Your spreadsheet stays local. The commercial trail is narrow.

1. Controller and contact

The controller for Jason website and account data is CASTILVA GAMES LTD, at 34 Curtis House, Third Avenue, Unit 9, Hove/East Sussex, England, BN3 2PD, United Kingdom. Registration: 16517352. Privacy requests can be sent to support@jasongrid.com.

2. The spreadsheet data boundary

CSV rows, formulas, edits, local projects, .jason backups, and exports are processed in your browser and stored on your device. Jason does not send that spreadsheet content to an Operator server for import, editing, search, sorting, calculation, backup, or export. Clearing browser storage or removing a project may delete the only local copy, so you should keep your own backups.

3. Information processed outside the spreadsheet

Website requests

The hosting provider may receive normal request metadata such as IP address, user agent, requested URL, timestamp, and security logs. The current build does not include advertising trackers or behavioral analytics.

Account and licence data

Jason uses a random browser installation identifier and, after a verified purchase, a signed account session containing Paddle customer and subscription identifiers plus the purchase email. Licence checks send those commercial identifiers to Jason account endpoints and Paddle; they do not include spreadsheet content.

Checkout and support

Paddle receives checkout, payment, billing, tax, and transaction information as merchant of record. The Operator receives limited purchase and subscription facts needed to verify Pro access, but does not receive full card details. If you contact support, we process your message and attachments; do not send card numbers or confidential spreadsheet rows.

4. Why this information is used

We use commercial identifiers to provide and restore Pro access, verify subscription status, prevent fraud, secure the service, answer support requests, and meet legal, tax, and accounting duties. Depending on applicable law, the bases are performance of a contract, legitimate interests in operating and securing Jason, compliance with legal obligations, and consent where consent is required.

5. Browser storage and cookies

The installation cookie is HttpOnly, SameSite=Lax, and may last up to two years. The signed account cookie is HttpOnly, SameSite=Lax, and may last up to one year. Production cookies are Secure. A theme preference and short-lived signed Pro receipt are stored locally. Active or trialing receipts expire after at most seven days; past-due receipts expire after at most one day. Local spreadsheet projects remain until you remove them, clear site data, or the browser reclaims storage.

6. Service providers and disclosure

Data may be processed by the website hosting provider, Paddle for commerce and payment, the email provider for support, and professional advisers or authorities when lawfully required. We do not sell personal information and do not share it for cross-context behavioral advertising.

7. International transfers

Providers may process data outside your country. Where required, we rely on recognized transfer mechanisms and provider safeguards. Paddle applies its own privacy terms to information it processes as merchant of record.

8. Retention

Browser identifiers and sessions follow the periods above and can be removed by clearing site data or signing out. Support records, security logs, and transaction-related records are kept only as long as reasonably needed for their purpose, dispute handling, fraud prevention, and legal obligations. Paddle retains its own commerce records under its policies and legal duties.

9. Your choices and rights

Depending on where you live, you may request access, correction, deletion, restriction, portability, or objection, and may complain to a competent data protection authority. Some transaction records cannot be deleted immediately where retention is legally required. We may need to verify your identity before acting on a request.

10. Security, children, and changes

We use signed sessions, same-origin mutation checks, short-lived licence receipts, and least-data design, but no system is perfectly secure. Jason is not directed to children who cannot lawfully enter the service agreement. Material policy changes will be posted here with a revised effective date.