Privacy Policy

SweepMyMail is operated by CHARLES BALLADUR CONSEIL ("we", "us"), the data controller for the personal data described in this policy. You can reach us at privacy@sweepmymail.com. The service helps you find the newsletters in your Gmail and unsubscribe from or clean them out.

We collect the following categories of personal data:

• Account data — your Google account email address and profile identifier, used to create and secure your account.
• Gmail metadata — sender name and address, domain, message counts, last-received date, estimated size, read/unread status, and unsubscribe signals (List-Unsubscribe header). We only read message headers; we never read the body or content of your emails. Optional exception: if you explicitly turn on receipt detection on the Subscriptions page (off by default), the scan also reads Gmail's short text preview of receipt-looking emails solely to extract an amount and a date; only the amount, currency and date are stored, never the preview itself, and turning the feature off deletes everything it collected.
• Connection credentials — your Google access and refresh tokens, encrypted at rest and used only to talk to Gmail on your behalf.
• Usage and activity data — the actions you take (unsubscribe, archive, delete, restore) and aggregate counts used to operate the freemium plan.
• Technical data — IP address, device and browser information, and security logs used to prevent abuse.

Payment data (card details, billing address) is collected and processed directly by our merchant of record, Paddle — we never see or store your full card details.

• Providing the service (performance of our contract with you): detecting newsletters, displaying them, and performing the actions you choose — unsubscribe, archive, delete, restore.
• Security and abuse prevention (legitimate interest): rate limiting, protecting accounts, and keeping the service reliable.
• Product improvement (legitimate interest): aggregate, non-identifying statistics about feature usage.
• Legal obligations: keeping the records required by applicable accounting and tax law (handled together with Paddle for sales).

• Paddle.com Market Ltd — our merchant of record for all paid orders. Paddle processes payments, subscriptions, invoicing, and tax compliance, and acts as an independent controller of the data needed for those purposes. See Paddle's privacy policy.
• Infrastructure providers — hosting and database providers that process data on our behalf under data-processing agreements.
• Professional advisers and authorities — where required by law.

We never sell, rent, or share your data with data brokers or advertisers, and we do not use your Google data to train AI/ML models.

We keep your account data and Gmail metadata for as long as your account is active. Activity and usage logs are kept for up to 12 months. Security logs are kept for up to 6 months. If you disconnect Gmail or delete your account, your stored connection, tokens, and sender data are deleted promptly, and at the latest within 30 days, except where a longer retention is required by law (for example billing records kept by Paddle).

We apply appropriate technical and organisational measures: your Google tokens are encrypted at rest, all traffic is encrypted in transit (HTTPS/TLS), access to production data is restricted to what is strictly needed, and database access is governed by row-level security so each user can only reach their own data.

SweepMyMail's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Some of our service providers process data outside the UK/EEA. Where they do, transfers are protected by appropriate safeguards such as adequacy decisions or standard contractual clauses.

You have the right to access, rectify, erase, restrict, and object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time. You can revoke our Gmail access from your Google account permissions or by disconnecting Gmail in the app, which deletes your stored connection. To exercise any right, email privacy@sweepmymail.com — we respond within one month. You also have the right to lodge a complaint with your supervisory authority (in France, the CNIL).

We use only essential cookies and local storage needed to keep you signed in and run the app. We do not use advertising or cross-site tracking cookies. If you arrive through one of our ads, we note which campaign brought you (read from the link itself, with no ad-network pixel or cookie) so we can tell which ads are worth running.

Questions about this policy? Email privacy@sweepmymail.com.