Privacy

Last updated 7 August 2026

Who we are

SuiteAction is operated by Metro Stack Limited, a company registered in England and Wales (company number 17195789), registered office 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Metro Stack Limited is the data controller for the personal data described on this page. For anything on this page, contact support@suiteaction.dev.

What we collect, and why

If you join the waitlist: your email address — that is all we require. Optionally, you can tell us which of Sheets, Docs or Slides matters most, whether $29 a month would be worth it, which AI tool you use, and one task you want automated. We also record which page you arrived on and, if you came from an advert or another site, where from.

We use this to email you when the product launches and to decide what to build first. The lawful basis is your consent — which you can withdraw at any time with the unsubscribe link — and our legitimate interest in developing a product people asked for.

When you join, we email you a confirmation (from hello@updates.suiteaction.dev) with an unsubscribe link. If it does not arrive, check your spam folder, or email support@suiteaction.dev and we will remove you. You will also be emailed once when the product launches.

If you connect a Google account: that gives SuiteAction permission to read and edit your Google Sheets, Docs and Slides so it can carry out the instructions you give it. The lawful basis is performance of a contract — it is the service you are asking for.

If you create an account: we store the email address and name from your GitHub or Google sign-in to create and contact you about the account, a record that your email was verified, any API keys you create (kept only as a one-way hash, never in the clear), and a per-action usage count that meters your plan. The lawful basis is performance of a contract.

Google user data

SuiteAction's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We request exactly these Google scopes, and no others:
  • https://www.googleapis.com/auth/spreadsheets
  • https://www.googleapis.com/auth/documents
  • https://www.googleapis.com/auth/presentations
  • https://www.googleapis.com/auth/drive.file
  Google classifies the first three as sensitive and describes them on the consent screen as, for example, “See, edit, create, and delete all your Google Sheets spreadsheets”. They are what lets SuiteAction make the change you asked for. drive.file covers Drive-level operations (sharing, comments, revisions, export) and is limited to files you open or that SuiteAction itself created.
• We request no restricted Drive scope — SuiteAction cannot browse or read your Drive at large.
• Your file content is used only to carry out the instruction you gave. It is not used to train any model, is not sold, and is not shared with anyone except the Google API the request is bound for and the AI assistant you connected, which receives the results of the requests it makes on your behalf and processes them under its own terms.
• Your access and refresh tokens are stored encrypted. We do not read your documents; the service decrypts your credentials in order to use them on your behalf, which is not the same thing as being unable to.
• Disconnecting your Google account revokes our access and deletes the stored tokens.

Where your data goes

Our hosting and database (DigitalOcean), our email provider (Resend), and Google itself are in the United States, so your data is transferred outside the UK. Those transfers rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on the UK Extension to the EU–US Data Privacy Framework where the provider is certified under it. You can ask us for a copy of the safeguard we rely on.

How long we keep it

Waitlist entries are kept until launch plus twelve months, or until you use the unsubscribe link or ask us to delete them. Google tokens are kept while your account is connected and deleted when you disconnect or close your account. Account data — your sign-in identity, hashed API keys and usage records — is kept while your account is open and deleted when you close it.

Who else sees it

Our hosting, database and email providers (DigitalOcean and Resend), acting on our instructions; Google when a request is made on your behalf; and the AI assistant you connected, which receives the results of your requests. We do not sell personal data and we do not share it for advertising.

Cookies and local storage

We set no cookies and use no third-party analytics or advertising trackers. The site keeps two small values in your browser's local storage: one records how you first arrived (a timestamp, the landing page and any campaign tags) so we can see which channels work, and one remembers a pre-launch access token. Both stay on your device until you clear them, and neither is shared.

Your rights

Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, object to how we use it, ask us to restrict it, or ask for a portable copy in a machine-readable format. Email support@suiteaction.dev and we will respond within one month. If you are not satisfied you can complain to the Information Commissioner's Office.

Changes

If this page changes materially before launch we will say so here, and we will email anyone on the waitlist whose data is affected.