← Attio for Sheets

Privacy Policy — Attio for Sheets

What we collect

Attio for Sheets stores the minimum data needed to operate:

• Your Attio OAuth token — issued by Attio when you click "Connect Attio." Used to call the Attio API on your behalf to fetch People and Companies records.
• Last-import preferences — which object type (People or Companies) you imported most recently, so the sidebar can pre-set the Refresh button for you.
• Auto-refresh setting — whether you have enabled the daily trigger.

Nothing else is collected. We do not collect your name, email address, IP address, or any data from your Attio workspace beyond what is written into the spreadsheet you explicitly import into.

Where it is stored

All data is stored exclusively on Google's servers within your own Google account, using Google's Apps Script storage APIs:

• The OAuth token is stored in User Properties (per-user, private to your Google account).
• Import preferences and the auto-refresh flag are stored in Document Properties (tied to the specific spreadsheet you are using).
• Script Properties are used only during the OAuth flow (temporary state token); they are cleared after the callback completes.

We operate no external database, server, or third-party storage. Your Attio token never leaves Google's infrastructure.

How we use it

The OAuth token is used solely to make read-only API calls to Attio (POST /v2/objects/people/records/query and /v2/objects/companies/records/query) to retrieve the records you request. We do not write to your Attio workspace, and we request only the minimum Attio scopes needed: Records → Read and Object Configuration → Read.

Data sharing

We do not sell, share, rent, or disclose your data to any third party, except as required by law. The only external service your token is transmitted to is Attio's own API at api.attio.com, under your instruction when you click Import or Refresh.

Google API scopes used

The add-on requests the following Google OAuth scopes:

Scope	Why	Tier
spreadsheets.currentonly	Write imported CRM rows into the active spreadsheet only	Non-sensitive
script.container.ui	Show the add-on's sidebar and menu	Non-sensitive
script.external_request	Call the Attio API via UrlFetchApp	Sensitive
script.scriptapp	Create/delete the daily auto-refresh trigger	Sensitive

No restricted Google OAuth scopes are requested — no Gmail, Drive, Contacts, Calendar, or Admin SDK access. The add-on only ever touches the spreadsheet it is installed in.

Data retention and deletion

To delete all stored data, click Disconnect in the sidebar. This immediately deletes your Attio OAuth token from User Properties. Document Properties (import preferences) are cleared when you uninstall the add-on via Google Workspace settings. No data is retained on our end because we hold none.

Children's privacy

This add-on is not directed at children under 13. We do not knowingly collect data from children.

Changes to this policy

We will update this page if we change how data is handled. Material changes will be noted with an updated effective date.

Contact

Questions or requests: support@fourducks.dev