Doc Regia

Google Workspace™ Add-on

Privacy Policy

Version 1.7 | Last updated: June 2026

⚠ Google API Services User Data Policy — Limited Use Disclosure

Doc Regia’s use and transfer of information received from Google APIs to any other application will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Doc Regia uses Google user data exclusively to provide and improve the features described in this policy. Data is never sold, used for advertising, or shared with third parties except as described herein.

1. Data Controller

The Data Controller for the processing of personal data in connection with the Doc Regia add-on is:

Company: FIDES FABER MOTUS S.R.L.
VAT code: C.F. 14585740963
Privacy contact: privacy@regiasuite.com

2. Scope of Application

This Privacy Policy applies exclusively to the Doc Regia add-on, which operates within the Google Workspace ecosystem (Google Sheets, Google Forms, Google Drive, Google Docs, Gmail) via Google Apps Script and Google APIs. It governs the processing of data that occurs when a user installs and uses the add-on within their Google or Google Workspace account.

Doc Regia is available in a free tier that provides core document management and generation features at no cost, and in paid PRO plans that unlock advanced features such as automated email notifications, PDF delivery, unlimited document returns, and additional automation capabilities. A full comparison of features available on each plan is published at www.regiasuite.com/pricing. All OAuth permissions described in this policy are requested at installation for all users; features that require a paid plan are enforced within the add-on and do not affect the authorisations granted.

This policy does not apply to external websites, third-party services, or any platform other than Doc Regia.

3. Data Processed

Doc Regia processes only the data strictly necessary to deliver the functionalities described in this policy. No data is stored on external servers operated by the add-on provider.

A) Google account data

The authenticated user’s Google email address — used for authorisation, permissions, and audit logging.

B) Google Workspace file data

Data and project configurations stored in the Google Sheet of the Doc Regia environment (project names, settings, folder IDs, form IDs, URLs, notification preferences).
Structure and questions of Google Forms linked to projects.
Form responses, including any personal data entered by respondents (e.g., name, surname, email address, and any other data collected by the form questions). This data is read exclusively at the time of document generation or other actions expressly requested by the user.
Generated documents (Google Docs and/or PDFs), including content derived from templates and form responses.
File and folder metadata (IDs, names, URLs) necessary to create, copy, organise, move, and share files and folders within Google Drive.

C) Licence and activation data

The licence key and Google account email address entered by the user in the Doc Regia activation panel, transmitted to regiasuite.com solely for licence validation.

D) Technical configuration data and logs

Project configuration settings (e.g., notification email addresses, email templates, feature toggles, automation state).
Technical execution logs written to a dedicated sheet: timestamp, log level, function name, message, context, user identifier, spreadsheet ID. These logs are used solely for diagnostics, error prevention, and operational stability.
Technical state data (checkpoints, flags) saved in Google Apps Script User/Script Properties to ensure robust execution and recovery after interruptions.

E) Handwritten signature data (optional feature)

When the user voluntarily uses the handwritten signature feature within the document return panel, the signature is drawn locally in the user’s browser as a graphic stroke pattern (vector points). The signature is processed exclusively to insert it as an image into the target Google Doc(s) selected by the user.
Temporary storage on Google Drive: at the moment of insertion, the signature image (PNG) is uploaded to the user’s own Google Drive for a few seconds — the time strictly necessary for the Google Docs API to fetch the image and embed it into the target document. The temporary file is then automatically deleted from Google Drive. The embedded image becomes part of the document and remains under the user’s full control.
Local persistence in the browser: to allow the user to sign multiple documents during the same work session without redrawing, the signature stroke pattern is stored in the user’s browser localStorage for a maximum of 8 hours. This data never leaves the user’s device and is automatically cleared after expiration, by pressing the “Clear” button in the signature panel, or by clearing the browser’s site data. No copy of the signature is retained by the add-on provider on any server.

F) Sign Regia — document signature management

Sign Regia is Doc Regia’s internal system for managing signatures on documents: it allows the user to send a recipient a request to sign a document and to receive the signed document back. The request is sent through a personal, protected link, valid only once and with an expiry date: the recipient signs directly from a phone or computer, with nothing to install.

The entire process is designed to be secure and confidential. Data travels over encrypted channels and the signature image is held on a private infrastructure, accessible exclusively by Doc Regia’s systems through protected credentials: no access key or credential is ever exposed or visible on the signing page, and the temporary storage is not reachable by third parties. The signature is automatically deleted the moment it is applied to the document, without being retained; any residual data is in any case automatically removed within a few days. The provider neither keeps nor has access to any copy of the signed document, which remains under the control of the requesting user and is delivered to the recipient by e-mail.

Important: Doc Regia does not build or maintain any external archive of form responses. Response data is never copied to servers outside the user’s Google account. All data remains within the user’s own Google Workspace environment.

4. Purposes of Processing

Data is processed exclusively to provide the features requested by the user:

Project creation and management (folders, Google Forms, document templates, generated documents).
Automatic and manual document generation (Google Docs and/or PDF) from form responses.
Automation management: processing new responses, handling form lifecycle events (open/close), PAUSE/AUTO state control.
Email delivery via the user’s own Gmail account:
- Internal notifications to the project administrator or coordinator (if configured).
- Confirmation or document delivery emails to the form respondent (only if an email address is collected by the form and the feature is explicitly activated by the user).
File and folder sharing within Google Drive with email addresses specified by the user, with viewer or editor permissions as chosen.
Security, error prevention, and diagnostics through technical logs and integrity checks.

5. Legal Basis for Processing

The processing of personal data by Doc Regia is based on the following legal grounds under Regulation (EU) 2016/679 (GDPR):

Execution of a contract / provision of a requested service (Art. 6(1)(b) GDPR): data processing is necessary to deliver the functionalities of the add-on as configured and requested by the user.
Legitimate interest (Art. 6(1)(f) GDPR): technical logs and security checks necessary to ensure operational stability and prevent errors.

Doc Regia does not independently collect data entered in Google Forms and does not store response content on any infrastructure outside the user’s Google services. Responses are read only at the moment of processing to generate documents and perform the actions requested. No external copies are created. Ownership of documents remains with the user.

6. Data Location and Storage

Doc Regia operates entirely within Google’s infrastructure. All files created or managed by the add-on (Sheets, Forms, Docs, PDFs, Drive folders) remain in the user’s or organisation’s Google Drive, except where the user explicitly configures sharing with third parties.

Doc Regia does not transfer the content of form responses or generated documents to any external infrastructure operated by the add-on provider. The only data stored outside Google’s infrastructure is:

Apps Script User/Script Properties: small key-value entries (technical state, configuration flags, locale preference) stored within the Google Apps Script environment associated with the user’s project. These entries do not contain form response content or personal data beyond what is strictly necessary for the operation of the add-on.

International data transfers

Doc Regia operates exclusively through Google Workspace services and APIs provided by Google LLC (USA). Data processed through these services may be transferred to and stored on servers outside the European Economic Area. Such transfers are governed by the Standard Contractual Clauses adopted by Google LLC under the Google Workspace Data Processing Addendum, in accordance with Art. 46(2)(c) GDPR.

7. Data Sharing and Recipients

Doc Regia shares data only in the following strictly limited cases:

Email delivery: via the user’s own Gmail account (GmailApp) to recipients specified by the user — internal notifications and, where activated, respondent notifications.
File/folder sharing: with email addresses entered by the user in the add-on configuration, with viewer or editor permissions as chosen.
Technical provider — Google LLC: all operations rely on Google Workspace services and Google APIs (Drive, Sheets, Forms, Docs, Gmail, Apps Script). Google acts as a data processor under the Google Workspace Data Processing Addendum.
Payment processor — Paddle.com Market Ltd: payment processing for purchases made on regiasuite.com is handled by Paddle.com Market Ltd, acting as Merchant of Record. Paddle independently collects and processes buyer payment data under its own Privacy Policy. See Section 8 for details.
Regia Suite (regiasuite.com): the licence key and user email are transmitted to regiasuite.com exclusively for licence validation. No other user data is shared.

Doc Regia does not sell personal data. It does not share data with third parties for commercial, advertising, or profiling purposes. It does not use data to serve advertising of any kind.

8. Payments, Licences, and regiasuite.com

Free tier and PRO plans

Doc Regia operates on a freemium model. The free tier provides access to core features — including project creation, form linking, and basic document generation — without any payment or account registration on regiasuite.com. Advanced features (such as automated email notifications, PDF delivery to respondents, unlimited document returns, and extended automation) are available exclusively on paid PRO plans. Details and a full feature comparison are available at www.regiasuite.com/pricing.

Purchase and payment processing

Paid plans for Doc Regia are purchased exclusively through the website www.regiasuite.com, which uses WooCommerce as its e-commerce platform.

Payment processing is handled by Paddle.com Market Ltd, acting as Merchant of Record. As Merchant of Record, Paddle is the legal reseller of Doc Regia PRO plans and assumes full responsibility for the transaction, including billing, invoicing, tax compliance, and payment data security. Payment data (card details, billing address, transaction data) is collected and processed exclusively by Paddle and is never stored on Regia Suite’s servers. Paddle processes this data under its own Privacy Policy.

Licence key delivery and activation

Upon successful purchase, a licence key is generated and delivered to the user via email and/or via the account on regiasuite.com. To activate the add-on, the user enters their licence key and Google account email address directly within the Doc Regia add-on interface inside Google Sheets.

The add-on contacts the server at regiasuite.com exclusively to verify the validity of the licence (key + email combination). This verification is performed via a secure HTTPS request. No form response data, document content, or other personal data is transmitted to regiasuite.com during this operation — only the licence key and email address provided by the user for activation purposes.

Data processed for licence management

The licence key and the Google account email address entered by the user in the activation panel are transmitted to regiasuite.com solely to verify licence validity. This data is stored on regiasuite.com servers exclusively for licence management purposes and is not used for any other purpose.

9. Permissions and OAuth Scopes

Doc Regia requests only the permissions strictly necessary to deliver its features. Here is a plain-language explanation of each:

Permission	Why we ask for it	What we do with your data
Drive (drive.file)	To create and organise your project folders and generated documents, and to read document templates that you explicitly select through the Google Picker.	We create and manage only the files and folders necessary for your projects. We access pre-existing files only when you explicitly select them via the Google Picker (e.g., to use them as templates), and only for the duration needed to copy their content.
Sheets (spreadsheets.currentonly)	To read your project configuration and detect new form responses to process.	We read and write only the spreadsheet you have opened with the add-on. We never access other spreadsheets.
Forms (forms)	To create forms for your projects and to open/close them automatically on schedule.	We create and manage only the forms linked to your Doc Regia projects. We never access unrelated forms.
Forms REST API (forms.body)	To add images to form questions and answer options.	We modify only the visual structure of your project forms. We never read or write response data through this permission.
Gmail (gmail.send)	To send notification emails and document delivery emails when you activate this feature.	We send only the emails you configure. We never read, search, or modify your inbox or any existing emails.
Triggers (script.scriptapp)	To run document generation automatically every hour without you having to open the add-on.	We create a single hourly trigger for your project. We never create triggers for other purposes.
External requests (script.external_request)	To call Google’s APIs and to verify your licence on regiasuite.com.	All calls go exclusively to Google’s APIs and regiasuite.com. No data is sent to any other external server.
Interface (script.container.ui)	To display the add-on sidebar, menus, and dialogs inside Google Sheets.	Used only to show the add-on interface. No data is collected through this permission.
Account email (userinfo.email)	To identify you for authorisation and to send you re-authorisation reminders if needed.	Your email is never stored externally and never used for marketing.
Profile name (userinfo.profile)	To pre-fill your name as the default sender signature in the document return email editor.	Your display name is used only at the moment the panel opens. It is never stored or transmitted externally.

10. Compliance with Google API Services User Data Policy

Doc Regia is fully committed to complying with the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

Google user data is used only to provide or improve user-facing features described in this policy.
Google user data is not transferred to third parties except as necessary to provide the requested service, for security purposes, or to comply with applicable law.
Google user data is not used for serving advertising.
Google user data is not used for creditworthiness, lending, or similar purposes.
Human access to Google user data is limited to cases where it is necessary to provide the service, investigate a bug, or comply with applicable law.

11. Data Retention

Files, folders, forms, and generated documents remain in the user’s Google Drive until the user deletes them or the project is removed.
Project configurations and technical logs remain in the Google Sheet and Apps Script properties until the user deletes the relevant data or uninstalls the add-on.
Apps Script User Properties (technical state, locale) are deleted when the user revokes access to the add-on or the add-on is uninstalled.

12. Security

Doc Regia processes data exclusively through Google’s secure infrastructure and APIs. All communications use HTTPS/TLS. Access to data is governed by Google OAuth 2.0 and limited to the scopes listed in Section 9. No third-party analytics, tracking scripts, or external data storage services are used.

Technical logs (Section 3D) are designed to minimise personal data exposure: they record operational metadata necessary for diagnostics and do not store the full content of form responses.

13. Data Subject Rights

Within the limits applicable under GDPR and other applicable regulations, data subjects may exercise the following rights:

Right of access (Art. 15 GDPR): obtain confirmation of whether personal data is being processed and receive a copy.
Right to rectification (Art. 16 GDPR): request correction of inaccurate data.
Right to erasure (Art. 17 GDPR): request deletion of personal data.
Right to restriction of processing (Art. 18 GDPR).
Right to object (Art. 21 GDPR).
Right to data portability (Art. 20 GDPR).

To exercise these rights, contact the Data Controller at privacy@regiasuite.com.

Since the primary content (forms, responses, documents) resides in the user’s Google Drive, data subjects can also exercise many of these rights directly by modifying or deleting files and responses within their Google account.

Data subjects also have the right to lodge a complaint with the competent supervisory authority (in Italy: Garante per la protezione dei dati personali).

14. International Users and Applicable Law

Doc Regia is available to users worldwide. While this policy is primarily drafted in compliance with the EU General Data Protection Regulation (GDPR — Regulation (EU) 2016/679), which represents one of the most comprehensive data protection frameworks globally, the following additional rights and notices apply depending on your country of residence.

United Kingdom — UK GDPR

Users in the United Kingdom are protected by the UK GDPR and the Data Protection Act 2018. The rights described in Section 13 of this policy apply in full. The competent supervisory authority is the Information Commissioner’s Office (ICO).

United States — CCPA / CPRA (California)

California residents have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). The rights described in Section 13 apply in full. In addition, California residents have the right to opt out of the sale or sharing of personal information and the right to non-discrimination for exercising their privacy rights. Doc Regia does not sell or share personal information with third parties for commercial or advertising purposes.

To exercise these rights, contact us at privacy@regiasuite.com. We will respond within 45 days as required by California law. Users in other US states with enacted privacy laws (Virginia, Colorado, Texas, Connecticut, and others) may exercise equivalent rights under their respective state laws by contacting us at the same address.

Canada — PIPEDA

Canadian users are protected by the Personal Information Protection and Electronic Documents Act (PIPEDA). You have the right to access personal information we hold about you and to request corrections. Contact us at privacy@regiasuite.com to exercise these rights.

Brazil — LGPD

Users in Brazil are protected by the Lei Geral de Proteção de Dados (LGPD — Law No. 13,709/2018). The rights described in Section 13 apply. The competent supervisory authority is the Autoridade Nacional de Proteção de Dados (ANPD).

Australia — Privacy Act

Australian users are protected by the Privacy Act 1988 and the Australian Privacy Principles (APPs). You have the right to access and correct personal information we hold about you. Contact us at privacy@regiasuite.com. Complaints may be lodged with the Office of the Australian Information Commissioner (OAIC).

Note on data transfers: Doc Regia operates exclusively through Google’s infrastructure. All data processed by the add-on remains within the user’s own Google Workspace environment. The only data transmitted outside Google’s infrastructure is the licence key and email address sent to regiasuite.com for licence validation, as described in Section 8.

15. Changes to this Policy

This policy may be updated to reflect changes in the add-on’s features, applicable law, or Google’s requirements. The updated version will be published on the official website (www.regiasuite.com) with the date of the last update indicated at the top of the document. For significant changes, users will be notified within the add-on or via email where possible.

Trademark Notice

Google Forms™, Google Docs™, Google Drive™, Google Sheets™, Gmail™ and Google Workspace™ are trademarks of Google LLC. Doc Regia is not affiliated with or endorsed by Google LLC. Use of these names refers solely to the services with which Doc Regia is designed to operate.