Call Sheet Tools Privacy Policy

Effective date: October 19, 2026
Last updated: October 19, 2026

This Privacy Policy describes how Saliga.Studio (“we,” “us,” or “our”) collects, uses, and shares information when you visit andrewsaliga.com (the “Site”), buy our products, join our email list, contact us, or use Call Sheet Tools, the Google Sheets template and bound Apps Script sold through the Site.

This policy covers andrewsaliga.com and our products sold through it. Our other websites have their own policies. We’ve kept this direct: you deserve to know what we do with your information, so we say it plainly.

1. Who we are

Saliga.Studio
Operated by Andrew Saliga
Tulsa, Oklahoma, USA
Contact: support@saliga.studio

2. Information we collect

Information you give us.

Orders and accounts: name, email address, billing and shipping address, phone number (if you provide one), order history, and account login details.
Payments: handled by our third-party payment processors. We receive confirmation of payment and limited details (such as the last four digits of a card) but not your full card number.
Email list: your email address and any name you provide when you subscribe.
Messages and inquiries: anything you send through a contact form or by email, including details about a project or support issue.

Information collected automatically. When you use the Site, we and our service providers collect your IP address, browser and device type, operating system, pages viewed, referring page, approximate location (derived from IP address), and the date and time of your visit. This is collected using cookies and similar technologies (see Section 5).

Information from others. Our payment processors, shipping carriers, and advertising and analytics providers may give us information related to your order or your interaction with our ads.

3. How we use information

To process and deliver orders, issue and validate licenses, provide downloads, and offer support.
To send transactional messages (receipts, shipping updates, license and product notices).
To send newsletters and product news if you subscribed, and to honor your unsubscribe.
To understand how the Site is used, improve it, and measure and improve our advertising.
To prevent fraud and abuse, enforce our Terms of Service, and meet legal, tax, and accounting obligations.

We do not use your information for purposes unrelated to the above without telling you.

4. Legal bases (EEA and UK visitors)

If you are in the European Economic Area or the United Kingdom, we process your information to perform our contract with you (orders and licenses), for our legitimate interests (running and securing the Site, understanding how it’s used), to comply with legal obligations, and, where required, with your consent (for example, marketing emails and non-essential cookies). You can withdraw consent at any time.

5. Cookies, analytics, and advertising

Essential cookies. WordPress and WooCommerce use cookies to keep you logged in, remember your cart, and keep checkout working. The Site doesn’t work properly without them.

Google analytics and advertising. We use Google Analytics, Google Ads (including conversion tracking and, where enabled, remarketing), and related Google measurement tools. These use cookies and similar identifiers to measure traffic, understand which pages and ads lead to purchases, and show our ads to people who have visited the Site. Google and other third-party vendors may use cookies to serve ads based on your past visits to the Site. Data collected through these tools is processed by Google under its own privacy policy.

Your choices.

Manage Google ad personalization at adssettings.google.com.
Install the Google Analytics opt-out browser add-on.
Opt out of interest-based advertising from participating companies at optout.aboutads.info.
Block or delete cookies in your browser settings. Blocking essential cookies may break the cart and checkout.
Where we can detect it, we treat a Global Privacy Control signal from your browser as an opt-out of sharing for advertising.

The Call Sheet Tools script itself does not set cookies or use tracking technologies. The delivery-confirmation page sets no cookies and contains no analytics.

6. Email marketing

We use Kit to manage our email list and send newsletters and product updates. If you subscribe, Kit processes your email address (and name, if given) on our behalf, and may record whether you open or click our emails. Every marketing email includes an unsubscribe link. Buying a product does not by itself put you on the marketing list unless you opt in, but we will still send you transactional messages about your order or license. Kit’s privacy practices are described in Kit’s own privacy policy.

7. Who we share information with

We share information only as needed to run the Site and our business:

Service providers that act on our behalf: web hosting, WordPress/WooCommerce and related plugins (including license management), payment processors, shipping carriers and label providers, email delivery and Kit, and customer-support tools.
Google, for analytics, advertising measurement, and (for Call Sheet Tools) the services described in Section 8.
Legal and safety: when required by law, legal process, or to protect our rights, customers, or the Site.
Business transfers: if we sell or merge our business, information may transfer to the successor, subject to this policy.

We do not sell your personal information for money. Some advertising cookies described in Section 5 may count as “sharing” for cross-context behavioral advertising under certain state privacy laws; you can opt out using the choices in Section 5 or by emailing us.

8. Call Sheet Tools: applies to v2.0 and later

This section describes what the script does with data. Earlier versions (v1.5–1.6) behaved differently in some respects; earlier versions of this policy are available on request at support@saliga.studio.

8.1 What the script accesses on your Google account

When you first run a Call Sheet Tools menu item, Google asks you to grant permissions. You must accept all of them for the script to function. Here’s what each permission is for, in plain language:

Permission line on the consent screen	What it does in the script
See, edit, create, and delete all your Google Sheets spreadsheets	Reads and writes your call sheet, and creates and maintains exactly one other file: your Crew Library spreadsheet (created in your Drive the first time you save crew to it). v1.x used a narrower “current spreadsheet only” permission; the Crew Library feature requires this broader one because the library is a separate file. The script touches no spreadsheet other than the call sheet it’s bound to and the Crew Library it created.
See and download all your Google Drive files	Sounds broader than it is — used for one job: rendering the call sheet to PDF via Google’s Drive export endpoint. The endpoint requires a Drive scope; Google offers no narrower one for PDF export on a container-bound spreadsheet. The script never lists, opens, or downloads any other file in your Drive.
Connect to an external service	Calls our license server, weather APIs, geocoding APIs, the Google Maps proxy, and (when you enable it) the delivery-confirmation service. Specific endpoints are listed below.
Send email as you	Sends call sheets and calendar invites to your crew when you use Send Call Sheet to Crew. Emails come from your Gmail address, not ours. Uses the narrow script.send_mail scope — the script cannot read, search, or delete any email in your inbox.
Allow this application to run when you are not present	Runs the optional 6 AM weather refresh trigger you schedule, and the daily license re-validation trigger.
Display and run third-party web content in prompts and sidebars inside Google applications	Renders the modal dialogs (Project Setup, Add Crew, etc.) the script uses.
See your primary Google Account email address	Used as the recipient for the recap email, as the organizer field on calendar invites, and as the account your license binds to.

Google API Services User Data Policy. Call Sheet Tools’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the features you ask for inside your own spreadsheet, we do not transfer it to others except as described here, we do not use it for advertising, and no human reads it except as needed for security, to comply with law, or with your consent.

8.2 Your Crew Library and day rates

The Crew Library — including any day rates you enter — is a spreadsheet in your own Google Drive, owned by you. It is never transmitted to us or to any third party. Day rates are used only to build the hidden Crew Budget tab inside your project; they are never written to the printed call sheet, the exported PDF, or any email the script sends.

8.3 What reaches our servers

Two categories of Call Sheet Tools data reach our infrastructure, and only these:

License data. Your license key and the Google account email(s) it is bound to. We store the key, its account roster (the Google accounts authorized to run copies of the template), per-account activation and validation timestamps, and a count of bound accounts. Per-license caps limit people, not spreadsheets — make as many copies as you like. As of v2.0, your copy of the template authenticates with an opaque access token rather than transmitting the license key itself on every request.
Delivery-confirmation records (optional). When you send a call sheet with Request delivery confirmations checked (it’s on by default, and you can turn it off per send), we store no information about your crew at all. For each recipient we receive only an opaque reference and a random token — no name, no email address, no project title, no day label — plus a send timestamp and, if the recipient taps the confirmation link, a confirmation timestamp. The mapping from those tokens back to your crew’s names and emails is kept only in your own spreadsheet (a hidden tab in your Google account) and never reaches us; the Confirmation Status window joins the two locally so you see who confirmed. These records contain no personal data, no call times, no phone numbers, no rates, and no call sheet content, and the opaque records are automatically deleted 60 days after the send. Sending with the checkbox off transmits nothing — crew confirm by replying to your email instead.

We do not collect, transmit, or have access to:

The contents of your call sheet (project details, schedules, phone numbers)
Your Crew Library, including day rates
Your shoot locations or the addresses you geocode¹
Your weather forecasts
The body or attachments of the emails you send through Send Call Sheet to Crew
Your calendar invite content

¹ Addresses you geocode pass through our Maps proxy (see below) and appear in short-lived operational logs, but are not collected or stored beyond those logs.

8.4 Third-party services the script contacts

Service	What it sees	Why
Google Maps Platform (Geocoding, Places, Directions APIs) — routed through our proxy at andrewsaliga.com	Location addresses you enter	Convert addresses to coordinates, find nearest hospitals, calculate drive times
Open-Meteo (open-meteo.com)	Coordinates of your primary location and the shoot date	Generate weather forecasts
api.weather.gov (U.S. National Weather Service)	Coordinates of your primary location	Severe weather alerts (U.S. only)
Nominatim (nominatim.openstreetmap.org)	Location addresses (fallback only)	Geocoding fallback when Google APIs are unavailable
Overpass API (overpass-api.de)	Location coordinates (fallback only)	Hospital lookup fallback when Google Places is unavailable
andrewsaliga.com (our store and proxy)	Your license credential; opaque per-recipient references and tokens when delivery confirmations are enabled (no names, no emails)	License activation and validation; delivery-confirmation tracking

Each service has its own privacy policy. You should review the ones you care about:

Google Maps Platform Privacy
Open-Meteo Terms
National Weather Service Privacy
OpenStreetMap Foundation Privacy (covers Nominatim and Overpass)

8.5 Why we use a proxy for Google Maps

Google Maps API calls go through our server at andrewsaliga.com rather than directly from your script. This means our API credentials are held centrally instead of distributed in every buyer’s bound script. The proxy forwards your Maps query and returns the result. Your query (typically an address or coordinate pair) is logged by the proxy for rate limiting and abuse prevention. Logs are retained for 30 days and used only for operational purposes (debugging, quota management). They’re not used for marketing, sold to third parties, or correlated with other data.

8.6 What we store, and where

On our servers (andrewsaliga.com): your license key, the Google account email(s) on its roster, per-account activation and last-validation timestamps, a count of bound accounts, and the access tokens that v2 copies use to authenticate. When delivery confirmations are enabled: only the opaque per-send records described above (references, tokens, timestamps — no crew names or emails), for up to 60 days.

In your Google account (UserProperties): your license access token (v2) or key (v1.x), a display-masked copy of your key, validation timestamps and status, the file ID of your Crew Library, and a short list of your recent confirmation-tracked sends (so the Confirmation Status window knows what to ask about). Stored by Apps Script in your own Google account; we don’t have access to it.

In your Google Drive: your Crew Library spreadsheet, the hidden Crew Budget tab inside your projects, and — when you use delivery confirmations — a hidden tab in your call sheet that maps confirmation tokens back to crew names so the status window can show them. All yours, not ours.

Proxy logs (andrewsaliga.com): rolling 30-day logs of API calls for rate limiting and debugging. Each entry contains the query, timestamp, and a credential fingerprint (not the key itself). No personally identifiable information beyond what the user typed into the query field.

8.7 Email sent through the script

When you send call sheets to crew using Send Call Sheet to Crew, those emails are sent directly from your Gmail account through Google’s MailApp service. We do not see, log, or store the content of those emails — including each recipient’s personalized call time. Your crew’s names and email addresses never leave your Google account: even with Request delivery confirmations checked, we receive only opaque references and tokens, never the people behind them. The same applies to the recap email you receive in your own inbox after each send.

When a crew member taps a confirmation link, they reach a page hosted on our infrastructure that records the confirmation timestamp for that send. The link contains a random token — not their email address, and not their name — and works without any login. The page itself shows no personal information.

When you export a calendar invite using Export Calendar Invite, the resulting .ics file is generated from your sheet’s data and downloaded directly. It’s never transmitted to our servers.

8.8 Crew members

Because delivery-confirmation records on our servers contain no crew names or emails — only opaque tokens we cannot trace back to a person — we are unable to identify an individual crew member in those records. Crew members who want their information removed should contact the producer who sent them the call sheet; the crew name↔token mapping lives only in that producer’s own spreadsheet.

9. Retention

Orders and license records: kept for the lifetime of your purchase plus a reasonable period afterward for dispute resolution and tax/accounting purposes (typically 7 years for U.S. tax compliance).
Account information: kept while your account is open and as needed for the purposes above.
Email list: kept until you unsubscribe, after which we keep only what’s needed to honor your opt-out.
Messages and inquiries: kept as long as needed to respond and for a reasonable period afterward.
Call Sheet Tools delivery-confirmation records: auto-delete 60 days after the send. To have a send’s records removed sooner, email support@saliga.studio with the project name and send date.
Call Sheet Tools proxy logs: auto-purge after 30 days.
License removal: if you remove the license from your Google account using the License Status menu item, the local cache in your Google account is deleted immediately and the account’s access token is revoked on our server. The license record on our server remains.
Analytics and advertising data held by Google follows Google’s own retention settings.

10. Your rights and choices

You have the right to:

Access the personal information we hold about you (your orders, account, license records, and any active confirmation records from your sends).
Correct inaccurate information.
Delete your data by requesting we remove your records. (Note: deletion may make a purchased license unusable, and we may need to keep order records we are legally required to keep.) Confirmation records can be deleted on request without affecting your license.
Object to or restrict processing, or request portability of your data.
Opt out of marketing emails (unsubscribe link in every email) and of advertising cookies (Section 5).

To exercise any of these rights, email support@saliga.studio. We respond within 30 days. We may need to verify your identity first. We will not discriminate against you for exercising your rights.

If you are in the European Economic Area, the United Kingdom, or California, you have additional rights under GDPR, UK GDPR, or the CCPA/CPRA respectively; residents of other U.S. states may have similar rights under their state laws. Contact us at the same address, and if you are unhappy with our response, you may also contact your local data protection authority.

11. Children

The Site and our products are for adults and professionals. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with information, contact us and we will delete it.

12. Security

We use standard industry practices: HTTPS for all transmission, reputable third-party processors with their own security commitments (Google, payment processors, Kit, and others), and a hosted WordPress + WooCommerce stack on andrewsaliga.com with regular updates. As of v2.0, your copy of Call Sheet Tools authenticates with a revocable access token instead of transmitting the license key, and confirmation links use single-purpose random tokens. The bound script is inspectable in your own Apps Script editor at any time if you want to audit what runs.

No system is perfectly secure. If you suspect your account or license has been compromised, contact us immediately.

13. Where your information is processed

We are based in the United States and our service providers process information in the United States and possibly other countries. If you access the Site from outside the U.S., your information will be transferred to and processed in the U.S., where data-protection laws may differ from those in your country.

14. Third-party links

The Site may link to other websites. We’re not responsible for their privacy practices; please read their policies.

15. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top will reflect any changes. Material changes will be communicated by email to active license holders and posted on the Site.

16. Contact

Questions, requests, or concerns:

support@saliga.studio
Saliga.Studio — Tulsa, Oklahoma, USA