Last updated: 3 November 2026
This policy explains how Gold Star, a Google Sheets add-on made by Ironbit Ltd (“we”), handles information. Contact: hello@goldstar.school.
Ironbit Ltd is registered in Northern Ireland, company number NI729290. Registered office: 15 Longfield Lane, Desertmartin, Magherafelt, BT45 5NW.
Gold Star runs inside your own Google account. Your spreadsheet data, pupils’ names, templates and generated files stay in your Google Drive; we never receive them. The only things that reach us are what’s needed to run paid plans: your Google account email address, so Gold Star can check which plan you’re on, and, if you buy a plan, the payment details handled by Stripe. We never sell or share your data.
Job settings (template, folder, file name pattern, email text) are saved inside the spreadsheet itself using Google’s document properties. Your organisation details (name, colours, logo, signatures, date format) your list of saved designs and your saved classes (names, email addresses and any parent or guardian email addresses you add) are stored in your own Google account’s add-on settings, and your logo and uploaded designs are saved as files in your Google Drive. Status columns and an optional “Gold Star log” sheet are written to your spreadsheet. Generated files are saved in the Drive folder you choose. None of this is stored by us.
goldstar.school is hosted on Cloudflare Pages. The site sets no cookies and runs no analytics or tracking scripts. Cloudflare processes basic request data (such as IP address) only to deliver the site and protect it from attacks. The Gold Star add-on itself sends nothing to the website.
Payments are taken by Stripe (stripe.com), which processes card details under its own privacy policy; we never see your card number. When you buy a plan, we keep a licence record in our licence service (run on Cloudflare’s network, which may process it outside the UK under standard data protection safeguards): the email address or school email domain the plan covers, the plan, when it ends, and the Stripe subscription reference. Stripe keeps the billing name, email and invoices, which we can see in our Stripe account to provide receipts, invoices and support. We keep licence and billing records for as long as the plan is active and then for up to six years, as UK tax law requires. Ironbit Ltd is the data controller for these records.
When you give an award, a record (date, name, email addresses, reason and class) is added to an “Awards” tab in the spreadsheet you’re using, so you can see who has received what. You can edit or delete these rows at any time.
spreadsheets.currentonly) and the Drive files you pick or it creates (drive.file), not the rest of your Drive. Email is only sent when you turn it on for a job, from your own account, to the addresses in your sheet.Gold Star’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not let humans read it except with your explicit permission for support or where required by law, and do not use it to train artificial intelligence or machine learning models.
When a school uses Gold Star, the school remains the data controller for the personal data in its spreadsheets. Because Gold Star does not receive or store the contents of those spreadsheets, we do not act as a processor of them. A data processing statement for school records is available on request.
Gold Star is a tool for teachers, staff and administrators. It is not designed to be used directly by children, and we do not knowingly collect information from anyone.
You can remove Gold Star’s access at any time at myaccount.google.com/permissions. Deleting a job in Gold Star removes its settings from the spreadsheet; files already generated stay in your Drive until you delete them.
If you are in the UK or EU, you have rights under data protection law, including access, correction and deletion of the personal data we hold (your licence and billing records, and any emails you send us for support), and the right to complain to the Information Commissioner’s Office (ico.org.uk) or your local authority. Send requests to the contact address above.
If this policy changes, the new version will be posted here with a new date.