Gold Star for IT teams

Gold Star is a Google Sheets add-on that teachers use to make and email certificates. It can’t see staff members’ Drive: it only opens the spreadsheet it is used in and the files it creates or the teacher picks. Only staff use it. Pupils never sign in to it.

At a glance

Made by: Ironbit Ltd, Northern Ireland (company NI729290).
Where data lives: in the teacher’s own Google account. Spreadsheet contents, pupil names and certificates are never sent to our servers.
What reaches us: the teacher’s email address, so we can check whether they or their school have a paid plan. Card payments are handled by Stripe.
No restricted scopes: Gold Star uses drive.file, not full Drive access, and spreadsheets.currentonly, not access to all spreadsheets.
Google’s rules: Gold Star’s use of Google user data follows the Google API Services User Data Policy, including the Limited Use requirements. No advertising, no selling data, no AI training.

Permissions it asks for

Permission	Why
`spreadsheets.currentonly`	Reads the rows of the sheet it is opened in and writes status and file links back. No other spreadsheet.
`drive.file`	Copies the template the teacher picks, saves certificates to the folder they pick. Cannot see any other Drive file.
`script.send_mail`	Emails certificates from the teacher’s own account, only when they turn email on.
`script.external_request`	Calls Google’s Docs, Slides and Drive APIs; loads design artwork from designs.goldstar.school; checks the plan at licence.goldstar.school (email address only).
`script.scriptapp`	Creates a trigger only when the teacher turns on automatic certificates for a Google Form or a schedule.
`script.container.ui`	Shows the sidebar in Google Sheets.
`userinfo.email`	Identifies the signed-in teacher for “Email me” tests and the plan check.
`classroom.courses.readonly`, `classroom.rosters.readonly`, `classroom.profile.emails`	Optional. Only used if the teacher chooses “Import from Google Classroom”, to copy a class list. Read-only. Teachers can decline these and still use everything else.

How to allow Gold Star for staff

If your domain blocks third-party apps, a super admin can allow Gold Star in the Google Admin console:

Install it for staff. Go to Apps → Google Workspace Marketplace apps → Apps list → Add app → Add app to Domain install list, search for “Gold Star” and choose the staff organisational units. Or allow staff to install it themselves.
Trust it. Go to Security → Access and data control → API controls → Manage Third-Party App Access. Find Gold Star (after a teacher has tried it, or with Configure new app → search “Gold Star”) and set it to Trusted or Specific Google data for staff.
Pupil accounts can stay blocked. Gold Star is only used by staff, so you don’t need to allow it for pupils’ organisational units.

Google’s own guide: Control which third-party & internal apps access Google Workspace data.

Data protection

The school remains the data controller for the personal data in its spreadsheets. Gold Star doesn’t receive or store those contents, so Ironbit Ltd isn’t a processor of them. Ironbit Ltd is the controller only for licence and billing records. Full details are in the privacy policy. A data processing statement is available on request.

Questions

Email hello@goldstar.school. A real person replies, usually within one working day.