Privacy Policy

Last updated: October 27, 2026

1. Who We Are

EasyDash is a dashboard generation service provided by EasyDash ApS, CVR 46552539, Amagerfælledvej 146, 2. 9, 2300 København S, Denmark (“EasyDash”, “we”, “us”, “our”). We help businesses turn spreadsheets into visual dashboards. EasyDash ApS is the data controller for the personal data described in this policy. For questions about this policy, contact us at privacy@easydash.app.

Data inside your files: When you upload a spreadsheet or connect a Google Sheet, any personal data it contains belongs to you or your organisation. For that data you are the controller and we are your processor, acting only on your instructions. Our Data Processing Agreement sets out the terms and forms part of our Terms of Service.

2. Data We Collect

Account data: When you sign up, we collect your email address and name through Supabase Auth. If you sign in with Google, we receive your basic profile information from Google (name, email address, profile picture). If you join a team, the team owner gives us your email address to send the invitation.

Billing data: Payment information (credit card number, billing address) is collected and processed exclusively by Stripe. We do not store your payment card details on our servers. We store your Stripe customer ID to manage your subscription.

Dashboard data: We store the spreadsheet files (CSV, XLSX) you upload, the Google Sheets data you connect, and the Google Analytics, Search Console or Meta Ads reports you connect. This data is processed to generate charts and is stored in our database to render your dashboards. We keep the uploaded file, or the latest copy of a connected sheet or report, for as long as the dashboard exists, because your dashboard is rebuilt from it whenever you edit it or it syncs on a schedule. If you schedule email reports, we store the recipients’ email addresses and email them the report, which can include up to four headline figures and a picture of the dashboard. Unless you let anyone with the link open a report, a recipient confirms their email address with a one-time code we email them, and we record which confirmed address opened each report and when, which you and your project’s editors can see under Past reports. We do not use your business data for any purpose other than providing the EasyDash service to you.

Usage data: If you allow analytics cookies, we use PostHog (EU cloud, Frankfurt) to record how the product is used, such as pages visited and features used, so we can improve it. These events never include the contents of your dashboards. Without your consent, no analytics data is collected.

3. How We Use Your Data

We use your data exclusively to: provide and improve the EasyDash service; generate and display your dashboards; process your payments through Stripe; send you essential service emails (account verification, password resets, critical service notifications); and respond to support requests.

We do not sell, rent, or share your personal data with third parties for their marketing purposes. We do not use your uploaded business data to train AI models, and our AI provider does not use it for training either.

AI features: An AI model suggests the first layout of each dashboard, including which charts to show. It also suggests the extra charts you ask for and the layout of a sheet you regenerate, and it writes the AI summary block from the numbers on a page. The editor marks a suggested layout “Layout suggested by AI”, and every summary carries a “Written by AI” label, also when the dashboard is shared or exported. Check what the AI wrote before you share a dashboard. You can edit or replace all of it.

What we send to OpenAI: For a layout, extra charts or a regenerated sheet, we send the number of rows and, for up to 60 columns, each column’s name, type, number of different values and share of empty cells. For a number column we add its lowest, highest and average value, and for a date column its first and last date. For a column with no more than 25 different values we add up to five of them as examples, unless its name or values suggest that it holds direct identifiers such as names, email addresses or phone numbers. Then we send only how long its values are. That check reduces what is sent but cannot catch every identifier. We also send any focus you type, which columns can be combined into a rate, and the titles and settings of the charts already on the sheet. For an AI summary, we send each stat tile’s title, its value as shown, the value it is compared with, the change and the dates of the period, and for each bar chart its title, the name of the column it groups by and its five largest bars (label and value), together with the dashboard’s currency and language. When you ask for a change to a chart or a sheet, we send the request you type, the titles and settings of the charts it concerns (and the sheet’s name), and the same column description as for a layout, without example values. For none of these do we send the rows of your file. If you ask us to read your brand from a website, we send the colours found on that public page. OpenAI processes this data in the United States, does not use it to train its models, and keeps it for up to 30 days to monitor abuse, unless the law requires longer, before deleting it. You can turn AI summaries off in Settings under AI features, and then no data is sent for a summary. A dashboard created from a template is laid out from that template without AI, and nothing about its columns is sent. Only if the template is no longer available do we fall back to an AI layout as described above.

4. Third-Party Processors

We use the following services to operate EasyDash. Each processes personal data only on our instructions and under a data processing agreement with us.

Supabase (database, file storage and authentication; AWS region eu-west-1, Ireland) · Railway (the processing service that reads your files, connected sheets and connected reports and builds your dashboards; Google Cloud region europe-west4, the Netherlands) · Vercel (web hosting; server functions in Dublin, Ireland, with pages delivered through Vercel’s global network) · OpenAI (AI layouts, chart suggestions, AI summaries and the changes you ask for, United States. For layouts and suggestions we send a description of your columns: names, types, value ranges and how many distinct values each holds, plus example labels from columns that hold only a few, unless a column looks as if it holds names, email addresses or phone numbers. That check cannot catch every identifier. For summaries we send the totals shown on a page, and for a change you ask for, your request and the settings of the charts it affects. We do not send rows from your file. Section 3 lists exactly what we send) · Resend (transactional email and scheduled reports, and receiving the full emails you send to support@, hello@ or privacy@easydash.app, and sending our replies; sent from the EU, with email content, account records and delivery logs stored in the United States) · PostHog (product analytics, only with your consent; EU cloud, Frankfurt) · Stripe (payment processing) · Google APIs (Google Sheets, Google Analytics and Google Search Console connections, and Google sign-in, only when you choose to use them).

The full list of the companies that process data inside your files, with where each one processes it, is on our sub-processors page.

5. International Transfers

We store your account and dashboard data in the European Economic Area. Email is the exception: Resend keeps the content of the emails we send, including scheduled reports with the figures and picture they can contain, and of emails you send to our support address, with their delivery logs, in the United States for 30 days. Some of the services listed above are run by companies based in the United States (OpenAI, Vercel, Resend, Stripe and Google) and may process data there. We only use such services where the transfer is protected by an adequacy decision of the European Commission, including the EU–US Data Privacy Framework for certified companies, or by the European Commission’s Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards at privacy@easydash.app.

6. Google and Meta Data

If you connect Google Sheets, EasyDash asks Google for access only to the files you choose (the drive.file permission) and for your email address, so we can show which Google account is connected. You choose each spreadsheet in Google’s own file picker; EasyDash cannot see, list or open any other file in your Google Drive. We read the spreadsheets you choose only to build and re-sync those dashboards, and we never edit, create or delete anything in your Google account. If you connect Google Analytics or Google Search Console, EasyDash asks for read-only access to that product (the analytics.readonly or webmasters.readonly permission). We list the properties or sites your Google account can open so you can choose one, then read only the report described when you connect it, such as sessions by day and channel or clicks by day and search query, to build and refresh that dashboard. These reports are totals Google has already aggregated, not records of individual visitors.

We store a copy of the sheet or report data needed to render your dashboard, and encrypted Google access and refresh tokens so scheduled syncs can run while you are away. Both are stored in our EU database and are never used for advertising, never sold, and never read by people except where you ask us to help with a problem or the law requires it. Column descriptions from a connected sheet are sent to OpenAI to suggest a layout, exactly as for uploaded files. Analytics and Search Console dashboards start from a fixed layout, so nothing from them is sent to OpenAI unless you ask EasyDash to rebuild that layout with AI, and then only the same column descriptions. We do not use Google user data, or let anyone else use it, to develop, improve or train AI or machine-learning models.

EasyDash’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove EasyDash’s access at any time from EasyDash itself, under Settings, or from your Google Account’s Third-party connections page. Disconnecting in EasyDash also revokes the access at Google and deletes the stored tokens straight away. Either way, scheduled syncs for those sheets and reports then stop. Deleting a dashboard deletes our copy of its data. Deleting your account deletes all of it, including the stored token, within 30 days.

If you connect a Google or Meta account in a workspace someone else owns, or share one of your own connections with your workspace, that workspace’s editors can use the connection to build and refresh its dashboards. They never see the account’s password or access tokens. The person who connected the account can disconnect it at any time under Settings, which revokes EasyDash’s access and deletes the stored tokens, and the workspace owner can remove it from the workspace.

Meta Ads

If you connect Meta Ads, EasyDash asks Meta for read-only access to your ad accounts (the ads_read permission). We read your Meta user ID and name to identify the connection, and store only the ID. We list the ad accounts you can open, with their names, currencies and status, so you can choose one, then read only the report described when you connect it: spend, impressions, reach, link clicks and results by day and campaign, with the campaigns’ names. These are totals Meta has already aggregated, not records of the people who saw your ads. We never create, change or pause anything in your ad accounts.

We store a copy of the report data needed to render your dashboard and your encrypted Meta access token in our EU database, on the same terms as Google data above: never used for advertising, never sold, never read by people except where you ask us to help with a problem or the law requires it, and never used to develop, improve or train AI or machine-learning models. Meta Ads dashboards start from a fixed layout, so nothing from them is sent to OpenAI unless you rebuild that layout with AI, add an AI summary or ask for a change, as section 3 describes. Meta’s access token lasts about 60 days, after which you connect again.

Deleting your Meta data

To stop EasyDash reading your ad accounts, remove EasyDash in Facebook under Settings → Business integrations. That revokes EasyDash’s access at Meta straight away, and scheduled syncs of your Meta Ads dashboards stop.

To delete what EasyDash holds: deleting a Meta Ads dashboard deletes our copy of its data at once. To have the stored token and everything else from Meta deleted, email privacy@easydash.app from the address you sign in with. We delete it within 30 days, as we do when you ask us to delete your account.

7. Data Storage & Security

Your data is stored in Supabase (AWS eu-west-1, Ireland) with encryption at rest and in transit. Access to production systems is restricted to authorized personnel only. We use row-level security policies to ensure users can only access their own data.

8. Data Retention

We retain your account data and dashboards for as long as your account is active. If you delete a dashboard, we delete its stored file and data, except the copies in reports you have already sent. Each scheduled report keeps a copy of the figures it showed when it was sent, and it opens for the people you choose: anyone holding the report’s link, or recipients who confirm their address with a code. Codes expire after 10 minutes and are deleted within a day. The record of who opened a report, and the recipients’ addresses on it, are deleted with its copy. We delete it 13 months after sending (7 days for a test send), or within two days if you revoke the report under Past reports on its project. A report you choose to keep stays until you stop keeping it, revoke it or delete its project. After a copy is deleted, we keep the report’s title, date and period for another 13 months, so the project’s list of past reports stays complete. If you ask us to delete your account (email privacy@easydash.app), we will delete your personal data, uploaded files and connected-account tokens within 30 days. Encrypted backups expire on a rolling schedule of at most 7 days. When you email support@, hello@ or privacy@easydash.app, we keep your name, your email address, the subject and text of your message, and our replies for 24 months after the conversation is closed, and then delete them. Attachments are not kept. Anonymized usage analytics may be retained indefinitely.

9. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the right to: access your personal data; correct inaccurate data; request deletion of your data; export your data in a portable format; object to or restrict processing; and withdraw consent at any time.

To exercise any of these rights, email privacy@easydash.app. We will respond within 30 days. If a dashboard you appear in belongs to one of our business customers, we will pass your request on to them, since they control that data. You also have the right to complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk) or to the supervisory authority where you live.

10. Cookies

We use essential cookies to keep you signed in and to remember your language. When you confirm your email address to open a report someone sent you, an essential cookie remembers that address on your device for 90 days, so later reports from the same project open without a new code. With your consent, we also use analytics cookies from PostHog to understand how the product is used. You can accept or decline analytics cookies in the banner when you first visit, and change your choice at any time from the “Cookie settings” link in the site footer. The site works fully without analytics cookies.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify registered users of significant changes via email. The latest version is always available at this page.

12. Contact

For privacy-related inquiries, contact EasyDash ApS at privacy@easydash.app, or by post at Amagerfælledvej 146, 2. 9, 2300 København S, Denmark.