Privacy Policy

eg2 ("we", “us”) is operated by Efrat Galanti, a sole trader registered in Israel, business ID 056655061. This policy explains what personal data we handle, why, and what rights you have.

Questions or requests: [email protected].

1. Two different roles

eg2 turns a spreadsheet you already own into a private portal your own customers can log into. That creates two distinct relationships, and your rights differ depending on which applies to you.

When you are our customer (a portal administrator), we play two roles at once, and it matters which data we mean:

• Your account information — the details we need to run your account (your email, name, portal settings, and activity records). For this, we are the data controller: we decide what we collect and why, and this policy governs it.
• The files and spreadsheet content you connect — this is your data. It remains yours and belongs to you; connecting it to eg2 never transfers ownership to us. For this data we act only as a processor on your behalf, reading and storing it solely to run the service for you and following your instructions. You decide what it contains, who may see it, and when it is removed. We never claim ownership of it, sell it, or use it for any purpose other than providing the service to you.

When you are an end user of someone’s portal (a “portal contact”) — we are only a data processor. The business that created the portal is the controller: they chose what to put in their spreadsheet, and they decide who may see it. We process that data solely on their instructions. If you want your data corrected or deleted, contact that business directly — we cannot make those decisions for them. If you reach us instead, we will forward your request to them.

2. What we collect

From portal administrators

• Account details — email address and full name.
• Portal configuration — client name, portal URL slug, logo, brand colour, and the Google Drive file ID of the spreadsheet you connect.
• Activity records — sign-ins and significant actions, with a timestamp.

From portal contacts (on behalf of our customers)

• Contact identifier — the email address or mobile number used to sign in, taken from the administrator’s spreadsheet.
• Spreadsheet content — whatever rows and columns the administrator chose to publish. We do not control this and cannot predict it. It may include names, order histories, balances, documents, or images. Administrators are responsible for ensuring they have a lawful basis to publish it.
• One-time passcodes — the code sent to authenticate a sign-in, its expiry, and the number of failed attempts.
• Access records — which portal was accessed and when.

From website visitors

Effectively nothing. The eg2 marketing website sets no cookies and runs no analytics, advertising, or tracking scripts of any kind. If you use the contact form, we receive what you type into it.

3. What we do not do

• We do not sell personal data, and we never have.
• We do not use your data, or your customers’ data, to train machine-learning models.
• We do not send marketing email to portal contacts. They receive sign-in codes only.
• We do not read your Google Drive at large. Access is limited to the specific files you explicitly select — see §5.

4. Why we process it, and on what legal basis

Where we rely on legitimate interests, we have weighed them against your rights and concluded they do not override your interests. You may object at any time — see §8.

5. Google Drive access

When you connect a spreadsheet, you authorise eg2 through Google’s own consent screen using the drive.file scope. This is deliberately the narrowest scope Google offers for this purpose.

Concretely, this means:

• We can only access files you specifically pick using the Google file picker. We cannot browse, list, or open anything else in your Drive — the technical permission does not exist.
• Selecting a file grants our service account read-only access to that file alone.
• We read the file’s contents to sync it into your portal, and we subscribe to change notifications so the portal updates when you edit the spreadsheet.
• Revoking access at any time via your Google account permissions immediately stops all further reading.

eg2’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Who else processes data

We keep the list of third parties deliberately short:

Payments are handled entirely by Lemon Squeezy, who act as merchant of record. We never receive or store your card details.

7. International transfers

Israel has an adequacy decision from the European Commission, so personal data may flow from the EEA to Israel without additional safeguards. Where a provider processes data outside Israel or the EEA, that transfer relies on Standard Contractual Clauses or an equivalent recognised mechanism.

8. How long we keep data

Deleting a portal removes its synced data. Note that deleting data from eg2 does not touch your original Google spreadsheet, which remains entirely yours.

9. Your rights

If you are in the EEA or UK, you have the right to access your data, correct it, erase it, restrict or object to processing, port it to another provider, and withdraw consent where processing relies on consent. Israeli law grants comparable rights of review and correction.

Exercise any of these by emailing [email protected]. We respond within 30 days. There is no charge unless a request is manifestly unfounded or excessive.

Remember the distinction in §1: if you are a portal contact, we will pass your request to the business that runs the portal, because only they can act on it.

You may also complain to a supervisory authority — the Israeli Privacy Protection Authority, or your local EEA/UK data protection authority.

10. Security

Access to portal data requires a one-time passcode sent to an email address or phone number already present in the administrator’s spreadsheet. Each portal’s synced data is stored in its own isolated database. Traffic is encrypted in transit with TLS.

No system is perfectly secure, and we will not claim otherwise. If a breach affects your personal data and poses a risk to your rights, we will notify you and the relevant authority without undue delay, as required by law.

11. Children

eg2 is a business tool and is not directed at children under 16. We do not knowingly collect their data. If an administrator publishes a spreadsheet containing children’s data, that is their responsibility as controller.

12. Changes

We may update this policy. Material changes will be announced by email to administrators at least 14 days before taking effect. The date at the top always reflects the current version.

13. Language

This policy is published in several languages for convenience. In the event of any conflict, the English version governs.