Privacy Policy

1. Who We Are

Python & VBA is operated by Bosau Digital LLC, a limited liability company registered in New Mexico, United States. Bosau Digital LLC is the data controller responsible for the personal data described in this policy. For any privacy-related questions, please contact us at contact@pythonandvba.com.

2. What Data We Collect

Analytics

We measure how our website is used with a small analytics system that we run ourselves. It is not a third-party service, and it works without cookies. When you open a page on pythonandvba.com, your browser sends a short message to our own server (api.pythonandvba.com). It records:

• The address of the page you viewed, without anything after a question mark (so search terms and tokens in a link are discarded), and how long the page was open and visible
• The website that referred you, and campaign (UTM) parameters if the link you followed carried them
• Your country, worked out from your IP address using a database stored on our own server
• Your browser, operating system, and device type (desktop, mobile, or tablet)
• Clicks on buy, download, store, and external links, so we can see which pages lead people to our products

To count a visitor only once a day, we calculate an anonymous identifier from your IP address and your browser's user agent, combined with a random value that we generate fresh every day and delete within two days. Once that value is gone, the identifier cannot be recalculated, so we cannot recognise you on another day or link your visits across days. Your IP address is used only for that calculation, for the country lookup, and for a short-lived counter that blocks abuse; it is not saved in the analytics records.

The analytics use no cookies, local storage, or similar technologies on your device, and no third-party scripts. The data stays on our own server and is not shared with anyone or sold. We keep the individual records for up to 13 months.

Links in our YouTube video descriptions may go through yt.pythonandvba.com. That address only redirects you to our website and adds campaign parameters that name the video, so we can see which videos send visitors. It sets no cookies and stores nothing on your device.

If you start a checkout on the same day as a visit, we link that checkout to the source of your visit (for example, which website referred you, and which page you landed on). We do this by calculating the same anonymous identifier from the request to our checkout. We use it to understand which pages and sources lead to purchases, and that source information is kept with your checkout record. After a purchase, the thank-you page may ask an optional question, "How did you find us?". If you answer, we store only your answer (for example, YouTube or Google) with your checkout record, to understand how buyers find us. You can skip it. No consent banner is needed for this analytics, because it does not store anything on your device.

Contact Form and Support Messages

When you contact us through a form on our website, send a support message or feedback note from inside one of our apps, or ask for a refund, we receive your name, your email address, your message, and any files you attach. Messages sent from inside an app also include the technical details described in that app's privacy policy. We use this to answer you, and we may look up your purchases and licenses to help with your request. Contacting us does not sign you up for our newsletter.

To handle your message, we use these service providers:

• Reoon checks that your email address can receive email, so our reply reaches you
• Postmark delivers your message to us, and our confirmation and replies to you
• Todoist holds a task for your message on our to-do list
• Pabbly Connect, our automation service, also passes on messages sent through the contact form on our website

If you are already in our self-hosted CRM (FluentCRM, see Newsletter and Free Downloads below), we add a tag to your contact record that you have contacted support. Files you attach are deleted from our server within 30 days. We keep your messages as support history for up to 24 months after your last message, so we can follow up on repeat issues, and then delete them. You can ask us to delete them sooner.

Newsletter and Free Downloads

You can join our email list with the signup form at the bottom of our website. Some free downloads, such as the Excel dataset generator and the XLSnake game, are given in exchange for joining the email list: we send the download to the email address you enter and add that address to our list.

We store your email address, your first name if you give it, where you signed up, and when. The list is kept in FluentCRM, a CRM that runs on our own WordPress site rather than at a newsletter company. We may check with Reoon that your address can receive email. We use your address to send you the download and occasional emails about tutorials, free tools, and our products.

We do this on the basis of the consent you give by signing up. Every email has an unsubscribe link, and you can unsubscribe at any time. We keep your address on the list until you unsubscribe; after that, we keep only a note that you unsubscribed, so we do not email you again.

If you buy a product, we also add you to our customer list in the same CRM, so we can send you emails about your purchase, such as setup tips and product updates. You can unsubscribe from those at any time as well.

Purchase Data

When you purchase a product, your payment and billing information is processed by our payment processors. On our own checkout at buy.pythonandvba.com, payments are handled by Stripe or PayPal; some older purchase links still use Pabbly Subscription Billing. We receive your name, your email address, your billing country, and details of the product(s) purchased, so we can deliver your order, email your license key and receipt (sent via Postmark), and manage your license. We do not store your full payment card details.

On our own checkout, your IP address is used to preselect your billing country and, together with the billing country you enter and the country of your payment method, as evidence of your location for sales tax (VAT) purposes. The country is looked up in a database stored on our own server, so your IP address is not sent to a third party for this lookup, and your order keeps only a shortened network prefix of it, never the full address. IP Geolocation by DB-IP, licensed under CC BY 4.0.

If you enter your email address at checkout and press pay but do not finish paying, we may send you one reminder email about that order. We do not send it if you completed the purchase, including under a different email address in the same browser, and the email has a link to stop such reminders. Before sending it, we check with Reoon that the address can receive email.

Please refer to the respective privacy policies of our payment processors:

• Pabbly Privacy Policy
• Stripe Privacy Policy
• PayPal Privacy Policy

Account Portal (account.pythonandvba.com)

In our account portal you can see your licenses, devices, invoices, and subscriptions, free up a device, cancel a subscription, and withdraw from a purchase. You sign in either with a 6-digit code sent to your email address (valid for 10 minutes) or, if you sign in with a license key, with a one-time link sent to the email address that license belongs to (valid for 30 minutes). Sign-in emails are sent via Postmark. No password is stored. Once you are signed in, a strictly necessary cookie, account_session, keeps you signed in for up to 7 days.

Learning Platform Accounts (learn.pythonandvba.com)

When you sign in to our learning platform, we collect your email address and, for course buyers, the name provided at checkout. Sign-in uses a one-time code sent to your email; a strictly functional session cookie keeps you signed in. No password is stored.

For enrolled students we store:

• Course progress: which lessons you have completed and opened, and your overall progress. Records of opened lessons are also used to determine refund eligibility under our Refund Policy.
• Certificates: the name you choose to print on a certificate of completion. Certificates can be verified through a public certificate link that shows the holder name, course title, and issue date.
• Community content: questions and replies you post in the course Q&A, and any ratings or reviews you submit. Reviews appear publicly only if you explicitly opt in, and you can withdraw that consent at any time by editing your review.

Course videos are streamed via Bunny.net, our video delivery network, which processes your IP address to deliver the video stream. Transactional emails (sign-in codes, purchase access links, Q&A notifications) are sent via Postmark. Course buyers are added to our customer list in our self-hosted CRM so we can send purchase-related updates; you can unsubscribe from non-essential emails at any time. If a course purchase is refunded, we keep the email address on a list that blocks it from signing in to the learning platform, as described in our Refund Policy.

License Activation Data

Our paid software uses a license activation system. When you activate or use a licensed product, it sends your license key, a device identifier, and the product version to our license server (api.pythonandvba.com). The device identifier depends on the product:

• Desktop apps send your computer's name, and some add a short code derived from the Windows installation.
• Most Excel add-ins send a random install identifier created when the add-in is installed. It contains no name or hardware information, but because it is stored with your license key, it is pseudonymous rather than anonymous.
• XLlama sends an identifier calculated from your computer name and Windows user name; see its privacy policy.

For each license, we store the list of devices it is used on (the device identifier, when it was first seen and last used, and the product version) for as long as the license exists. This lets us enforce the device limit of your license, and lets you see and free up your devices in the account portal.

Server Logs and License Records

Like any web server, our server (api.pythonandvba.com) receives your IP address with every request, for example license checks, form submissions, requests from our free online tools, and messages from our apps. It records the IP address, an approximate country worked out from it, and details of the request in technical logs, so we can keep the service secure, stop abuse, and find faults. Routine log entries are deleted after 14 days; warnings and errors after 90 days.

When a license check fails (for example, because a key is unknown or blocked, or a license has reached its device limit), we record the license key, IP address, country, device identifier, and browser or app version, so we can spot keys that have been leaked or shared. These records are deleted after 90 days.

Error Reporting

Some of our products automatically send anonymous error reports to our server when an unexpected issue occurs. These reports help us identify and fix bugs. They do not intentionally include personally identifiable information, but may contain technical details such as your Excel version, operating system, and the nature of the error.

Free Online Tools

Our free online tools on pythonandvba.com work in one of two ways:

• In your browser. Some tools process what you enter or upload on your own device, and it is not sent to us. These include the chart and dashboard makers, Compare Two Lists, the VCF to Excel and Excel to JSON converters, and the emoji to HTML converter.
• On our server. Other tools send your input over an encrypted connection to our server (api.pythonandvba.com), which does the work and sends back the result. These include the bulk phone number validator, the SMS spam checker, the Office to Markdown converter, the form builders, and the dataset generator.

A few tools use a third-party service for part of the work:

• Carrier Lookup sends the phone numbers you check, through our server, to Twilio's lookup service.
• Address to Coordinates and What County Am I In send United States addresses straight from your browser to the US Census Bureau's free geocoding service, without passing through our server. Address to Coordinates sends addresses outside the United States, and the online Address Formatter sends every address, through our server to the Google Maps Platform.
• SMS Template Generator sends the message idea you type, through our server, to Groq, an AI provider whose model writes the drafts.
• Free PDF to Excel Table Extractor sends the PDF you upload, through our server, to Modal, a cloud computing provider that runs the table extraction.
• Image Link Converter runs in your browser, but to show previews it loads thumbnails of your images directly from Google Drive or Dropbox, which receive that request from your browser.

We do not keep what you enter or upload: uploaded files are deleted once your result has been returned, and if a request fails, we record only the type of error, never your input. To apply the daily free limits and to count how the tools are used, we store your IP address only as a one-way hash made with a secret key on our server, which cannot be turned back into the address. These usage statistics (which tool, when, whether it worked, and the type of file, not its name) are kept for up to 400 days. Carrier Lookup also keeps the answer for a number for up to 30 days, filed under a keyed one-way hash of the number rather than the number itself, so a repeat lookup does not cost another credit. The dataset generator is also a free download; see Newsletter and Free Downloads above.

XLSnake Leaderboard

XLSnake, our snake game for Excel, has an optional global leaderboard. If you choose to submit a score, the game sends the username you choose and your score to Pabbly Connect, which adds them to a Google Sheet that is published publicly. The Hall of Fame on our website reads that sheet, so anyone can see your username and score. Pick a username that does not identify you if you prefer. To have an entry removed, contact us.

Embedded Videos

Videos on our website and in our courses are hosted by Bunny.net. When a video player loads, your browser connects to Bunny's servers, which receive your IP address to deliver the video and to measure playback performance. The player sets no cookies; it remembers your video quality setting in its own browser storage.

Some pages show YouTube videos. The YouTube player loads only when you click play, from youtube-nocookie.com. From then on, YouTube (Google) receives your IP address and may store data in your browser, under Google's Privacy Policy.

Excel Add-ins

Our Excel add-ins run inside Excel. What each add-in sends, and to whom, depends on what it does.

Add-ins that keep your worksheet data local. The Address Formatter, Distance Calculator, Distance Matrix, Route Planner, Deltaline, SimpleGantt, Table Compare, DatePop, Audit Tickmarks, CutePlots, and XLlama add-ins never send your worksheet content to us:

• Map and address add-ins (Address Formatter, Distance Calculator, Distance Matrix, and Route Planner): when you run them, the addresses or coordinates from the cells you select are sent from your device directly to the Google Maps Platform to be geocoded or measured. These calls use your own Google Maps API key and go straight to Google, never through our servers, so we do not receive or store your addresses. Google's handling of that data is governed by the Google Privacy Policy.
• XLlama sends your prompt and any cell data you attach only to Ollama running locally on your own computer. Remote servers and cloud models are blocked, so your prompts and data stay on your machine.
• Deltaline and CutePlots draw charts from your data locally inside Excel. Their optional share links carry the chart's data inside the link itself, so anyone you give the link to can open the chart.
• SimpleGantt, Table Compare, DatePop, and Audit Tickmarks work on your data locally inside Excel.

AI add-ins. AI Fuzzy Match and AI Categorizer need an AI model to do their work. When you run them, the text of the cells you select, together with the reference list or categories and any extra rule you type, is sent to our AI service, which is hosted by Cloudflare, Inc., and from there to TypeSafe AI, Inc., whose AI model produces the answer. We do not store that text; it is held in memory only while your request is answered. TypeSafe processes it under its own terms. Each add-in's privacy policy explains what is sent, what TypeSafe and Cloudflare keep, and how free credits are counted.

LabelPop. LabelPop builds your labels and PDFs on your own device, and Excel on the web uploads nothing. Outside Excel on the web (for example on Excel for Windows and Mac), to open the PDF in your browser, the add-in encrypts the print job on your device and sends only that encrypted copy to our server. We keep it for at most 10 minutes and delete it the first time your browser opens it. The key never reaches us, because it travels in the part of the web address after the # sign, which browsers do not send to a server, so we cannot read your addresses. The LabelPop privacy policy has the details.

To activate a paid add-in, it sends its license key, an install identifier, and the add-in version to our license server (see License Activation Data above). Apart from the AI add-ins and the encrypted LabelPop print job described above, no worksheet content, addresses, prompts, or API keys are sent to us. Your settings, license key, and any API key you enter are stored only on your own device (in Office's per-user storage), inside your workbook, or in a local cache on your device. The add-ins do not use analytics or automatic error reporting.

QuickText SMS

QuickText SMS is a Windows application that sends text messages through your own Android phone using the third-party app KDE Connect. The contacts you import, your message templates, and your sending history are stored only on your own computer and are never transmitted to us or to any third party. Your messages are sent directly through your own phone and do not pass through our servers. Uninstalling the app leaves this data on your computer; deleting the app's data folder removes it. As with our other software, license activation transmits your license key, a device identifier (your computer's name), and the app version.

The app also sends a daily usage ping, which you can switch off in Settings > Advanced. It carries a random install identifier, the app version, whether you use the free or paid plan, and running totals (such as how many messages you have sent), never your contacts or message content. From version 1.6.1, the app also reports once each which setup steps you have completed, and whether a rating card was shown and answered. If you send a feedback note or use the in-app support form, we receive what you write, along with basic technical information about your setup (never your contacts, message text, or phone numbers) to help us diagnose the issue. Its privacy policy has the details.

TextBay

TextBay is a Windows application that sends SMS, MMS, and WhatsApp campaigns through your own Twilio account. Your contacts and lists, your saved messages, your block list, and your sending history (including the text of what you sent) are stored only in a folder on your own computer and are never uploaded to us. Messages travel directly between your computer and Twilio's API under your own Twilio account, so they never pass through our servers; that leg is governed by Twilio's own privacy policy, and the replies shown in the app's inbox are fetched from Twilio rather than written to disk. Your Twilio Auth Token is stored encrypted for your Windows account. Uninstalling the app leaves your data on your computer; the app's Start fresh option, or deleting the folder, removes it. License activation transmits your license key, a device identifier (your computer's name), and the app version. Apart from that and any support message you choose to send, nothing reaches us: TextBay has no telemetry, no usage statistics, and no automatic error reporting.

Product Privacy Policies

Several of our products have their own privacy policy, which describes that product's data handling in more detail and applies in addition to this policy: Address Formatter, AI Categorizer, AI Fuzzy Match, Audit Tickmarks, Bounce Duel (Windows and Android), Bulk Phone Validator, CutePlots, DatePop, Deltaline, Distance Calculator, Distance Matrix Calculator, LabelPop, Office2MD, PDF2Excel, QuickText SMS, Route Planner, SendCommander, Sheet2JSON, SimpleGantt, Table Compare, TextBay, TextBay Inbox, and XLlama.

3. How We Use Your Data

• To deliver products you have purchased and send download links, license keys, or course access
• To operate your learning account: track course progress, issue certificates, and display your Q&A posts and reviews
• To determine refund eligibility for online courses, and to block sign-in to the learning platform after a course refund
• To send transactional emails such as sign-in codes and purchase confirmations, and a reminder about a checkout you did not finish
• To respond to your support and contact enquiries, including questions you ask before buying
• To activate and manage software licenses, and to show your licenses, devices, and invoices in the account portal
• To run our free online tools and apply their daily free limits
• To send our newsletter and free downloads, if you have signed up
• To publish the username and score you choose to submit to the XLSnake leaderboard
• To keep our services secure, prevent abuse, and detect leaked or shared license keys, using server logs and records of failed license checks
• To improve our products using anonymous error reports and, where an app sends one, an optional usage ping
• To understand how our website is used and which pages and sources lead to purchases, using our own cookieless analytics

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases:

• Contract performance and steps before a contract: Processing your purchase, delivering your product, license activation and device limits, the account portal and learning platform, and answering questions you ask before you buy
• Consent: Our newsletter and the free downloads you get by joining our email list, and leaderboard entries you choose to submit. You can withdraw your consent at any time, for example with the unsubscribe link in every email
• Legitimate interests: Answering your enquiries and support messages, keeping our services secure and preventing abuse (server logs, failed license checks, free-tool limits), checkout reminders, product emails to customers, anonymous error reporting, optional usage pings that you can switch off, and cookieless analytics to improve our website and products
• Legal obligation: Retaining transaction records as required by applicable law

5. Data Sharing

We do not sell your personal data. We share data only with these service providers, as needed for the purposes described in this policy:

• Stripe and PayPal to process payments on our checkout
• Pabbly: Pabbly Subscription Billing for purchases made through older purchase links, and Pabbly Connect to pass on website contact form messages and XLSnake leaderboard entries
• Postmark to deliver emails such as sign-in codes and links, license keys, receipts, and support messages
• Reoon to check that an email address can receive email
• Todoist to keep a task list of support messages
• Bunny.net to host and stream videos on our website and learning platform
• Cloudflare to protect and deliver our website, and to host the service behind our AI add-ins
• TypeSafe AI to provide the AI model for AI Fuzzy Match and AI Categorizer
• Twilio to look up phone numbers in Carrier Lookup
• Google: the Google Maps Platform for address lookups our free tools make through our server, and Google Sheets for the XLSnake leaderboard
• Groq to generate drafts in the SMS Template Generator
• Modal to run the Free PDF to Excel Table Extractor
• Hosting providers that run our websites, learning platform, server, and self-hosted services

These providers process data only as needed to provide their service to us. No other third parties receive your personal data from us. Our website analytics and our CRM are not in this list because we run them ourselves, on our own servers.

Separately from the service providers listed above, some of our software and tools connect directly from your device to a third-party service: for example, the Google Maps Platform for our map add-ins (using your own API key), the US Census Bureau for our county and coordinates lookups, Google Drive or Dropbox for image previews, and YouTube when you play a YouTube video. That data goes straight from your device to that provider, not through us, and is governed by that provider's own privacy policy.

We are based in the United States, so personal data described in this policy is processed in the United States and/or in the countries where our service providers operate. Where personal data of EEA or UK residents is transferred internationally, our service providers rely on appropriate safeguards such as the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses.

6. Cookies

Our website does not use advertising cookies or cookies that track you across other websites. Our own website analytics (see Analytics in section 2) use no cookies or other storage on your device and do not require a consent banner.

WordPress, the platform powering this website, may set strictly functional cookies for session management (for example, if you are logged in as a registered user). These are necessary for the website to function and do not track you across other websites.

Cloudflare, which protects our website from attacks, may set a strictly necessary cookie (__cf_bm, kept for 30 minutes) to tell real visitors from bots.

learn.pythonandvba.com sets a strictly functional session cookie when you sign in. It only keeps you signed in and does not track you across other websites; no consent banner is required for it.

account.pythonandvba.com sets a strictly necessary cookie, account_session, when you sign in to the account portal. It only keeps you signed in, for up to 7 days.

Our checkout at buy.pythonandvba.com sets two strictly necessary cookies. pv_b holds a random identifier for your browser (no name, email or other personal data) and is kept for one year; we use it only to recognise that a checkout started in this browser was completed, even under a different email address, so we do not send you a reminder about an order you already placed. pv_ty lets your browser open the thank-you page of your own order and show your license key there. During checkout, the page also keeps a random identifier in your browser's session storage (pv_funnel), which is deleted when you close the tab, so we can count how many checkouts reach each step. None of these track you across other websites, and no consent banner is required for them.

When the payment form on our checkout loads, Stripe sets cookies to prevent fraud: __stripe_mid (one year) and __stripe_sid (30 minutes) on buy.pythonandvba.com, and a cookie on m.stripe.com. If Google Pay or Apple Pay is available in your browser, Google and Apple may set their own cookies when the wallet buttons load, and hCaptcha, which Stripe uses to detect bots, may set its own as well. These are needed to take payments securely and are governed by those providers' privacy policies. If you pay with PayPal or through an older Pabbly purchase link, PayPal and Pabbly may set their own cookies on their own pages.

Our video player from Bunny.net sets no cookies; it stores your video quality setting in its own browser storage. YouTube videos load only when you click play, and YouTube may then store data in your browser (see Embedded Videos in section 2).

Because we do not track you across other websites and do not sell or share your personal data, there is no cross-site tracking to opt out of. We therefore do not need to change our behaviour in response to browser "Do Not Track" or Global Privacy Control signals.

7. Data Retention

• Purchase and license records: Retained for as long as necessary to support your license and comply with legal obligations. The list of devices for a license is kept for as long as the license exists
• Failed license checks: Deleted after 90 days
• Server logs: Routine entries are deleted after 14 days; warnings and errors after 90 days
• Learning platform data: Progress, Q&A posts, reviews, and certificates are retained while your enrollment is active so your access and records keep working; you can request deletion at any time. After a course refund, the email address stays on the sign-in block list
• Contact, support, and feedback messages: Kept as support history for up to 24 months after your last message, then deleted. Attached files are deleted from our server within 30 days
• Newsletter: Your address stays on our email list until you unsubscribe
• Free online tools: What you enter or upload is not kept. Usage statistics with hashed IP addresses are deleted after 400 days, and Carrier Lookup answers after 30 days
• XLSnake leaderboard: Entries stay in the public sheet until you ask us to remove them
• Analytics data: Individual page view and click records are deleted after 13 months; the daily random value used to build the anonymous identifier is deleted within two days
• Error reports: Retained for a reasonable period to diagnose and resolve issues

8. Your Rights

If you are in the EEA or UK

Under the GDPR and UK GDPR, you have the following rights:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Request that we limit how we use your data
• Portability: Request your data in a machine-readable format
• Objection: Object to processing based on our legitimate interests
• Withdraw consent: Where we rely on your consent, withdraw it at any time, without affecting processing already carried out

Right to complain: You also have the right to lodge a complaint with your local data protection supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk); in the EEA you can find your national authority through the European Data Protection Board (edpb.europa.eu). We would welcome the chance to resolve your concern first, so please consider contacting us before you do.

If you are in California

To the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to us, California residents have the right to know what personal information we collect and how we use it, to request access to or deletion of that information, to request correction of inaccurate information, and to not be treated differently for exercising these rights. We do not sell or share your personal information, and we do not use or disclose sensitive personal information, as those terms are defined under California law, in ways that would require an opt-out.

How to exercise your rights

To exercise any of the rights above, please contact us at contact@pythonandvba.com. We will respond within 30 days, or as otherwise permitted by law. We may need to verify your identity before we act on your request, and you may use an authorised agent where the law allows.

Automated decision-making

We do not use your personal data for automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

9. Data Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. License activation and error reporting data is transmitted over encrypted connections. However, no method of transmission or storage is completely secure, so while we work to protect your personal data, we cannot guarantee its absolute security.

10. Children's Privacy

Our website and products are not directed at children under the age of 16. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we change the "Last updated" date at the top of this page. If we make a material change, we will also let our customers know by email or in our apps.

12. Contact

For any privacy-related questions or to exercise your rights, please contact: