Operator and scope
SteadyTable is operated by Venture VD LLC, a Michigan domestic limited liability company (identification number 802557198). Contact support@venturevd.com for privacy, access, correction, export, or deletion requests. Offered only in the United States or Canada. Customers control the table data they connect; Venture VD processes it on their instructions under the Data Processing Addendum.
What we process and why
We process Wix site and instance identifiers used to install and bill the app; table configuration (name, source, columns, style); the data the owner connects — a Google Sheet, CSV upload, or manual rows — cached as a last-known-good snapshot so the table keeps rendering when the source is unreachable; an append-only sync history of timestamps, outcomes, and error summaries that never contains row contents; Google OAuth tokens encrypted at rest for private sheets; and operational and security telemetry. Processing serves only to render the owner's tables, show sync health, prevent abuse, support customers, and operate plan entitlements.
We do not sell table data, use it for advertising, or use it to train generalized AI models. Table content is whatever the owner publishes; owners are responsible for their own notices and lawful basis for personal data they place in a connected sheet.
Google user data
Effective when private-sheet access ships. SteadyTable's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including Limited Use. Only the https://www.googleapis.com/auth/spreadsheets.readonly scope is requested, used solely to read the connected spreadsheet to render it on the owner's own site. Google user data is never sold, used for advertising, or used to train generalized AI models. Not yet live; activates once Google OAuth verification completes.
Retention and control
Snapshots are retained while a table exists, replaced only by a successful re-sync. Deleting a table removes it from the owner's view immediately. Account data — tables, snapshots, sync history, encrypted Google tokens — is deleted 30 days after uninstall. Owners can read current data via the dashboard or render endpoint any time before uninstalling.
Sharing and subprocessors
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Fly.io | Hosting and network | Site/instance identifiers, table content in transit, operational metadata | Chicago, United States |
| Fly Managed Postgres | Encrypted database, backups, recovery | Table config, cached snapshots, sync history, encrypted Google tokens | Chicago, United States |
| Wix.com Ltd. | Platform, install lifecycle, billing | Instance identifiers, plan and billing state; never row content beyond the rendered widget | Wix infrastructure |
| Google (customer-selected) | Reads the connected spreadsheet | Sheet content; read-only OAuth token once private sheets are enabled | Google infrastructure |
Material subprocessor changes get advance notice and an objection right. No analytics or error-tracking subprocessor is enabled at launch.
Security
Google credentials are encrypted at rest (AES-256-GCM). Database connections require certificate-verified TLS. Wix requests are signature-verified. The runtime database role cannot delete account data; a separate restricted role performs the 30-day purge. Logs are structured and redact sheet identifiers and secrets.
Location and privacy rights
Data is processed in Fly.io's Chicago region, United States. Canadian customers' data leaves Canada and may face US lawful access; we remain accountable under PIPEDA. US state privacy laws and PIPEDA may give rights to know, access, correct, delete, or port data. We do not sell or share personal data as defined by California law. Appeal by reply, or file with a state attorney general or Canada's Office of the Privacy Commissioner.
Changes
Material changes are posted here with an updated date and, where they affect processing, emailed to administrators.