Skip to content
Formula Audit XL
Download free

Privacy policy

Last updated: .

This policy describes how Scalarly Srl ("we", "us"), the company behind Formula Audit XL and the data controller for the purposes of the EU GDPR, collects, uses, and protects information when you use the Formula Audit XL Excel add-in, the Formula Audit XL website at https://formulaudit.com, and the free web tools.

1. Model content and local processing

The Formula Audit XL Excel add-in processes your workbooks locally on your machine, inside the Excel process. Your cell values, formula text, sheet names, named ranges, and model structure are never transmitted to Formula Audit XL servers.

The free web tools (available at /free-tools) parse uploaded files entirely in your browser using client-side JavaScript. Uploaded files are not sent to any server. Closing or refreshing the browser tab discards all parsed data.

2. Data we collect

2.1 Account and billing data

When you purchase a licence, we collect your email address and payment-method details. Payment data is processed by Stripe; Formula Audit XL does not store credit card numbers. We retain your email address and subscription status for as long as your account exists.

2.2 Licence validation

The add-in periodically validates your licence by sending three items to our licensing API over HTTPS: your licence key, the add-in version number, and a one-way device identifier — a SHA-256 hash of stable hardware values. This hash is irreversible (it cannot be turned back into your computer name or serial number) and is used solely to enforce the one-device-per-licence limit and let you move your licence between machines. No model content, file paths, or cleartext machine identifiers are included in this request.

2.3 Anonymous usage analytics

We collect anonymous, aggregated events to understand product usage. These events include:

  • Feature invocations (e.g. "Trace started"): no inputs or outputs are captured
  • Add-in version and operating system type
  • Session start and end timestamps
  • Generic error codes (not stack traces)

These events do not include cell values, formula text, file names, or any model-derived content. You can disable analytics in Add-in Settings → Privacy.

2.4 Website analytics and download counts

Page views on the Formula Audit XL website are measured with Cloudflare Web Analytics, which uses no cookies, sets no cross-site identifier and does not fingerprint your browser or device. It reports aggregate figures only — page, referring site, country, browser family — and cannot follow you between sessions or across other sites.

We separately count how many times the add-in is downloaded, on our own servers. For each download we record the file name, a salted one-way hash of your IP address (never the IP address itself — the hash cannot be reversed and is only used to avoid counting one download several times), the country, the host name of the site that referred you (never the full URL) and the browser user-agent string. These records are kept for 13 months and are used solely to count installations. They are not linked to your licence or your email address.

2.5 Cookies and browser storage

The website uses one cookie and one item of local storage:

  • theme: stores your light/dark preference (localStorage, not a cookie, never transmitted to our servers)
  • fa_session: set only if you sign in to the member area at /account. It keeps you signed in and holds nothing but an opaque random token. HttpOnly, Secure, SameSite=Lax, expires after 30 days or when you sign out.

Our analytics use no cookies at all. We do not use advertising cookies or cross-site tracking.

3. How we use the data

  • To activate and validate your licence
  • To process payments and send receipts and renewal reminders
  • To respond to support requests you send us
  • To improve the product, based on aggregated, anonymous usage data
  • To understand website traffic and improve content

We do not sell, rent, or share personal data with third parties for marketing purposes.

4. Third-party processors

  • Stripe: payment processing. Stripe's privacy policy: stripe.com/privacy
  • Resend: delivery of transactional email (your licence key, receipts). Resend's privacy policy: resend.com/legal/privacy-policy
  • Cloudflare: the website and the licensing API are hosted on Cloudflare Pages; licence/subscription records and download counts are stored in Cloudflare D1; page views are measured with Cloudflare Web Analytics. Access logs may be retained for a limited period for security purposes. Cloudflare's privacy policy: cloudflare.com/privacypolicy

5. Data retention

We retain your account data for as long as your subscription is active plus a reasonable period thereafter (up to 12 months) for accounting and dispute purposes. You may request deletion of your account data by emailing [email protected]. Anonymous usage analytics are retained in aggregate and cannot be attributed to you once collected. Download records (see §2.4) are deleted automatically after 13 months.

6. Your rights

Depending on your jurisdiction, you may have rights to access, correct, or delete personal data we hold about you, and to object to or restrict certain processing. To exercise these rights, contact us at [email protected].

7. Security

We use HTTPS/TLS for all data in transit. Our licensing infrastructure is accessed only over authenticated, encrypted connections. See the Security page for a full description of our data-handling architecture.

8. Changes to this policy

We will post any material changes to this policy on this page and update the "Last updated" date above. We will notify active subscribers by email for changes that materially affect how their data is processed.

9. Data controller & contact

The data controller is:

Scalarly Srl
Via Borghetto 3, 20122 Milan, Italy
VAT (P.IVA): IT08592260965
PEC: [email protected]

For privacy questions or data requests, contact us at [email protected].