Privacy Policy

Last Updated: October 13, 2026

Effective: November 12, 2026

SSFeatures, LLC ("SSFeatures," "Company," "We," "Us," or "Our") is committed to protecting Your privacy. This Privacy Policy explains how We collect, use, disclose, and safeguard Your information when You use Our Service.

Please read this Privacy Policy carefully. By accessing or using the Service, You acknowledge that You have read, understood, and agree to be bound by this Privacy Policy. If You do not agree with the terms of this Privacy Policy, please do not access or use the Service.

1. Definitions

For the purposes of this Privacy Policy:

"Account" means a unique account created for You to access Our Service, identified by Your email address.

"Browser Extension" means the SSFeatures browser extension software that enhances Smartsheet functionality, available for Chrome, Edge, Firefox, Safari, and other supported browsers.

"Company" means SSFeatures, LLC, a Nevada Limited Liability Company.

"Cookies" means small data files placed on Your Device that store information about Your browsing session or preferences.

"Dashboard" means the web-based user portal accessible at app.ssfeatures.com/dashboard where You can manage Your Account, Subscription, and licensed users.

"Device" means any device that can access the Service, such as a computer, smartphone, or tablet.

"Local Storage" means the browser-based storage mechanism used by the Browser Extension to store Your settings and preferences locally on Your Device.

"Personal Data" means any information that relates to an identified or identifiable individual.

"Plan" means the named set of features on which You use the Service, such as Free, Standard, Pro, or Enterprise, as described in Our Terms and Conditions.

"Service" means, collectively, the Browser Extension, Website, Dashboard, and any related software, features, or services offered by SSFeatures.

"Smartsheet" means the Smartsheet project management and collaboration platform operated by Smartsheet Inc., with which the Browser Extension integrates.

"Usage Data" means data collected automatically when using the Service, including analytics and diagnostic information.

"Website" means the SSFeatures website accessible at https://ssfeatures.com and all related subdomains.

"You" means the individual accessing or using the Service, or the company or other legal entity on behalf of which such individual is accessing or using the Service.

2. Data Controller

SSFeatures, LLC is the data controller responsible for Your Personal Data.

Contact Information:

• Email: [email protected]
• Website: https://ssfeatures.com/contact

For security-related inquiries, please visit Our Trust Center at https://trust.ssfeatures.com.

3. Information We Collect

3.1 Account Information

When You create an Account or subscribe to Our Service, We collect:

• Email address
• First name
• Last name
• Organization name (if provided)
• Billing address (for paid subscriptions)
• Your Plan, subscription status, and the number of licenses You hold

3.2 Browser Extension Data

What We Collect:

The Browser Extension collects minimal data necessary to provide the Service:

• Authentication Data: The email address, first name, and last name associated with Your Smartsheet account to verify Your Plan and subscription status
• Feature Usage Analytics: Information about which SSFeatures features You use (e.g., "Auto Sort feature activated"), recorded against Your Account, to improve Our Service and support Our customers

What We Do NOT Collect:

SSFeatures never collects, transmits, or stores Your Smartsheet data. This includes:

• Sheet data, cell contents, or formulas
• Report data or dashboard content
• Form submissions or responses
• Comments, attachments, or proofs
• DataMesh, Data Shuttle, or Bridge data
• Dynamic View or WorkApps content
• Any other Smartsheet content or metadata

Your Smartsheet data remains entirely within Your browser and is never sent to SSFeatures servers.

3.3 Settings and Preferences (Local Storage Only)

Your SSFeatures settings and preferences (such as sort configurations, feature preferences, and UI customizations) are stored exclusively in Your browser's Local Storage. This data:

• Is stored only on Your Device
• Is never transmitted to Our servers
• Is never stored in Our databases
• Is automatically deleted if You uninstall the Browser Extension

3.4 Usage Data

We automatically collect certain information when You access the Service:

• IP address
• Browser type and version
• Operating system
• Device identifiers
• Pages visited on Our Website
• Time and date of access
• Time spent on pages
• Referring website addresses, including whether You arrived through an affiliate link or an advertisement
• Clickstream data

3.5 Payment Information

When You make a purchase, payment information is collected and processed directly by Our payment processor, Stripe. We do not collect, store, or have access to Your full payment card details. We receive only:

• Last four digits of the card (for display purposes)
• Card type (e.g., Visa, Mastercard)
• Billing address
• Transaction confirmation

3.6 Communications

When You contact Us, We collect:

• Email address
• Name
• Content of Your message
• Any attachments You provide
• Support ticket history

3.7 Marketing List Membership

We record that Your email address is on Our marketing list, which groups it belongs to, and whether You have unsubscribed. Recording an address is automatic: whenever We first hold Your email address for any of the reasons described in Section 4, We add it to the list. Section 6.4 explains this and how to leave.

4. How We Collect Information

4.1 Information You Provide

We collect information You voluntarily provide when You:

• Create an Account
• Subscribe to the Service
• Request a quote
• Contact Our support team
• Respond to surveys or feedback requests
• Participate in promotions
• Apply to Our Affiliate and Reseller Program

We also record Your email address when an account administrator adds You as a licensed user on their Account, which You may not have done yourself. However We come to hold Your address, holding it is what places You on Our marketing list; see Section 6.4.

4.2 Information Collected Automatically

We automatically collect information through:

• Cookies and Similar Technologies: When You visit Our Website or Dashboard
• Browser Extension: When You use SSFeatures with Smartsheet
• Server Logs: When You access Our servers
• Analytics, Advertising, and Referral Tools: Through the third-party providers described in Sections 8 and 9

4.3 Information from Third Parties

We may receive information from:

• Smartsheet: Basic profile information (email, first name, last name) when You use the Browser Extension with Smartsheet
• Payment Processors: Transaction status and billing information from Stripe
• Affiliates and Resellers: The email address and organization of a customer they refer to Us or purchase on behalf of

5. Legal Basis for Processing (GDPR)

If You are located in the European Economic Area (EEA), United Kingdom, or Switzerland, We process Your Personal Data based on the following legal grounds:

5.1 Contract Performance

We process Personal Data necessary to:

• Provide and maintain the Service
• Process Your Subscription and payments
• Manage Your Account
• Provide customer support

5.2 Legitimate Interests

We process Personal Data for Our legitimate business interests, including:

• Improving and optimizing the Service
• Analyzing usage patterns and trends
• Identifying Accounts that may benefit from additional training or assistance, and contacting them about it
• Preventing fraud and ensuring security
• Marketing Our own products and services to Our users and customers, including adding Your email address to Our marketing list when We first record it and sending You marketing email until You unsubscribe (see Section 6.4)
• Measuring whether Our advertising leads to sign-ups and purchases (see Section 9.13)
• Paying commissions to affiliates who refer customers to Us (see Section 9.10)
• Telling a Browser Extension user who has no Subscription that an Account exists at their email domain, and passing their request to join it to that Account's owner or administrators (see Section 7.6)

5.3 Legal Obligations

We process Personal Data to comply with legal obligations, such as:

• Tax and accounting requirements
• Responding to lawful requests from authorities
• Enforcing Our terms and policies

5.4 Consent

Where required by law, We obtain Your consent before:

• Using certain Cookies and tracking technologies
• Processing sensitive Personal Data

You may withdraw consent at any time by contacting Us at [email protected].

Marketing email is not on this list. We do not ask for Your consent before adding You to Our marketing list, and We do not treat Your acceptance of this Privacy Policy or of Our Terms and Conditions as that consent. We rely on Our legitimate interests (Section 5.2) and on Your right to unsubscribe. Where local law restricts marketing email to people who have asked for it, We rely on the exception that permits a business to email its own customers and users about its own similar products. Section 6.4 explains how this works and Section 14 explains Your right to object.

6. How We Use Your Information

We use the information We collect to:

6.1 Provide and Maintain the Service

• Verify Your Plan, subscription status, and license validity
• Enable access to the features included in Your Plan
• Process transactions and send related information
• Provide customer support and respond to inquiries
• Match the email domain of a Browser Extension user without a Subscription to Accounts at the same domain, and, if that user asks, pass their request to be added to the Account's owner or administrators

6.2 Improve the Service

• Analyze usage patterns to improve features
• Identify and fix bugs and technical issues
• Develop new features and functionality, and decide which features belong in which Plan
• Conduct research and analysis
• Identify Accounts where additional training or assistance may be helpful, and contact them about it

6.3 Communicate With You

• Send transactional emails (receipts, subscription updates, notices about changes to Your Plan or its price)
• Respond to Your inquiries and support requests
• Send security alerts and important notices
• Provide product updates and announcements

6.4 Marketing

• Send promotional communications about Our products and services
• Inform You of special offers and new features
• Measure whether Our advertising leads to sign-ups and purchases

Marketing email is opt-out rather than opt-in. We add Your email address to Our marketing list when We first record it, without asking You first. This happens when You create an Account, when an account administrator adds You as a licensed user, when You first use the Browser Extension, when You join Our affiliate program, and when You join a beta program.

You may opt out of marketing communications at any time by clicking the "unsubscribe" link in any marketing email or contacting Us at [email protected]. Where You are an administrator asking on behalf of Your organization, We will honor that request for an entire email domain.

Opting out of marketing does not stop the service emails described in Section 6.3, which We must send to operate Your Account, and it does not affect Your Account, Your Subscription, or Your access to the Service.

We do not treat Your acceptance of Our Terms and Conditions or of this Privacy Policy as consent to marketing. Section 5.2 states the basis We rely on, and Section 14 states Your right to object.

6.5 Security and Fraud Prevention

• Monitor for suspicious or fraudulent activity
• Protect against unauthorized access
• Enforce Our Terms and Conditions
• Comply with legal obligations

7. How We Share Your Information

We do not sell Your Personal Data. We may share Your information in the following circumstances:

7.1 Service Providers

We share information with third-party service providers who perform services on Our behalf (see Section 9 for details).

7.2 Business Transfers

If SSFeatures is involved in a merger, acquisition, or sale of assets, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different privacy policy.

7.3 Legal Requirements

We may disclose Your information if required to do so by law or in response to valid legal requests by public authorities (e.g., a court or government agency).

7.4 Protection of Rights

We may disclose information when We believe disclosure is necessary to:

• Comply with a legal obligation
• Protect and defend Our rights or property
• Prevent or investigate possible wrongdoing
• Protect the safety of Users or the public
• Protect against legal liability

7.5 With Your Consent

We may share Your information for other purposes with Your explicit consent.

7.6 Organizational Accounts

If You access the Service using an email address associated with an organization, such as Your employer or its affiliates, or if that organization has or later establishes an Account with Us covering Your email domain, We may share information about You with that organization and its designated administrators. This includes:

• Your name and email address
• Your Plan, and Your license and subscription status, including whether You are on a free trial
• Whether and when You have used the Service

Your organization's administrators may also be able to view and manage Your access to the Service, including assigning, reassigning, or removing Your license.

This applies whether You signed up with Us directly or were added by Your organization. Where We share this information, We do so as an independent controller of Your Account information, not on Your organization's behalf.

If You use the Browser Extension without a Subscription and an Account exists for Your email domain, We may tell You that someone at Your organization uses SSFeatures. If You then ask to be added, We send Your name and email address, as read from Smartsheet, to that Account's owner or administrators. We do this only at Your request. We do not do this for public email providers such as gmail.com.

If You own or administer an Account, people at Your email domain may learn that Your organization has an Account, and We will send You their requests. We do not reveal Your identity, Plan, or license count to them. You can turn these requests off at any time in the Dashboard.

7.7 Resellers and Affiliates

Some Subscriptions are purchased or managed on Your behalf by a third party, such as a consultant, partner, or reseller.

If Your Subscription was purchased through a reseller, We may share with that reseller the email address of the account owner, the Plan and number of licenses held, the subscription status and billing cycle dates, the users assigned to the Subscription, and the email domains associated with it. Resellers may also manage the Subscription on Your behalf, including adding, removing, and reassigning licensed users. Requests to join Your Account under Section 7.6 are sent to You as the account owner, not to the reseller, and the reseller may see the users You add through them.

If Your Account is associated with one of Our affiliates, for example because You subscribed using their referral link or discount code, We may share with that affiliate the email address of the account owner, the Plan and number of licenses held, the subscription status, and the referral or discount code used. Affiliates cannot view Your feature usage and cannot manage Your Account or licenses.

8. Cookies and Tracking Technologies

8.1 Types of Cookies We Use

Essential Cookies (Required)

• Purpose: Authentication, security, bot protection, and basic functionality
• Duration: Session or persistent (up to 1 year)
• Provider: SSFeatures; Cloudflare (security and bot protection, see Section 9.12)
• Example: Session cookies to keep You logged in; Cloudflare's security cookies

Functional Cookies

• Purpose: Remember Your preferences and settings
• Duration: Persistent (up to 1 year)
• Example: Language preferences, dashboard layout

Analytics Cookies

• Purpose: Understand how visitors interact with Our Website
• Duration: Up to 26 months
• Provider: PostHog
• Example: Page views, feature usage

Performance Cookies

• Purpose: Monitor and improve Service performance
• Duration: Session or short-term
• Provider: Sentry
• Example: Error tracking, performance metrics

Referral Attribution Cookies

• Purpose: Record that You arrived at Our Website through an affiliate's link, so that a later purchase can be credited to that affiliate
• Duration: Up to 60 days
• Provider: Rewardful (see Section 9.10)
• Example: A referral identifier set when You follow an affiliate link. The Rewardful script loads for every visitor, but a referral is recorded only when You arrive through an affiliate link or use an affiliate's code

Advertising and Conversion Measurement Cookies

• Purpose: Measure whether a visit that began with one of Our advertisements led to a sign-up or purchase, so that We can tell which of Our advertising works
• Duration: Up to 90 days
• Provider: Google (Google Ads, see Section 9.13)
• Example: A Google advertising identifier that links a click on one of Our advertisements to a later conversion on Our Website or Dashboard. Section 8.3 describes how to opt out

8.2 Managing Cookies

You can control Cookies through Your browser settings:

• Block All Cookies: May prevent You from using some features
• Delete Cookies: Will log You out and reset preferences
• Accept All Cookies: Provides the best experience

Most browsers allow You to:

• View what Cookies are stored
• Delete Cookies individually or all at once
• Block third-party Cookies
• Block Cookies from specific sites

8.3 Opting Out of Advertising Measurement

You can opt out of Google's advertising cookies and conversion measurement by:

• Visiting Google's Ads Settings at https://adssettings.google.com and turning off ad personalization
• Installing Google's opt-out browser add-on at https://tools.google.com/dlpage/gaoptout
• Blocking third-party cookies in Your browser, which prevents the Google advertising cookie from being set
• Emailing [email protected] with the subject "Opt out of advertising measurement", and We will honor the request for Your Account

Opting out does not affect Your Account, Your Plan, or Your access to the Service. The Browser Extension never loads advertising or conversion measurement code and never sends anything to Google.

9. Third-Party Service Providers

We use the following third-party services to operate and improve Our Service. The current list, with each provider's location, is maintained at https://trust.ssfeatures.com/sub-processors.

9.1 Payment Processing

Stripe

• Purpose: Process payments and manage subscriptions
• Data Shared: Name, email, billing address, payment information
• Data Stored by SSFeatures: Transaction IDs, last four digits of card
• Privacy Policy: https://stripe.com/privacy
• Compliance: PCI-DSS Level 1 certified

9.2 Authentication

Keycloak (Self-Hosted)

• Purpose: Secure user authentication and identity management
• Data Processed: Email, name, authentication tokens
• Location: Hosted on Our servers (see Section 13.1)
• Note: Keycloak is open-source software that We host and control

9.3 Analytics

PostHog

• Purpose: Product analytics to understand feature usage, improve the Service, and support Our customers
• Data Shared: Feature usage events (e.g., "feature X was used"), an identifier derived from Your email address, Your Plan, and standard technical data (browser, device, IP address, and the address of the page You are using). Your email address and Your name are not sent to PostHog.
• Privacy Policy: https://posthog.com/privacy
• Note: This data is linked to Your Account. It is pseudonymous, not anonymous: the identifier is derived from Your email address, and We are able to link analytics activity back to You. See Section 9.9 for how We use it.

When You use the Browser Extension, the page address recorded with each event is the Smartsheet page You were on. Smartsheet page addresses contain the numeric identifier of the sheet or report, but not its name or any of its contents.

9.4 Error Monitoring

Sentry

• Purpose: Error tracking, performance monitoring, and session replay
• Data Shared: Error logs, stack traces, device/browser information, and session replay recordings (see below)
• Privacy Policy: https://sentry.io/privacy
• Note: We configure Sentry to minimize Personal Data collection

Session Replay

Sentry records a replay of some browsing sessions so that We can see what happened in the moments before an error. A replay reconstructs the page as it appeared to You and covers things such as page navigation, clicks, and the technical activity of the page.

• Where it runs: Our Website (ssfeatures.com) and Dashboard (app.ssfeatures.com) only
• Where it does not run: The Browser Extension. Session replay is not part of the Extension, so it never records Your Smartsheet pages or anything on them.
• How much is recorded: Approximately 10% of sessions, plus any session in which an error occurs

9.5 Cloud Infrastructure

DigitalOcean

• Purpose: Cloud hosting and data storage
• Data Stored: Account data, feature usage analytics (see Section 9.9), server logs, database backups
• Location: United States (North America)
• Privacy Policy: https://www.digitalocean.com/legal/privacy-policy
• Compliance: SOC 2 Type II certified

9.6 Business Communications

Google Workspace

• Purpose: Email communications, document storage, internal collaboration
• Data Processed: Email correspondence, support communications
• Privacy Policy: https://policies.google.com/privacy
• Compliance: SOC 2, ISO 27001 certified

9.7 Email Marketing

MailerLite

• Purpose: Email marketing and newsletter communications. Enrollment is automatic and opt-out, not opt-in; see Section 6.4
• Data Shared: Email address; first and last name where We hold them; and group labels describing Your relationship to Us, such as whether You are a new user, have been asked for a review, own a Subscription, are a member of a Subscription, are on the Free Plan, have never subscribed, are an affiliate, or are a beta tester
• Not Shared: Your Smartsheet content, which is never sent to MailerLite
• Location: European Union
• Privacy Policy: https://www.mailerlite.com/legal/privacy-policy
• Compliance: GDPR compliant

9.8 Customer Relationship Management

Pipedrive

• Purpose: Managing Our relationships with customers and prospective customers, including tracking subscriptions, renewals, and follow-up
• Data Shared: Your name, email address, and phone number where You have given it; Your organization's domain name, Plan, licensed seat count, number of active users, renewal date, and subscription value; and internal labels describing Your relationship to Us, such as whether You are a billing contact or an engaged user of the Service
• Location: United States
• Privacy Policy: https://www.pipedrive.com/en/privacy
• Note: Some labels are informed by the feature usage described in Section 9.9. We do not send Your Smartsheet content to Pipedrive.

9.9 Product Analytics in Our Own Systems

In addition to being processed by PostHog, feature usage information is stored in Our own database, hosted on DigitalOcean's managed PostgreSQL service in the United States (see Section 9.5). It is not shared with any other third party.

• What is stored: Which features were used, how many times, and on which date, associated with Your Account and the Plan You were on
• What is not stored: Any of Your Smartsheet content, including sheet names, cell values, formulas, comments, and attachments
• How We use it: To improve the Service, to provide support, to understand which features deliver the most value and which belong in which Plan, and to identify Accounts where additional training or assistance may be helpful. We may contact You about Your use of the Service on this basis.
• Legal basis (GDPR): Our legitimate interest in improving and supporting the Service (see Section 5.2). You may object to this processing at any time by contacting Us at [email protected].

We do not sell this information, and We do not share it for advertising purposes.

9.10 Affiliate Program Management

Rewardful

• Purpose: Managing the SSFeatures Affiliate and Reseller Program: tracking referrals, calculating commissions, and paying affiliates
• Data Shared: If You are an affiliate, the name, email address, and payout details You provide when You join, Your referral links and discount codes, and the referrals and commissions attributed to You. If You were referred by an affiliate, the email address and Subscription payment amounts needed to attribute the referral and calculate the commission. For every visitor to Our Website or Dashboard, the Rewardful script may set the referral cookie described in Section 8.1 and record the visit
• Not Shared: Your Smartsheet content, which is never sent to Rewardful
• Location: United States
• Privacy Policy: https://rewardful.com/privacy
• Note: Referral and commission data is processed only if You participate in the Affiliate and Reseller Program or were referred by an affiliate. The program's own terms are at https://ssfeatures.com/affiliate-terms

9.11 Transactional Email

MailerSend

• Purpose: Delivering Our service emails, such as receipts and billing notices, notices about changes to Your Plan or its price, requests from people at Your organization to join Your Account, replies to contact and quote requests, affiliate program correspondence, and invoices to resellers
• Data Shared: Your email address, Your name where We hold it, and the content of the message, which may include Your Plan, license count, and billing details
• Not Shared: Your Smartsheet content, which is never sent to MailerSend
• Location: European Union
• Privacy Policy: https://www.mailersend.com/legal/privacy-policy

9.12 Network Security and Bot Protection

Cloudflare

• Purpose: DNS, DDoS protection, web application firewall, and TLS termination for all traffic to Our Website, Dashboard, and servers, and bot protection (Cloudflare Turnstile) on some of Our forms, such as the quote request form
• Data Processed: IP address, request headers, and browser characteristics for each request to the Service, held briefly to filter malicious traffic
• Not Shared: Your Smartsheet content, which never passes through Our servers
• Location: United States, with a global network of edge locations
• Privacy Policy: https://www.cloudflare.com/privacypolicy/

9.13 Advertising and Conversion Measurement

Google Ads

• Purpose: Measuring whether visits that began with one of Our advertisements led to a sign-up, trial, or purchase, so that We can tell which of Our advertising works and spend accordingly
• Data Shared: The Google advertising identifier described in Section 8.1, the page You were on, the fact that a conversion event occurred (such as completing a purchase), and standard technical data such as IP address and browser type. We do not send Google Your name, email address, or Smartsheet content
• Where it runs: Our Website and Dashboard only. The Browser Extension never loads Google advertising code
• Location: United States
• Privacy Policy: https://policies.google.com/privacy
• Opt out: See Section 8.3. If You are a California resident, see also Section 14.3

10. Browser Extension Privacy

10.1 How the Browser Extension Works

The SSFeatures Browser Extension operates entirely within Your browser. It:

• Interacts directly with the HTML and JavaScript on Smartsheet web pages
• Adds UI elements (buttons, menus, dialogs) to enhance Smartsheet
• Calls Smartsheet's own JavaScript functions to perform actions
• Stores all settings in Your browser's Local Storage

10.2 Extension Permissions

The Browser Extension requires certain permissions to function:

10.3 Data Flow

What stays in Your browser:

• All Your Smartsheet data
• Your SSFeatures settings and preferences
• Feature configurations (e.g., sort settings)

What is sent to SSFeatures servers:

• Your Smartsheet email, first name, and last name (for license and Plan verification)
• Feature usage analytics linked to Your Account (e.g., "Auto Sort activated")

What is NOT sent:

• Any Smartsheet content, data, or metadata
• Your sort configurations or feature settings
• Any information about Your sheets, reports, or dashboards

10.4 Source Code Transparency

Our Browser Extension source code is fully visible and auditable. Browser extension stores (Chrome, Edge, Firefox, Safari) require unobfuscated code. You can view the source code in Your browser's developer tools under "Sources > SSFeatures > javascript/webpage/webpage-main.js".

10.5 No Remote Code Execution

SSFeatures does not and cannot remotely inject code into Your browser. Browser extension stores explicitly prohibit and detect remote code execution attempts.

11. Data Retention

We retain Your Personal Data only as long as necessary for the purposes described in this Privacy Policy. Specific retention periods are:

Subscription Cancellation vs. Account Deletion

• Subscription Cancellation: Your Account and data remain active, on the Free Plan where one is offered. You may resubscribe at any time.
• Account Deletion: Upon Your explicit request, We will delete Your Personal Data within thirty (30) days. The only exceptions are the records marked above as kept after Account deletion, which We retain because the law requires it (payment records for tax purposes) or to answer later questions about the support We gave You; We keep them only for the period shown, keep them confidential, and process them only for that purpose. This is the same commitment We make to organizations in Our Data Processing Addendum. Contact [email protected] to request Account deletion.

12. Data Security

We implement robust security measures to protect Your Personal Data:

12.1 Technical Safeguards

• Encryption in Transit: All data transmitted between Your browser and Our servers is encrypted using TLS 1.2 or greater
• Encryption at Rest: Data stored in Our databases is encrypted at rest using provider-managed volume encryption (LUKS) on DigitalOcean managed database services
• Access Controls: Logical access controls for all servers, systems, and databases
• DDoS Protection: All traffic is proxied through Cloudflare's DDoS protection and web application firewall (see Section 9.12)
• Secure Development: Regular security reviews and code audits

12.2 Organizational Safeguards

• Background Checks: Background checks for employees with access to Personal Data
• Least Privilege Access: Employees have access only to data necessary for their role
• Confidentiality Agreements: All personnel are bound by confidentiality obligations
• Multi-Factor Authentication: Required for administrative and privileged access to internal systems, and enforced wherever the system supports it
• Employee Training: Regular security awareness training
• Access Reviews: Quarterly evaluation of access rights, with access revoked promptly when no longer needed and in any event within two weeks
• Encrypted Workstations: Full-disk encryption on all Company workstations (FileVault on macOS, LUKS on Linux)

12.3 Incident Response

• Security Monitoring: Continuous monitoring for suspicious activity
• Incident Notification: We will notify affected users without undue delay (and in any event within 72 hours) of discovering a security incident impacting user data
• Backup and Recovery: Regular backups with tested restore procedures

12.4 Compliance

SSFeatures undergoes independent SOC 2 examinations of its security practices. Our current attestations and reports, and detailed information about Our security practices and procedures, are available at Our Trust Center at https://trust.ssfeatures.com.

13. International Data Transfers

13.1 Data Location

Your Personal Data is primarily stored on servers located in the United States (North America), operated by DigitalOcean. The third-party services listed in Section 9 and at https://trust.ssfeatures.com/sub-processors may process Personal Data in the locations identified there.

13.2 Transfer Mechanisms

If You are located outside the United States, Your Personal Data will be transferred to the United States. We rely on the following mechanisms to ensure lawful transfers:

• Standard Contractual Clauses (SCCs): We use EU-approved Standard Contractual Clauses for transfers from the EEA, UK, and Switzerland
• Data Processing Agreements: We maintain appropriate data processing agreements with Our service providers

14. Your Privacy Rights

14.1 Rights for All Users

Regardless of Your location, You have the right to:

• Access: Request a copy of the Personal Data We hold about You
• Correction: Request correction of inaccurate Personal Data
• Deletion: Request deletion of Your Personal Data
• Data Portability: Request Your data in a machine-readable format
• Opt-Out: Unsubscribe from marketing communications at any time, using the link in any marketing email or by contacting Us. Because We enroll You without asking first (Section 6.4), this is the right that matters most here, and We honor it whatever country You are in. You may also opt out of advertising measurement as described in Section 8.3

To exercise these rights, contact Us at [email protected].

14.2 Additional Rights for EEA, UK, and Swiss Residents (GDPR)

If You are located in the European Economic Area, United Kingdom, or Switzerland, You also have the right to:

• Restrict Processing: Request that We limit how We use Your data
• Object to Processing: Object to processing based on legitimate interests
• Object to Direct Marketing: Object to Our use of Your data for direct marketing at any time. This right is absolute. Unlike the general right to object above, We do not weigh Our interests against Yours: if You object, We stop
• Withdraw Consent: Withdraw consent at any time (where processing is based on consent)
• Lodge a Complaint: File a complaint with Your local data protection authority

EEA Supervisory Authorities: https://edpb.europa.eu/about-edpb/about-edpb/members_en

UK Information Commissioner's Office: https://ico.org.uk

Swiss Federal Data Protection Authority: https://www.edoeb.admin.ch

14.3 Rights for California Residents (CCPA/CPRA)

If You are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide You with specific rights:

Right to Know

You have the right to request that We disclose:

• Categories of Personal Information collected
• Categories of sources from which Personal Information was collected
• Business or commercial purpose for collecting Personal Information
• Categories of third parties with whom We share Personal Information
• Specific pieces of Personal Information We have collected about You

Right to Delete

You have the right to request deletion of Personal Information We have collected from You, subject to certain exceptions.

Right to Correct

You have the right to request correction of inaccurate Personal Information.

Right to Opt-Out of Sale or Sharing

SSFeatures does not sell Your Personal Information. We do not share Your Account information, feature usage, or Smartsheet content for advertising. We do use Google Ads conversion measurement on Our Website and Dashboard, described in Section 9.13, which places a Google advertising cookie and reports to Google that a visit led to a sign-up or purchase. To the extent California law treats that as "sharing" for cross-context behavioral advertising, You have the right to opt out, and You may do so by any of the methods in Section 8.3, including by emailing [email protected]. We will honor a request within fifteen (15) business days. We do not knowingly sell or share the Personal Information of anyone under 18.

Right to Non-Discrimination

We will not discriminate against You for exercising Your privacy rights.

Categories of Personal Information Collected (Past 12 Months)

How to Exercise Your Rights

Submit requests to [email protected]. We will verify Your identity before processing requests. You may designate an authorized agent to make requests on Your behalf.

Response Timing

We will respond to verifiable requests within 45 days. If We need more time (up to 90 days total), We will notify You.

14.4 Rights for Other Jurisdictions

We respect privacy rights under other applicable laws. If You are located in a jurisdiction with specific privacy rights not listed above, please contact Us at [email protected] to discuss how We can assist You.

15. Children's Privacy

The Service is intended for users who are at least 18 years of age, as specified in Our Terms and Conditions. We do not knowingly collect Personal Data from anyone under 18.

If We learn that We have collected Personal Data from anyone under 18, We will take steps to delete that information promptly.

If You believe We have collected information from anyone under 18, please contact Us immediately at [email protected].

16. Do Not Track Signals

Our Service does not currently respond to Do Not Track (DNT) browser signals, for which there is no accepted industry standard. The only tracking across websites that We take part in is the Google Ads conversion measurement described in Sections 8.1 and 9.13, which You can opt out of as described in Section 8.3.

The Browser Extension only operates on Smartsheet domains, does not load any advertising or analytics code from third parties other than those described in Section 9, and does not track Your activity on other websites.

17. Automated Decision-Making

SSFeatures does not use automated decision-making or profiling that produces legal effects or similarly significant effects on You.

18. Links to Third-Party Websites

Our Service may contain links to third-party websites or services that are not owned or controlled by SSFeatures, including Smartsheet.com.

We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites or services. We encourage You to review the privacy policies of any third-party sites You visit.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When We make changes:

• We will update the "Last Updated" date at the top of this Privacy Policy
• For material changes, We will notify You via email to the address associated with Your Account at least 30 days before the changes take effect
• We will post the updated Privacy Policy on Our Website

Your continued use of the Service after the effective date of any changes constitutes Your acceptance of the revised Privacy Policy.

We encourage You to review this Privacy Policy periodically.

20. Contact Us

If You have any questions, concerns, or requests regarding this Privacy Policy or Our data practices, please contact Us:

SSFeatures, LLC

• Email: [email protected]
• Website: https://ssfeatures.com/contact
• Trust Center: https://trust.ssfeatures.com

For Privacy-Specific Inquiries:

Please include "Privacy Inquiry" in the subject line of Your email.

Response Time:

We aim to respond to all inquiries within 5 business days.

21. Additional Information

21.1 Smartsheet Relationship

SSFeatures is an independent company and is not affiliated with, endorsed by, or officially connected to Smartsheet Inc. Smartsheet is a trademark of Smartsheet Inc. Our Browser Extension is designed to enhance Your Smartsheet experience but operates independently of Smartsheet's systems.

21.2 Trust Center

For comprehensive information about Our security practices, compliance attestations, and data protection measures, please visit Our Trust Center at https://trust.ssfeatures.com.

21.3 Questions About Specific Features

If You have privacy or security questions about a specific SSFeatures feature, please visit Our Features page at https://ssfeatures.com/features or contact Us directly.

By using the SSFeatures Service, You acknowledge that You have read and understood this Privacy Policy.