications may include your name, email address, and the relevant account event. This data is used solely for operational monitoring (e.g., welcoming new users, tracking billing events) and is not shared further.

5. Cookies and Tracking Technologies

Important: We employ an opt-in consent model. No analytics or tracking scripts are loaded until you affirmatively accept by clicking "Accept" on our cookie consent banner. Rejecting consent prevents all non-essential cookies and tracking from loading.

5.1 Essential Cookies and Storage

The following are necessary for the Service to function and do not require consent:

5.2 Analytics Cookies (Consent Required)

The following are loaded only if you click "Accept" on the cookie consent banner:

5.3 Managing Your Consent

You may change your cookie consent preference at any time by clicking "Cookie Preferences" in the site footer. This will reset your consent and re-display the consent banner, allowing you to accept or reject analytics tracking. You may also clear your browser's localStorage to reset all stored preferences.

6. Data Retention

We retain your Personal Information and User Content for as long as your account is active or as needed to provide the Service. Specifically:

• Account Data: Retained until you delete your account.
• User Content (Worksheets): Retained until you delete the worksheet or your account.
• Usage Logs: Retained for the duration of your account. Usage logs (features used, credits consumed, AI model metadata) are deleted when you delete your account.
• Session Data: Authentication sessions (including IP address and user agent) expire automatically and are deleted upon expiration or account deletion.
• Subscription Data: Transaction records may be retained as required by tax and financial regulations, even after account deletion.
• Analytics Data: Session recordings in Microsoft Clarity are retained in accordance with Microsoft's retention policies (typically 30 days).

7. Data Security

We implement industry-standard technical and organizational measures to protect your Personal Information, including:

• All data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
• Authentication sessions are protected with CSRF tokens and secure session management via Better Auth.
• Database access is restricted and managed through secure connection pooling.
• Payment information is handled entirely by our Merchant of Record (Polar.sh) and is never stored on our servers.
• Admin access to user data is restricted to authorized personnel via an email whitelist.

NOTWITHSTANDING THE FOREGOING, NO METHOD OF TRANSMISSION OVER THE INTERNET OR METHOD OF ELECTRONIC STORAGE IS 100% SECURE. WHILE WE STRIVE TO USE COMMERCIALLY REASONABLE MEANS TO PROTECT YOUR PERSONAL INFORMATION, WE CANNOT GUARANTEE ITS ABSOLUTE SECURITY.

8. Your Rights Under GDPR (European Economic Area Users)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of Access (Art. 15): You may request a copy of the Personal Information we hold about you.
• Right to Rectification (Art. 16): You may request correction of inaccurate or incomplete Personal Information.
• Right to Erasure (Art. 17): You may request deletion of your Personal Information. You can delete your account at any time via the Profile page in the Service, which will remove your account data and sign you out.
• Right to Restriction (Art. 18): You may request that we restrict processing of your Personal Information under certain circumstances.
• Right to Data Portability (Art. 20): You may request a copy of your data in a structured, commonly used, machine-readable format. Portability requests are fulfilled manually within 30 days of receipt.
• Right to Object (Art. 21): You may object to processing of your Personal Information for direct marketing or on grounds relating to your particular situation.
• Right to Withdraw Consent (Art. 7): Where we rely on consent (e.g., analytics tracking), you may withdraw consent at any time by clicking "Cookie Preferences" in the site footer. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

Legal Bases for Processing (Art. 6): We process your Personal Information on the following legal bases:

• Contract Performance: Processing necessary to provide the Service (account management, worksheet generation, billing).
• Consent: Analytics and session recording via Microsoft Clarity (opt-in only).
• Legitimate Interest: Service security, fraud prevention, and operational improvement.
• Legal Obligation: Tax and financial record-keeping requirements.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

9. Your Rights Under CCPA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You may request disclosure of the categories and specific pieces of Personal Information we have collected, the categories of sources, the business purpose for collection, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of your Personal Information. You can self-serve this by deleting your account from the Profile page.
• Right to Correct: You may request correction of inaccurate Personal Information.
• Right to Opt-Out of Sale/Sharing: We do not sell or share your Personal Information for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

Categories of Personal Information Collected (preceding 12 months):

• Identifiers (name, email address, IP address)
• Internet or other electronic network activity (usage logs, browser user agent, analytics data with consent)
• Commercial information (subscription tier, credit usage, transaction history)
• Inferences drawn from the above (usage patterns for service improvement)

To submit a verifiable consumer request, contact us at [email protected]. We will verify your identity before fulfilling the request and respond within 45 days.

10. International Data Transfers

The Service is hosted on servers located in Europe (Hetzner, Germany). Your data may also be processed by third-party providers located in other jurisdictions, including the United States (e.g., Supabase, OpenRouter, Microsoft Clarity, Resend). Where your data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or the service provider's participation in recognized data transfer mechanisms.

11. Children's Privacy and Student Data

THE SERVICE IS DESIGNED FOR USE BY EDUCATORS AND IS NOT DIRECTED AT CHILDREN UNDER THE AGE OF 13 (OR THE APPLICABLE AGE OF DIGITAL CONSENT IN YOUR JURISDICTION). WE DO NOT KNOWINGLY COLLECT PERSONAL INFORMATION FROM CHILDREN UNDER 13. IF WE BECOME AWARE THAT WE HAVE COLLECTED PERSONAL INFORMATION FROM A CHILD UNDER 13 WITHOUT PARENTAL CONSENT, WE WILL TAKE STEPS TO DELETE SUCH INFORMATION PROMPTLY.

THERE ARE NO STUDENT ACCOUNTS ON SHEETWORKS. ONLY EDUCATORS MAY CREATE ACCOUNTS. STUDENTS DO NOT SIGN UP, LOG IN, OR HAVE PROFILES ON THE SERVICE.

When an educator shares a worksheet via a link, students or other visitors may access that worksheet in a read-only "take mode." Visitors may be prompted to enter their first and last name before starting the worksheet. This name is held only in the visitor's browser memory (client-side JavaScript state) for display purposes during the session. It is never transmitted to our servers, never stored in our database, and is discarded when the browser tab is closed. We do not track, profile, or create records for students or other visitors who access shared worksheets.

If you are a parent or guardian and believe your child has provided Personal Information to us, please contact us at [email protected].

12. Account Deletion

You may delete your account at any time through the Profile page within the Service. Upon account deletion:

• Your account record, profile information, and associated authentication data will be permanently removed from our database.
• Your active session will be terminated and you will be signed out.
• Worksheets and User Content associated with your account will be deleted from our database.
• Cached copies of your content in content delivery networks, search indexes, and file storage services may take up to 30 days to be fully purged.
• Subscription and billing records may be retained by our Merchant of Record (Polar.sh) as required by applicable tax and financial regulations.
• Anonymized, aggregated data that cannot be used to identify you may be retained for analytical purposes.

13. Third-Party Links

The Service may contain links to third-party websites or services that are not operated by us. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites or services. We encourage you to review the privacy policy of every site you visit.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this Policy.
• Post the revised Policy on this page.
• For material changes affecting your rights, provide notice through the Service or via email.

YOUR CONTINUED USE OF THE SERVICE AFTER THE EFFECTIVE DATE OF ANY REVISED POLICY CONSTITUTES YOUR ACCEPTANCE OF THE REVISED TERMS.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: [email protected]
• Website: sheetworks.ai

For GDPR-related requests, you may also lodge a complaint with your local Data Protection Authority.