Last updated 8 Nov 2026
bayanSheet is a tool for customs-clearing companies. You upload a bayan declaration PDF, check the values it read, and bayanSheet appends one row to a Google Sheet that you own. This page explains exactly what that means for your data.
Only what the service needs to work — an account, a link to your spreadsheet, and enough of a record to find a filed row again.
The declaration PDF you upload never leaves your browser. It is read on your own device, and it is never uploaded to us or stored on our servers. If you choose to attach a merged PDF to a row, that file is uploaded from your browser directly to your own Google Drive — it does not pass through our servers, and we store only the link. The exceptions are the optional invoice inbox, the optional QuickBooks connection, the automatic work on documents already filed in your Drive, and a shipment's document emailed to your customer with “Send to client”, all described below: there a document can pass through our servers, where it is held in memory for that one operation and never written to our storage.
The declaration data goes into YOUR Google Sheet, not into bayanSheet. Of the values a declaration carries — the consignee, the amounts, the CR number, the carrier and the rest — we keep only what this page names: the bayan number, the QR reference and your customer list above, and, when an invoice is matched to a row, the evidence for that match (described next, and in the Gmail section below). Everything else lives in your spreadsheet and nowhere else with us. An invoice notice to your customer carries only the few details listed under “Email we send”. An invoice you create in QuickBooks from bayanSheet carries that shipment's waybill into your QuickBooks and, if you keep it in your Origin field, the country of origin that shipment's declaration names, as set out in the QuickBooks section. An invoice that a person in your company emails to your customer with “Send to client” carries the invoice's own PDF, as QuickBooks renders it, and its number, date, waybill and total, as set out under “Email we send”. If attaching the shipment's document is on, an invoice emailed on its own can also carry that shipment's document as it is filed in your Drive, which starts with the invoice and holds the shipment's declaration, with every value on it, and every invoice and paper filed in it, your cargo agents' invoices among them; when that document already holds the current invoice, it goes alone, in place of the invoice's own PDF. The customer it is sent to can be a forwarder, billed for its own clients' shipments, rather than the company the declaration names.
For the invoices you issue to your own customers we do keep a record, because you check each one before it is written into your sheet. For every such invoice, whether you upload it or create it in QuickBooks from bayanSheet, or it is imported from QuickBooks, we keep: its invoice number, total, date and waybill (as read, and as printed), the customer's name as the invoice gives it, and the bayan number it was matched by; the tab and row it was matched to, with the evidence for that match — that row's bayan number, waybill and company name as your sheet holds them; and where its file is in your Drive, the file's link, its size and a SHA-256 fingerprint of its bytes. If your company sends invoice notices, the record also says whether, and when, your customer was sent one about it, or why not. The record is kept until you delete the invoice from the Customer invoices screen, or until the company is deleted. Each time a person in your company emails an invoice to your customer with “Send to client”, we also keep a record of that email: the invoice's QuickBooks identifier and number, the revision of the invoice that was emailed, which email of that invoice it was, who sent it and when, whether Gmail accepted it (or a short code saying why not), how many addresses it was copied to, whether a hidden copy went to your company, whether the shipment's document went with it, and the identifiers bayanSheet and Gmail gave the message — never an address it went to. That record is kept until the company is deleted, even if the invoice's own record is deleted first. The activity log also keeps the invoice number, amount, waybill and bayan number of every invoice written into your sheet, and the QuickBooks identifier, number and total of every invoice created in QuickBooks from bayanSheet, with the bayan number of its shipment, and, for every change saved with “Edit invoice”, the invoice's QuickBooks identifier, its revision, number and total before and after the change, and the bayan number and sheet row of its shipment, and, for every request to email an invoice with “Send to client”, whether or not the email went, the invoice's QuickBooks identifier and number, which email of that invoice it was, how many addresses it was copied to, whether a hidden copy went to your company, whether the shipment's document went with it and whether the invoice went inside that document, and whether Gmail accepted it or a short code saying why not, as described under “How long we keep it”.
We never ask for and never store card or bank details. Billing is handled manually; see the Terms of service.
When you connect Google, bayanSheet requests one Drive permission: drive.file. That permission does not grant access to your Drive. It grants access only to the individual files you explicitly choose in Google's own file picker, and to files bayanSheet creates in your Drive at your request — no other file in your Drive is visible to us.
Connecting Google does NOT give bayanSheet access to your mail. The invoice inbox is a separate application registration with its own consent screen, so the Drive permission above is the only thing you grant here — if you never switch the invoice inbox on, no mail permission is ever requested and none exists. What the inbox does when you do turn it on, and how to end it, is the section below.
We use the Drive access for these things. When you ask for it: reading the layout of the sheet you picked so your columns can be matched, appending the rows you ask us to file, creating a merged PDF in your Drive when you attach a document to a row, reading the email addresses on your sheet's customer list when an owner asks to import them, reading the customer code, the waybill and the transport amount in a shipment's row, and the customer codes and clearing fees on your sheet's customer list (with the few rows at its top, to find those two columns), when someone in your company presses “Create invoice” for it (only if you connect QuickBooks), reading your sheet's customer list for the name, email address and CC addresses it gives the customer code on an invoice, when an email of that invoice to your customer is shown to someone in your company — when they open it, or when it is offered to them right after they press “Create invoice” or “Create invoices” — and again when they send it with “Send to client” (only if you connect QuickBooks and Gmail), reading the bayan number and the document link in the row of that invoice's shipment, and that document's identifier, name, type, size, link and version in your Drive, when it last changed, whether it is in the bin and the labels bayanSheet stamped on it (of which only its bayan number is used), when the email of that invoice on its own is shown to someone in your company — when they open it, or when it is offered to them right after they press “Create invoice” — and again, with the whole document and the copy of that invoice bayanSheet filed in your Drive, to attach the document and check that it starts with that invoice, when they send it with the document left in (only if you connect QuickBooks and Gmail and attaching the shipment's document is on), and reading the codes, names, email addresses and CC addresses on that list to show them to someone in your company who opens the Customers page in Settings. And automatically, without anyone clicking, when your company's settings allow it — either while the app is open or on a schedule on our servers, and always through your company's own Google connection: saving a copy of each invoice attachment we find into your Drive so it can be merged (only if you turn the invoice inbox on); saving the PDF of each invoice imported from QuickBooks into your Drive, without link sharing (only if you connect QuickBooks); updating the documents already filed for your rows, by putting a finished declaration or a matched invoice inside them; writing the number and amount of an invoice you issued to your customer into the row of the shipment it was matched to, with a link to that invoice in the row's document cell when the cell is empty; reading the customer code in that row, which is used only to choose where the invoice's notice goes if your company sends invoice notices; filing a cargo agent's invoice as the document of a shipment that has none, with its link written into that row; and filing a finished declaration as the document of a row that has none, with its link written into that row. Those automatic writes go only into the columns your column mapping names. The invoice copy stays in your Drive even if you dismiss the invoice. A file you attach is made viewable by anyone holding its link, so treat the link as shareable.
We never sell, rent or share your Google data, except that, if your company switches on invoice notices, the email addresses read from your sheet's customer list are passed to Resend, our email delivery processor, only to deliver those notices; that, when someone in your company emails an invoice to your customer with “Send to client”, the addresses read from your sheet's customer list for that customer are given to Gmail, from your company's own account, only to deliver that email to them and, when Gmail does not answer, to look for that invoice's email in your Sent folder using the To address, as set out in the Gmail section; that, with such an email and only if attaching it is on, the shipment's document read from your Drive for an invoice emailed on its own, which can hold your cargo agents' invoices found in your mail, goes to those same addresses, and to your company's own address when a hidden copy goes there, and stays with that email in your Sent folder; and that, when someone in your company presses “Create invoice” for a shipment (or “Create invoices” for several), the customer code and the waybill read from that shipment's row are sent to Intuit, the code to find your customer in your QuickBooks and the waybill to go on the invoice that person confirms, and the transport amount read from that row, that customer's clearing fee read from your sheet's customer list and the totals of the cargo agents' invoices matched to that shipment (those of one kind added together), whether found in your mail or uploaded, reach Intuit only as the amount of a line on that invoice, when that person keeps one there; none of them is sent for anything else. We do not use it for advertising, and we do not use it to develop, improve, or train any machine-learning or AI model.
bayanSheet's use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect Google at any time from Settings, or revoke bayanSheet from your Google account's permissions page. Disconnecting deletes the stored refresh token. If your invoice inbox is connected with the same Google account, disconnecting Google ends the inbox connection too.
Every bayan declaration carries a QR code, and that code addresses THAT declaration on the Oman Customs portal. When you file a bayan, bayanSheet keeps the code from it.
We use it for two things. First, asking the portal whether Customs has finished the declaration. That request goes to a public government page using a reference printed on your own document — it carries no account of yours, no sign-in, and nothing from your spreadsheet. It happens automatically, without anyone clicking — while the app is open, or on a schedule on our servers — which is the point: a declaration is usually filed while provisional and finalised days or weeks later. Second, only if you connect QuickBooks: when someone in your company presses “Create invoice” for a shipment (or “Create invoices” for several), our servers fetch that shipment's declaration from the portal the same way, to read the country of origin of its goods for the invoice they are making, as set out in the QuickBooks section.
When the finished declaration is available, the app can replace the provisional copy inside the document already filed for that row, so the file in your Drive is the current one. Whether that happens automatically is your setting. When it happens on our servers, the filed document is downloaded from your Drive through your company's own Google connection, the finished declaration is put in place of the provisional one, and the result is uploaded back to the same file — the link does not change. The document is held in memory for that one replacement and is never written to our storage.
The code is treated as a secret, because anyone holding it can fetch that declaration from the portal. It is never written into your spreadsheet, never included in the activity log, and never sent to your browser — links to the live copy go through bayanSheet so the code stays on our side. It is deleted when the company is deleted. The declaration itself carries the code, printed as its QR, so a shipment's document emailed with “Send to client” hands it to everyone that email goes to, who can then fetch that declaration from the portal too.
No mail is read, and none is sent, until an owner connects the invoice inbox, and you can disconnect it at any time. Mail access — gmail.readonly to read, and gmail.send to send — is requested by its OWN application registration, on its own consent screen, separate from the one that grants Drive access. So it is granted only if you deliberately connect the inbox; disconnecting the inbox stops all mail reading and sending and deletes the stored token. If the inbox uses a different Google account from your Drive connection, disconnecting it leaves Drive untouched. If both use the same Google account, Google ends them together. Drive must then be connected again with that account, and the spreadsheet and the documents already filed chosen again.
If you connect it, bayanSheet requests gmail.readonly: permission to READ your mail. We use it for four things. First, finding invoices your cargo agents email you, using a search you control and can narrow at any time in Settings. For each email the search finds, we read its sender, its subject, the date it arrived and its text, look in its subject and text for the waybill, and fetch its PDF attachments. Everyone in your company can see the invoices found in the connected mailbox, and what we keep of them, even when that mailbox is one person's own. Second, only if you also connect QuickBooks: when someone in your company presses “Create invoice” for a shipment (or “Create invoices” for several), the totals of those invoices matched to that shipment are offered, those of one kind added together, as the amounts of the handling and document-charges lines on the invoice they are making for your customer, and reach Intuit only if that person keeps them there and confirms the invoice; no mail is read for this, and nothing more is kept. Third, only when Gmail does not answer while an invoice email described in the next paragraph is being sent, and when someone in your company later asks to send that invoice again: looking in your mailbox for that one message — by the identifier bayanSheet gave it, or by its recipient as your customer list gives it, its subject and the time it was sent — to learn whether it went out; only the Gmail identifier of what is found is read. Fourth, only if attaching the shipment's document to invoice emails is on: a cargo agent's invoice found in your mail and filed in a shipment's document goes, inside that document, to everyone an email of that shipment's invoice goes to, when someone in your company emails that invoice on its own with “Send to client” and leaves the document in; no mail is read for this, and nothing more is kept. Apart from sending those invoice emails, we never send anything from your mailbox, and we never delete, reply to, label, or mark anything as read, or move anything to trash. Your mailbox is left exactly as we found it, but for those emails in its Sent folder.
Connecting the inbox does not ask for gmail.send. That permission, to send email from that account, is asked for separately, on its own Google screen: only for a company we have enabled “Send to client” for, and only when an owner presses “Reconnect Gmail” to allow sending. An inbox connected between 4 November 2026 and 5 November 2026 was asked for it when it was connected. We use it for one thing only: sending, from that account, an invoice that a person in your company emails to your customer with “Send to client” and confirms, only if we have enabled that for your company, as set out under “Email we send”. Nothing is ever sent from your account by itself — not on a schedule, and not in the background — and nothing else is ever sent from it. Gmail keeps each email sent this way in that account's Sent folder, as it does any email you send; of each one we keep the record described under “What we do not collect”, which holds Gmail's identifier for it and no address. Until that permission is given, or if it is left unticked on Google's screen, the inbox still reads invoices, and nothing can be sent from it.
We do not store your emails. For each invoice we keep what identifies it: the sender, the subject line, the date it arrived, the attachment's filename, and the details read from the invoice itself — the waybill, invoice number, date and amount — so we can show you which shipment it belongs to. Alongside that we keep the evidence for the match we are proposing, which includes the tab name, row number and the waybill and reference cells copied from the candidate rows of your spreadsheet, so you can check our reasoning before accepting it. A cargo agent's invoice that someone in your company uploads on the Cargo invoices screen instead is kept the same way: the time it was uploaded, its filename, a SHA-256 fingerprint of its bytes, the same details read from it and the evidence for its match. When an invoice is merged into a shipment's document, we also keep a fingerprint of each of its pages: the page's size and a one-way digest of how the page is drawn, which contains none of its text or figures. It lets bayanSheet find exactly that invoice's pages if you later take it back out of the document, even after its copy in your Drive can no longer be opened. It is cleared when the invoice is taken back out, and deleted with the company.
We also keep the Gmail message identifier of every message the search examined, including ones that turned out to hold no invoice. It is an identifier only — no sender, subject or content — and it exists so the same message is not fetched and charged against your mailbox again on every pass. These are removed when the company is deleted.
The attachment itself is copied into YOUR Google Drive: we fetch it from Gmail and immediately upload it to your Drive. It is held in memory for the length of that single transfer and is never written to our storage. The invoice's text may also be read on our servers, to confirm which shipment it belongs to; only the details listed above are kept from it.
Merging an invoice into a filed document happens in your browser or on our servers, depending on your settings and on whether the merge was started by a person or runs automatically on a schedule. On our servers the document is downloaded from your Drive through your company's own Google connection, the invoice is added, and the result is uploaded back to the same file; it is held in memory for that one merge and is never written to our storage.
You can pause syncing or disconnect Gmail at any time in Settings, or revoke bayanSheet from your Google account's permissions page. Disconnecting deletes the stored refresh token. The invoice records and message identifiers described above stay after a disconnect, so your company can still check an invoice later; they are deleted with the company, or sooner if an owner asks us to delete them. Invoices already merged into your documents stay in your Drive, because they are yours.
Nothing is read from QuickBooks until an owner of your company connects it in Settings, and the connection is offered only to companies we have enabled it for. The person who connects must be an owner of your company in bayanSheet and an administrator of your QuickBooks company, and approves the connection on Intuit's own sign-in and consent screen. From then on Intuit is a source of data for bayanSheet: the invoices you issue in QuickBooks Online reach us from Intuit, through that connection. What Intuit itself does with your QuickBooks data is governed by Intuit's own privacy statement; this section covers what bayanSheet does with what it reads.
Intuit offers one permission for this, com.intuit.quickbooks.accounting, and it allows both reading and changing everything in your QuickBooks company. bayanSheet reads with it, and makes exactly two kinds of change, each only when a person in your company asks for it in bayanSheet and confirms it, and only if we have enabled it for your company, as set out below: it creates an invoice in your QuickBooks when the person presses “Create invoice”, and it changes an invoice already written into your sheet when the person presses “Edit invoice” and saves the change. Every other request we send to QuickBooks's accounting service is a read, from a fixed list. Apart from creating and changing those invoices, we never change, send, void or delete anything in your QuickBooks: we never send an invoice to your customer through QuickBooks, never write an email address into it, never void or delete an invoice, and never change one that has a payment recorded against it, which stays yours to change in QuickBooks. An invoice that a person in your company emails with “Send to client” goes from your company's Gmail instead, as set out below.
What we read: your company's name, home currency and multicurrency setting, and the names of its custom fields; and your invoices — each invoice's number, date, total, currency, customer, deposit and whether it is voided, the field you choose to carry the bayan number (a custom field, or the memo on statement) and the field you choose for the waybill. Other memo and line text is read only if you choose automatic detection of the bayan number instead of naming a field, or, when someone presses “Create invoice”, from the recent invoices of the customer the invoice is for — and of the other customers with the same code, when the person chooses among several — or, when someone presses “Edit invoice”, from the invoice being edited, as set out below, or in the readiness check described at the end of this paragraph. An invoice is fetched whole, but only what this page lists is kept from it. When an owner runs the setup check, recent invoices (up to the last 90 days) are read in memory to report counts and yes-or-no answers about how your fields are filled; nothing from that check is stored. Before we enable “Create invoice” for your company, and while it is enabled, a member of our staff may run a readiness check through your company's connection: it reads your QuickBooks settings and up to your 300 newest invoices, whole — their customers' names and line text included — in memory, to report only counts and yes-or-no answers about whether they can be copied as new invoices. Our staff see only those counts and answers; nothing from that check is stored, and it changes nothing in QuickBooks.
Each invoice's PDF is fetched from QuickBooks as QuickBooks renders it, held in memory on our servers for that one transfer, and saved into your own Google Drive, in the folder your company uses for customer invoices, through your company's own Google connection. It is never written to our storage. It is saved without link sharing, and becomes viewable by anyone holding its link only when it is filed as the document of a row in your sheet, as an invoice you upload yourself is. Its text may be read on our servers to check that the PDF agrees with QuickBooks.
When a person in your company presses “Create invoice” for a shipment, bayanSheet reads the customer code and the waybill in that shipment's row of your sheet — and, where your sheet has those columns, the row's transport charge and, to find that customer's clearing fee, the customer codes and clearing fees on your sheet's customer list, with the few rows at its top that name those two columns — and asks QuickBooks for the customer whose name ends in that code, for that customer's recent invoices, and for the settings that decide how your invoices are numbered and taxed; the search for the customer carries the code to Intuit. It also takes, from what bayanSheet already keeps of the cargo agents' invoices matched to that shipment — its handling receipts and its document-charges receipt, whether found in your mail or uploaded — the total of each, without reading your mail for it, and adds up those of each kind. The form puts each of these amounts on the line it belongs to, or offers it beside the lines, as an amount the person can change. The clearing fees read from your customer list are held in memory on our servers for at most two minutes, so that one read serves several invoices prepared together, and nothing from this read is stored. If the names of several of your customers end in that code, the person is shown up to 10 of them, by their QuickBooks names, and chooses one; that is the customer meant below. It then shows the person the invoice it would create: that customer, today's date, which the person can change to a day from 90 days before it to 30 days after it, and the lines of the customer's previous invoice (when there is one to copy), with their items and tax codes, and their descriptions and amounts, and that invoice's message to the customer, without the previous shipment's waybill, bayan number or customer code, all of which the person can change; and, if your QuickBooks lets you number invoices yourself, the number after your latest invoice's, which the person can change too. The person can also start from an empty invoice instead, remove or add lines, and choose each line's product or service and tax code from yours, and can choose the customer by name. To offer those choices, bayanSheet reads from QuickBooks the customers whose names match what the person types, and your products and services (with each one's description, default tax code and default price), your tax codes and their tax rates, your payment terms and the customer's default terms, and, to offer and pre-fill the invoice's other custom fields, their values on that customer's recent invoices; the search carries what the person typed to Intuit. They are used only to fill in the form, to estimate its VAT, which QuickBooks itself calculates when the invoice is created, and to check the person's choices just before sending, and none of them is stored. Where your QuickBooks invoices have an Origin field, bayanSheet also fetches that shipment's declaration from Oman Customs on our servers — the copy the portal serves for it, asked for with the reference printed on that declaration, as described under “Checking your declarations with Oman Customs” — to read the country of origin of its goods, which the form puts in your Origin field as a value the person can change; the declaration is held in memory for that one read and is never written to our storage, and nothing from it is stored. Nothing is created until the person confirms it. Just before sending, bayanSheet checks with QuickBooks that no invoice for that customer already carries this waybill and, if you number invoices yourself, that the number is not already used. When the person chose that customer from several whose names end in that code, bayanSheet also reads the recent invoices of each of the others, whole, and checks that none of them carries this waybill either; nothing from them is stored. Only then do we send Intuit the new invoice: that customer, the lines and amounts and the message the person confirmed, the date the person chose, the payment terms, due date and deposit, the values of your other custom fields and the memo on statement the person confirmed, the waybill in the QuickBooks field you chose for waybills and, if you number invoices yourself, the number. Of your sheet, only the waybill — and the transport charge or the clearing fee, where the person kept one on a line — goes on it, of your cargo agents' invoices only the totals the person kept on a line, and of the shipment's declaration only its country of origin, where the person kept it in your Origin field; bayanSheet adds nothing else to it from your sheet, your declarations, your cargo agents' invoices or your mail. A person may also press “Create invoices” for several waiting shipments at once: each is shown as one row of a table — its customer, the date, the customer's default payment terms and the values of your other custom fields on that customer's previous invoice (in your Origin field, the country of origin read from that shipment's declaration as above, when it can be read), each line's item, tax code, description and amount, the message, and the number — which the person checks and can change, and from which they can remove lines, before confirming, and each is then created as above, one after another.
QuickBooks's PDF of the new invoice is then fetched, held in memory on our servers for that one transfer, and handed to the person's browser, which saves it into your Drive and files it for that shipment exactly as it would an invoice you upload yourself, and the invoice is written into your sheet as an uploaded one is. We keep of it what we keep of an invoice you upload and, once QuickBooks reports it back to us, what the next paragraph lists for each QuickBooks invoice; the activity log also records its QuickBooks identifier, number and total, and the bayan number of its shipment. The customer that was found, the previous invoice its lines came from and your QuickBooks settings are held only in memory and in the open window, and are never stored. Taking the invoice out of a row in bayanSheet changes nothing in QuickBooks: the invoice stays there until someone in your company voids or changes it.
What we keep. For the connection: the access and refresh tokens and the identifier of your QuickBooks company, all encrypted; the company's name and home currency, whether multicurrency is on, and the names and identifiers of the fields you chose. For each QuickBooks invoice: its QuickBooks identifier and revision numbers, when it was created and last changed, what we did with it and why (as short codes and yes-or-no answers), the row we expected it to match, and fingerprints — one-way keyed digests — of its invoice number, of its QuickBooks customer, of its bayan number, of its waybill, of the key of the row it was expected to match, and of its contents. The fingerprints let us notice that an invoice changed, or that its bayan number or waybill was copied from the same customer's previous invoice, without keeping the values themselves. An imported invoice also becomes a customer invoice record, with the details listed under “What we do not collect”; the customs client code that a QuickBooks customer name may carry is removed before the name is kept. If your company switches on invoice notices, an invoice imported from QuickBooks can be the subject of one: its number, date and waybill are then sent through Resend to the address on your customer list, never to an address from QuickBooks.
What we never keep: the invoice as QuickBooks sends it, its line items, balances or payment status, addresses, email addresses, your QuickBooks customer records, or the identifier of your QuickBooks company unencrypted. Our logs record only error codes and Intuit's own reference for a request, never an invoice's content.
When a person in your company presses “Edit invoice” on an invoice already written into your sheet that bayanSheet has linked to its invoice in QuickBooks, bayanSheet reads that invoice from QuickBooks as it is at that moment, with the settings that decide how your invoices are numbered and taxed, and shows it in a form like the one described above. The person can change its lines, with their products or services, tax codes, descriptions and amounts, its date, its number if you number invoices yourself, its payment terms and due date, its message to the customer, its memo on statement, its deposit and the values of your other custom fields. Its customer and its waybill cannot be changed there, and an invoice that is voided, that has a payment recorded against it, or that holds something bayanSheet cannot show as it is, such as a discount or group line, cannot be edited in bayanSheet. To fill in the form and check the person's choices, bayanSheet reads the same lists of your products and services, tax codes and tax rates, and payment terms as for “Create invoice”, and none of them is stored. Nothing is changed until the person saves. Just before sending, if the person changed the number and you number invoices yourself, bayanSheet checks with QuickBooks that the new number is not already used. Only then do we send Intuit the change — the lines and the other values the person saved, together with the revision of the invoice the form was opened on, so that QuickBooks refuses the change if someone changed the invoice in the meantime, and nothing they did is overwritten; QuickBooks then calculates the invoice's VAT again. bayanSheet then fetches QuickBooks's PDF of the changed invoice and saves it into your Drive, as described above for each invoice's PDF, and files it in place of the earlier copy: the earlier copy is taken out of your sheet's row and out of the shipment's document in your Drive, and the changed one is written in, as when an invoice changed in QuickBooks reaches us. The activity log records who saved the change and when, the invoice's QuickBooks identifier, its revision, number and total before and after the change, and the bayan number and sheet row of its shipment; it does not record the lines or the values that changed. bayanSheet never sends the changed invoice to your customer by itself: if it had already been emailed, from QuickBooks or with “Send to client”, your customer keeps the earlier version until someone in your company sends the changed one, from QuickBooks or with “Send to client”.
When a person in your company emails an invoice to your customer with “Send to client” — an invoice just made with “Create invoice” or “Create invoices”, or another of your customer invoices that bayanSheet has linked to its invoice in QuickBooks — and only if we have enabled that for your company, bayanSheet reads that invoice from QuickBooks as it is at that moment: its number, date, total and currency, its customer, whose name carries the customer code that finds the addresses on your sheet's customer list, its waybill, whether it is voided or deleted, and whether and when QuickBooks itself already emailed it, which bayanSheet only shows to the person and does not keep. It reads it when the email is shown to the person — when they open it, or when it is offered to them right after “Create invoice” or “Create invoices” — and again when they send it, and only then fetches the invoice's PDF, as QuickBooks renders it, for the email, which goes from your company's Gmail as set out under “Email we send” and carries that PDF unless the shipment's document goes in its place. The PDF is held in memory on our servers for that one email and is never written to our storage. Nothing is sent through QuickBooks and nothing is changed in it: bayanSheet does not use QuickBooks's own email, takes no address from QuickBooks and writes none into it.
The identifiers, revisions and fingerprints above, including the record that an invoice was deleted or voided in QuickBooks, are kept until your company is deleted, even after you disconnect: that is what stops a reconnection from importing an invoice twice, or bringing back one you removed. You can ask us at iyasseralsaidi@gmail.com to delete them sooner.
You can disconnect QuickBooks at any time, from Settings in bayanSheet or from the Apps page in QuickBooks. Disconnecting in bayanSheet revokes our access at Intuit and deletes the stored tokens and the connection's details; disconnecting from QuickBooks ends our access at Intuit's side. Either way, nothing more is read from, created in or changed in your QuickBooks. Invoices already imported or created, and their PDFs in your Drive, stay where they are, because they are yours. Deleting your company deletes everything above and revokes our access at Intuit.
bayanSheet sends email from its own addresses on bayansheet.app, through an email delivery service, Resend. The one exception is an invoice that a person in your company emails to your customer with “Send to client”: that email is sent from your company's own Gmail, never through Resend, as the last paragraph of this section sets out. Nothing else is ever sent from, or through, your Gmail or your Google account.
To the people in your company we send: a link to reset a forgotten password, and a note whenever a password has been changed, including by one of our administrators; a link to confirm your email address when you sign up, or when you ask for a new one; and an invitation to join your company, which carries the link only — the six-digit code that goes with it is never emailed, and is still passed on by the person who invited you. A link to reset a password stops working after an hour, and a link to confirm an address after a day.
To your company's owners — and, where a notice concerns them, to the member who uploaded a payment receipt or made a connection — we send notices about the account: that it was approved, that its trial is about to end, that a subscription payment is due soon, that access stops tonight or has stopped because it was not paid in time, that a payment was accepted or was not accepted, and that its Google, Gmail or QuickBooks connection stopped working and has to be connected again. They name your company and link to bayanSheet; a payment notice may also give the number and amount of our bill.
The people who run bayanSheet are emailed when new companies register, at most once an hour, and when a payment receipt is uploaded, once for each receipt and at most five times a day for each company. Those alerts say only how many companies registered, or whether the receipt was approved automatically, and link to our console: they carry no company or person's name, no email address and nothing from a receipt. They also receive a copy of each notice above that a subscription payment is due soon, that access stops tonight or has stopped, or that a payment was accepted; each copy names your company and may give the number and amount of our bill.
If your company switches on invoice notices, bayanSheet also emails your own customers when an invoice you issued to them is written into the row of their shipment. The notice goes to the address your customer list holds for the customer code in that row, and only when the name on the invoice matches that customer's name. It goes out in your company's name, as “Your company via bayanSheet”, from an address kept for these notices, and replies go to your company's email address. It carries only your company's name, the invoice number, its date and its waybill — no attachment, no link to the document, nothing else from the invoice, and nothing from the declaration or your sheet. Before the first notice, we send a confirmation link to your company's email address, and notices start only once it is confirmed.
For these notices your company decides which customers are emailed and at which address, and is responsible for being entitled to email them: your company is the controller of those addresses, and we process them on its behalf. We use them only on your company's instruction and only to send the notices it switched on — never for marketing — and we never sell them or share them with anyone but Resend. The one use we make of them for ourselves is our do-not-email list: an address that a notice bounced from permanently, or from which one was reported as spam, gets no more notices through bayanSheet, from any company, until we take it off that list or the company whose notice put it there is deleted. If we cannot tell which company's notice it was, the address stays on the list until we take it off.
Every notice to your customers carries a link to stop them, which the customer's mail program can also offer as its own unsubscribe button. Using it stops your company's notices to that address. Reporting a notice as spam does the same, and also switches all of your company's notices off until an owner switches them on again. Your company sees that the address opted out, and only we can lift that, at that customer's own request. The record of an opt-out holds only a fingerprint of the address — a one-way keyed digest — and is kept until your company is deleted, even after the address is taken off your customer list.
Resend delivers these emails for us, as our processor. It handles them in the United States and Japan, and keeps a copy of each message — its subject and everything it says — and of our request to send it, for 30 days, after which it deletes them. It also keeps its own list of addresses that bounced or reported a message as spam, so that it does not deliver to them again. That is why our emails carry only what this section lists: never a declaration's values, a receipt's contents, a password or an invitation code.
We do not keep a copy of the emails themselves. What an email needs is held only until it is sent — for no more than three days if it cannot be — and is then deleted. We keep the record of each email listed under “What we collect” for 90 days, so that we can tell whether it arrived; an address that bounced or reported one of our account emails as spam stays on our do-not-email list until we remove it, and one that an invoice notice bounced from or was reported from stays as long as set out above. The emails to the people in your company are part of running the account and cannot be switched off; they stop when the account is deleted.
An invoice emailed with “Send to client” is your company's own email: it is sent from your company's connected Gmail, in your company's name, and is not one of our emails — Resend has no part in it. It is sent only when a person in your company asks for it, with “Send to client” on an invoice or when it is offered right after “Create invoice” or “Create invoices”, and confirms what they are shown, and only if we have enabled it for your company: nothing sends one by itself. It goes to the email address your sheet's customer list gives for the customer code on that invoice, with the CC addresses it gives that customer as copies (the first 20, if it gives more), read from your sheet when the email is shown to the person — when they open it, or when it is offered to them — and again when they send it; no address can be typed for it in bayanSheet. When one invoice is emailed on its own, the person can leave out any of the copies for that email; an email sent from the review after “Create invoices” goes with every copy the list gives for that customer (the first 20, if it gives more). If an owner turns it on, a hidden copy also goes to your company's email address. The email is in English: its subject gives the invoice's number and waybill and your company's name, its message the invoice's number, date, waybill and total, signed with your company's name, and it carries the invoice's own PDF, fetched from QuickBooks when the person sends it, held in memory on our servers for that one email and never written to our storage. Attaching the shipment's document is set in Settings › Company › Invoice emails, where an owner can turn it off at any time. It is on from the start for a company that registers after this policy's update of 8 November 2026; for one that registered before that update, it is off unless it has been turned on. While it is on, an invoice emailed on its own can also carry that shipment's document, exactly as it is filed in your Drive when the person sends it, read from your Drive through your company's own Google connection: it starts with the invoice and holds the shipment's declaration, with every value on it, and every invoice and paper filed in it, your cargo agents' invoices among them. When that document already holds the current invoice, it goes alone, in place of the invoice's own PDF, and the message says the invoice comes with the shipment's documents; otherwise the invoice's own PDF goes beside it, and the message adds that the shipment's documents are attached as a separate PDF. It goes to everyone the email goes to: your customer, the copied addresses and, when one goes, your hidden copy. The person sees it listed, with its size, before sending, and can leave it out of that email. It starts left out, for the person to check, when something about it looks wrong: for example, when it also holds another customer's invoice, or when the shipment is another company's, unless your earlier invoices show that customer as a forwarder. The customer an invoice is billed to can be such a forwarder rather than the company the declaration names, and the document then goes to that customer. An email sent from the review after “Create invoices” goes without it. The document, too, is held in memory on our servers for that one email and never written to our storage. Gmail keeps the email, with everything it carries, in that account's Sent folder, as it does any email sent from it. We keep no copy of it and none of the addresses it went to: each time a person sends one, we keep only the record described under “What we do not collect” and a line in the activity log.
Account, company and settings data is held in a managed Postgres database, and the application runs on Vercel. Your spreadsheet is never copied there — it stays in your own Google account the whole time. Our own email is delivered through Resend, which handles it in the United States and Japan and keeps each message for 30 days — see “Email we send” above; an invoice emailed with “Send to client” goes from your company's own Gmail instead, which keeps it in that account's Sent folder.
bayanSheet is served only over HTTPS, and bayansheet.app tells browsers to use nothing else (HSTS). Our servers reach the database over TLS and check its certificate.
Every token we keep for your Google Drive, Gmail and QuickBooks connections is encrypted with AES-256-GCM, and the key is kept in our hosting provider's settings, never in the database. The database itself is stored encrypted.
Our server logs never contain an email's subject, text or attachments.
Only an owner of your company can connect Gmail. Only an owner, or our support staff at an owner's request, can pause it, change which emails it reads, or disconnect it.
Our staff do not read your mail or the invoices found in it, unless the law requires it or the owner who connected your Gmail has agreed in writing that a named person on our team may see those invoices as a member of your company. At the request of an owner of your company, our support staff can change your company's settings for it, for example to turn attaching the shipment's document on or off, or to pause your company's automatic work. A pause of its automatic work made that way is shown in the app as made by bayanSheet support, and turning the document on that way is recorded under the name of the staff member who did it. When a member of our staff signs in to your account to help you, bayanSheet hides the Cargo invoices page; it does not show, in your sheet's rows, your log or “Create invoice”, the details or amounts of the invoices found in your mail, and it does not open, from your sheet's rows or the lists of shipments, a shipment's document that the records bayanSheet keeps of those invoices point to; and it does not let them connect or reconnect Gmail, check for new mail, merge an invoice or send an email from your Gmail. Insights still shows counts and times for them, as totals only. Our admin console shows nothing from your mail but counts and these security-log entries: the address of each mailbox your company connected and, for each cargo invoice merged, taken back out, dismissed, put back in the queue or matched to a shipment by hand, its waybill and invoice number, the shipment it went to and how many pages it added or took out. It never shows an email or a PDF, or a link or an identifier that opens one. Changes our staff make in Settings › Gmail while signed in to your account show in your company's log as done by “Admin”.
Filing history is kept for as long as your company has an account, because its whole purpose is letting you find a row again months later. Account and connection records are kept for the same period.
Deleting your account removes your account, your company, your Google connection and your filing history. Ask for it at iyasseralsaidi@gmail.com and we do it by hand — there is no self-serve delete button in Settings yet. Rows already written to your spreadsheet are yours — they stay exactly where they are, and we neither can nor do remove them.
Three things deliberately outlive a deleted account, and we would rather say so than leave you to find out. Payment records — a receipt you uploaded, and the credit movements it produced — are kept as financial evidence, because a record of what was paid has to survive the account it was paid for. Security log entries keep the name and email address of whoever performed each action, for the same reason a log nobody can be identified in is not a log; the entry for an invoice written into your sheet also keeps its invoice number, amount, waybill and bayan number, and the entry for an invoice created in QuickBooks from bayanSheet its QuickBooks identifier, number and total and the bayan number of its shipment, and the entry for a change saved with “Edit invoice” the invoice's QuickBooks identifier, its revision, number and total before and after the change, and the bayan number and sheet row of its shipment, and the entry for every request to email an invoice with “Send to client”, whether or not the email went, the invoice's QuickBooks identifier and number, which email of that invoice it was, how many addresses it was copied to, whether a hidden copy went to your company, whether the shipment's document went with it and whether the invoice went inside that document, and whether Gmail accepted it or a short code saying why not, so that a disputed figure, or a disputed email, can still be traced. The entry for turning on attaching the shipment's document to invoice emails also keeps the version of this policy that was agreed to and the email addresses of the Google accounts your Drive and your invoice inbox were connected with at that moment, so that the agreement can still be shown. The entries for the invoice inbox also keep the mailbox's address each time it is connected or disconnected or Google withdraws access, and, when a new connection replaced another Google account, that account's address too. The entries for cargo agents' invoices keep: for each one merged into a document, its waybill, invoice number, bayan number and sheet row, how many pages it added and the Drive file it went into; for each one taken back out of a document, its waybill, invoice number and bayan number and how many pages came out; for each one uploaded by hand, its waybill, invoice number, bayan number and sheet row; and for each one dismissed, put back in the queue or matched to a shipment by hand, its waybill and invoice number, with its bayan number and sheet row when it was matched. And an address that bounced or reported one of our account emails as spam stays on our do-not-email list, so that no new account at that address is emailed either; so does an address that an invoice notice bounced from or was reported from, when we cannot tell which company's notice it was. None of the three is used for anything else, and you can ask us to remove any of them at the address below.
You can have your account deleted at any time by asking us at iyasseralsaidi@gmail.com. We do it by hand, and there is no self-serve delete button in Settings yet.
To ask for a copy of what we hold about you, to have something corrected, or to have it deleted, email iyasseralsaidi@gmail.com. A person reads that address and replies from it.
If we change how we use your Google data, we will tell your company's owners in the app and by email, and ask them to agree, before the new use starts. Whenever this policy changes in a way that matters, the date at the top of this page changes with it.
Any question about privacy: iyasseralsaidi@gmail.com.