Provider: Karelia Labs, Sweden ("we", "us")
Contact for privacy questions: support@karelialabs.atlassian.net
Version / date: 1.0 / 2026-10-20
1. What this policy covers
Karelia Spreadsheet ("the Addon") is an addon for Statamic 6 websites. It lets Control Panel users edit many entries of a collection at once, in a spreadsheet. This policy explains what personal data the Addon handles and what we, the provider, do and do not receive.
2. The short version
- The Addon runs on the site's own server and in the Control Panel user's browser. It never contacts us, sends no usage data, analytics or telemetry, and has no account with us.
- It stores nothing of its own on the server. Entries are saved exactly as Statamic saves them from the publish form.
- We do not receive content, user names, email addresses or files.
3. Data handled by the Addon
| Data | Examples | Purpose | Where | Retention |
|---|---|---|---|---|
| Entries being edited | The field values of the entries in the sheet, and labels of related entries, terms, users and assets | Show and edit them | Loaded from the site into the user's browser while the sheet is open; saved back through Statamic | Nothing is kept by the Addon. Saved entries follow the site's own rules |
| Column choice | Which columns a user shows for a collection | Remember the user's layout | The user's browser (local storage) | Until the user clears the browser's site data |
| CSV files | An export or an import file | Move values in and out | Downloaded to, or read from, the user's own computer | Under the user's control |
| Settings | The most entries loaded into one sheet | Run the Addon | The site's config | Until changed |
Saving goes through Statamic: the entry's blueprint validation, its fieldtypes, revisions where they are on, and the "last modified by" information Statamic always records. The Addon adds no cookies, no database tables and no front-end code. Visitors of the website are not affected by it.
4. Data sent anywhere
None. The Addon makes no network requests other than to the site's own Control Panel.
5. Data we receive as the provider
- Support requests: if you contact support we receive what you send us (typically name, email address, site address and the problem description). We use it to answer you and keep it as long as needed for support and legal obligations, for at most 24 months after the last message, unless a longer period is required by law (for example bookkeeping rules).
- Licences: licences are sold through the Statamic Marketplace on statamic.com. Statamic handles the checkout, taxes, receipts, licence keys and refunds under its own terms, and payments to us go through Stripe. We receive the information Statamic gives sellers about a sale, such as the buyer's name or company, email address, the licence and the amount.
- Website: the Karelia Labs website sets no cookies and uses no analytics or trackers.
Statamic itself checks licence keys with statamic.com. That is part of Statamic, not of the Addon, and is covered by Statamic's own privacy policy.
6. Roles and legal basis
For the site's content, the site operator decides why and how it is used and is the controller. We do not process the site's personal data: the Addon sends us nothing and we have no access to the site's server.
For our own data (support requests and sales records) we are the controller. The legal basis is our contract with you, our legitimate interest in running and supporting the Addon, and legal obligations (bookkeeping).
7. Sub-processors and recipients
We use no sub-processors for site data, because we receive none. Support requests, whether sent through our support portal or by email, are handled in Atlassian's Jira Service Management, with Atlassian as our processor under its Data Processing Addendum. Statamic and Stripe handle sales and payments under their own terms.
8. International transfers
Site data stays where the site stores it. Our own support data is stored in Atlassian's cloud. Atlassian may process it outside the EU/EEA, for example in the United States, and protects such transfers with the EU Standard Contractual Clauses and its certification under the EU-U.S. Data Privacy Framework.
9. Retention and deletion
The Addon keeps nothing on the server, so there is nothing of its own to delete. A user's column choice is removed by clearing the browser's data for the site. Removing the Addon with Composer removes it completely.
10. Security
Every request is checked on the server. Users need the "Use the spreadsheet" permission, see only entries they may view, can change only entries they may edit, need publish rights to change the status and cannot change the author unless they may edit other authors' entries. Values are validated by the entry's blueprint before anything is saved. CSV exports write cells that a spreadsheet program could run as a formula in a safe form.
11. Your rights
Under the GDPR you may have the right to access, correct, erase, restrict or object to the processing of your personal data, to data portability, and to complain to a supervisory authority (in Sweden: Integritetsskyddsmyndigheten, IMY). For data on a website that uses the Addon, please contact the operator of that website first, because we have no access to it. For our own data contact support@karelialabs.atlassian.net.
12. Children
The Addon is a tool for website operators and is not directed at children.
13. Changes
We will update this policy when the Addon's data handling changes and publish the new version with a new date. Material changes are announced in the changelog.