Privacy Policy

This policy explains what personal data Mettrie, Inc. (“mettrie”, “we”, “us”) handles when you use mettrie or visit mettrie.com, why we handle it, how long we keep it, and the choices you have.

1. What this policy covers

mettrie is an FP&A agent for finance teams that plan in Google Sheets. It has:

• a Chrome extension (a side panel next to your sheet);
• a web app;
• an optional Apps Script menu that mettrie installs in your plan, if you ask it to;
• a backend on Google Cloud that calls Anthropic's Claude models;
• optional check-ins with your budget owners.

This policy covers the mettrie service and our website, mettrie.com, including the early-access waitlist.

Business customers. mettrie is a business service. When a company uses mettrie, the company decides what data to connect. For that data the company is the controller and mettrie acts as its processor, under our agreement with the company. If you use mettrie through your employer, please contact your company first about your data; we will help them answer you.

2. What we collect

2.1 Account data

When you sign in with Google, we receive and store your Google account id, email address and name. We only accept Google accounts with a verified email address. We also store your company memberships, your role (owner, admin, analyst, department head or viewer), whether you have permission to see compensation data, and invitations (the invited email, role, and who sent it).

2.2 Business and financial data

To do the work you ask for, mettrie reads ranges of the plan your company connects and the files you upload or pick, such as general-ledger exports, budgets, forecasts and headcount rosters. These can contain personal data about your employees and contractors (for example names and departments, and compensation in files and tabs marked restricted). Only people with comp access can make mettrie read restricted data.

mettrie does not copy your workbook wholesale. It keeps what it needs to do and record the work:

• company setup: profile, account mappings, a directory of budget owners (names, work emails and, if used, Slack ids), standing approvals, KPIs and workflows;
• what mettrie has learned about how your company works, as short readable statements with the evidence behind them, which you can view, edit or delete;
• proposed changes and the decisions on them, including the cell values before and after;
• import summaries, saved plan versions and their figures, checks, daily digests and run records.

Your sheets and files stay in your Google account. Deleting data in mettrie never deletes them.

2.3 Conversations

What you type to mettrie, its replies and the steps it took are stored as conversation history. Each conversation is private to the person who started it, unless they share it read-only with a colleague in the same company.

2.4 Check-ins with budget owners

If your company uses check-ins, mettrie asks the budget owners in your owners directory questions about the numbers. Check-ins appear in the mettrie panel for people who are members of your company. If Slack has been set up for your company, mettrie can also send them as Slack direct messages, looking up the owner's Slack user from their work email; the Slack app does not read channels or message history. mettrie sends nothing by Slack or email for your company unless that has been set up for your company. We store the question, the answer and any note. An answer is evidence for a proposal, never a change on its own.

2.5 Usage, cost and audit records

• Audit trail: who did what and when, for every change, approval and tool call, and for shares, exports and deletions, with details such as the cells changed.
• Model usage: for each AI model call, the company, the kind of work, the model, token counts, cost, and the related person, turn or run ids. No prompt or reply text.
• Limits: your company's spending caps and alerts.

2.6 Technical logs

Our servers write operational logs to Google Cloud Logging: ids, counts, timings and error types. Our logger masks email addresses, tokens and compensation values, and is designed not to record prompts or cell values. Google Cloud's own request logs also record the requested address, your IP address and browser user agent. We do not keep request logs for addresses that carry a one-time credential (such as the Google sign-in return page). Logs are kept for 30 days.

2.7 Browser storage

The mettrie extension and web app use no cookies, advertising or analytics trackers. They use your browser's storage only to keep you signed in and to remember things like your current company, the open conversation, unsent drafts and your notification setting. The extension never holds a Google token.

2.8 Support

If you email us, we keep your email and our reply.

3. Google user data

mettrie uses Google OAuth. Your Google account is how you sign in, and it is how mettrie works in your plan.

3.1 What mettrie's app asks Google for

mettrie's app never requests full Google Drive access, read access to your whole Drive, Gmail, Calendar or other Google data.

3.2 The menu in your plan (Apps Script)

If you add mettrie's menu to your plan, a small script runs inside your plan, in Google's systems, under the Google authorization of the person using it. Each person allows it for themselves on Google's consent screen the first time.

• Menu-only (the default). The script can read and write only the plan it is installed in, show the mettrie menu, run an optional daily import, call mettrie, and tell mettrie who clicked (spreadsheets.currentonly, script.container.ui, script.scriptapp,script.external_request, userinfo.email, openid). It has no access to your Google Drive. You upload each month's exports in the mettrie panel or web app, or pick them in Google's file picker.
• Folder watching (only if your company's owner turns it on). The script also picks up exports dropped into mettrie's imports folder. For that, Google requires read access to the installing owner's Drive (drive.readonly), plus drive.file and spreadsheets. The script reads only the imports folder, but anyone who can edit the plan can edit the script, so an owner should turn this on only if they would trust the plan's editors with their Drive. The owner can switch back to menu-only at any time.

When you click a menu item, the script sends mettrie your Google email and a Google-signed identity token. mettrie checks it, matches you to a member of your company, and acts as you, with your role. If you are not a member, or Google does not share who you are with the script, mettrie refuses and does nothing. Only the optional daily import acts as the person who turned it on. mettrie does not store the identity token, and does not receive the script's Google authorization.

3.3 How we store Google access

We store your Google refresh token encrypted (AES-256-GCM, with a key per credential protected by Google Cloud KMS). Short-lived access tokens are not stored. The token never goes to the Chrome extension or the web app.

3.4 Signing out and disconnecting

Signing out ends your mettrie session but keeps Google access, so scheduled work such as the monthly close keeps running. Disconnect Google (web app, Data and security) revokes mettrie's access at Google and deletes the stored token. See section 9.

4. How we use data

We do not sell personal data. We do not use it for advertising. We do not use your data, or any Google user data, to train AI models.

5. Google API Services: Limited Use

For data we receive through Google APIs:

1. We use it only to provide and improve the user-facing features of mettrie you can see in the product: reading and updating your plan with your approval, analysis and commentary, imports, decks and check-ins.
2. We transfer it only as needed to provide those features (to the service providers in section 7: Google Cloud for hosting, and Anthropic to run the AI model that does the work you ask for), to comply with law, or as part of a merger or acquisition with notice to you.
3. We do not use or transfer it for advertising, including retargeting or personalized ads.
4. We do not sell it, and we do not use it to determine credit-worthiness or for lending.
5. We do not use it to develop, improve or train generalized or non-personalized AI or machine-learning models. What mettrie learns about your company is stored as readable statements for your company only.
6. No person at mettrie reads it unless you give us permission for specific data (for example, to resolve a support request), it is needed for security (such as investigating abuse or an incident), it is needed to comply with law, or it has been aggregated and anonymized for internal operations. When our staff must access the production database, that access is logged.

6. AI processing (Anthropic)

mettrie uses Anthropic's Claude models through the Claude API. Each request carries the instructions, the ranges and figures the task needs, and the conversation so far. mettrie sends only what a task needs, and marks content from your sheets and files as data, not instructions. mettrie uses only the API's messages endpoint: no file uploads to Anthropic, no batch jobs and no Anthropic-hosted tools.

Anthropic's handling of API data is set by its commercial terms, under which Anthropic does not train its models on API inputs and outputs, and keeps them for a limited period. To reduce cost, parts of a prompt may be cached by Anthropic for a short time.

7. Who we share data with

We use these sub-processors to provide mettrie:

Your company's own Google Workspace (Sheets, Drive, Slides, Apps Script) is your service, not a mettrie sub-processor. Before we add a sub-processor for mettrie, we will update this list and tell customers. For our website's providers, see section 13.

We also disclose data when the law requires it, to protect rights and safety, or in a merger or acquisition (with notice).

8. How long we keep data

9. Deleting data and revoking access

These controls are in the web app's Data and security page.

• Disconnect Google (any user). mettrie revokes its access at Google and deletes the stored token. If Google can't be reached, the token is deleted anyway and we record that Google did not confirm. You can also remove mettrie at any time at myaccount.google.com/permissions.
• Delete my account (any user). Your sign-in, memberships, stored Google access (revoked at Google) and the conversations you started are deleted. Records your companies keep, such as approvals you made and the audit trail, stay with them but show “Deleted user” instead of you, and your email is removed from the audit trail and invitations. Text other people wrote that mentions you (for example the budget owners directory) is your company's data and is not changed; your company can edit it. If you are a company's only owner, make someone else owner or delete the company first.
• Delete this company (owner only). Google access is revoked for members who belong to no other company, then every record of the company is permanently deleted from our database, including the audit trail. Only a record that the deletion happened remains. It can't be undone, so export first. It never touches your Google files.
• Export (owner). Download your company's data as one JSON file, and the audit trail as CSV.
• Remove a member (owner or admin). Their access to the company ends at once.
• Delete a conversation (the person who started it), in the panel.
• Remove the menu script: an editor of the plan can delete it (Extensions, Apps Script) at any time.

When a customer's contract ends and the company has not been deleted, we delete it within the period in that customer's agreement. You can also ask us to delete your data by emailing help@mettrie.com.

10. Security

Each company's data is isolated in the database by row-level security, and each conversation is private to its author at the database level. Data is encrypted in transit and at rest; Google tokens are encrypted with keys in Google Cloud KMS; the database has no public IP address. Changes to your plan need an approval, enforced in code, and every change, approval and tool call is recorded in an append-only audit trail. No system is perfectly secure; if a personal data breach affects you, we will notify affected customers as our agreements and the law require.

11. Where data is processed

We store and process data in the United States (Google Cloud, us-central1, Iowa). Anthropic processes model requests in the United States. We do not offer an EU data location. For personal data from the EEA, the UK or Switzerland, we rely on the EU Standard Contractual Clauses, and the UK Addendum where required, for these transfers. Our Data Processing Addendum is available to customers on request at help@mettrie.com.

12. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the use of your personal data, to data portability, and to withdraw consent. To use these rights, email help@mettrie.com. If your data came to us through your employer's mettrie account, we will pass your request to them and help them answer it. You may also complain to your local data protection authority.

12.1 California and other US state privacy rights

If you live in California or another US state with a consumer privacy law, you may have the right to:

• know what personal information we collect, use and disclose, and access a copy of it;
• have it deleted;
• have inaccurate personal information corrected;
• opt out of the sale of personal information or its sharing for cross-context behavioural advertising.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We will not discriminate against you for exercising any of these rights.

To make a request, email help@mettrie.com. You may also use an authorised agent, who will need your written permission to act for you. We will verify a request before acting on it, usually by confirming it comes from the email address we hold for you, and may ask for more information if needed. Where we process the data for a business customer, we will pass your request to that customer.

13. Our website and waitlist

If you sign up for early access on mettrie.com, we collect your work email address, the time you signed up, the page that referred you, and your browser's user agent. These are stored in a Google Sheet in our Google Workspace. We use them to contact you about access to mettrie. To be removed, email help@mettrie.com. We keep waitlist entries until launch plus 12 months, or until you ask us to remove them, whichever comes first.

The website is hosted by Railway in the United States, whose servers receive your IP address and browser details when you visit. The website uses no cookies and no analytics or advertising trackers. Its fonts are served from our own site.

14. Children

mettrie is a business service. It is not for anyone under 18, and we do not knowingly collect their data.

15. Changes to this policy

We will post changes on this page and update the date at the top. For material changes, we will tell customers by email or in the product before they take effect.

16. Contact

Mettrie, Inc., a Delaware corporation. Email: help@mettrie.com.

We have not appointed a representative in the EU or the UK.