Privacy Policy

1. Data controller

The data controller is AL1FO SNC, CBE 0598.828.906. Its full identification is set out in the legal notice. Contact for any question about your data: Alain Colette, manager, at [email protected]. MyCleark is not required to appoint a data protection officer (Article 37 GDPR); this contact serves in its place.

2. Data collected

We collect and process the following data:

• Account data: name and email address, provided by Google or Microsoft upon login, as well as the profile picture for a Google account;
• Connection data: Google OAuth access tokens (Gmail, Calendar) or Microsoft OAuth access tokens (Outlook.com, Hotmail, Microsoft 365: mail and calendar), stored encrypted, necessary for the service;
• Billing data: Stripe customer ID and subscription (no payment card data is stored on our servers);
• Usage metadata: activation date, subscription status, interface preferences;
• Data from your emails: to classify an email, we read its sender, subject and content. For each classified email, we keep the sender (name and address), the subject, a short excerpt from the start of the message, the date, the category and priority assigned and, if it announces an appointment, its date, place and title. We also keep per-sender statistics so that your mailbox is classified consistently;
• Customer segment: individual or business, to apply the right price and the right VAT treatment;
• Sign-up source: the page of the site from which you signed up, recorded only once;
• IP address and user agent: in technical and security logs (purpose: security and abuse prevention; legal basis: legitimate interest);
• GDPR consent: date and time of your acceptance of these terms.

We never use the content of your emails for commercial, advertising or profiling purposes. Their automated analysis is carried out on our servers and by our AI provider Mistral AI, all located in the European Union (see points 3 and 5).

3. Hosting and data sovereignty

4. Purposes and legal bases

5. Recipients, processors and transfers

Own infrastructure. Our database (PostgreSQL) and our automation engine (n8n) run on our own servers, located in Germany (EU). No third party has access to them.

Processors (they process data on our behalf, under a contract compliant with Article 28 GDPR):

• Mistral AI (France): analysis and classification of your emails by artificial intelligence. Receives, for each analysed email, the sender, the subject and the content of the message. Processing in the European Union; the use of our data to train its models is disabled;
• Microsoft Ireland Operations Limited (Ireland), Microsoft 365 service: sending of service emails and of your daily and weekly reports from [email protected]. Receives your email address and the content of the report (subjects and priorities of your emails);
• Stripe (Stripe Payments Europe Limited, Ireland): secure payments, PCI-DSS certified. Receives your email address and customer ID; your card data never passes through our servers;
• Cloudflare: DNS resolution of our domain names; may process the IP address of your DNS resolver.

Your email provider (Google or Microsoft). Google and Microsoft are not our processors. They host your mailbox and calendar under the contract that you, or your organisation, have entered into with them, and process this data under their own responsibility. MyCleark accesses it through their APIs, only with your authorisation and within the limits described in points 10 and 11; the changes it makes there (sorting, categories, labels, calendar events) are recorded with your provider.

• Google: the APIs are provided by Google LLC (United States). For a personal Google account, the controller for the European Economic Area is Google Ireland Limited; for a Google Workspace account, Google processes your data on behalf of your organisation. See Google's privacy policy.
• Microsoft: the Microsoft Graph API is provided by Microsoft Corporation (United States). For a personal Microsoft account (Outlook.com, Hotmail), the controllers are Microsoft Corporation and, for the European Economic Area, Microsoft Ireland Operations Limited; for a work or school Microsoft 365 account, Microsoft processes your data on behalf of your organisation. See the Microsoft privacy statement.

For data held by Google or Microsoft, exercise your rights with them (or, for a work account, with your organisation); for the data MyCleark derives from it, with us (point 7).

If you turn on report forwarding, the reports of the mailboxes you choose are also sent to the address you have designated and confirmed; you can remove it at any time from your dashboard.

Transfers outside the European Union. Stripe, Microsoft and Cloudflare belong to groups established in the United States and may process data there. These transfers are covered by the European Commission adequacy decision on the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795) where the recipient is certified under it, and otherwise by the European Commission standard contractual clauses (Article 46 GDPR). Google LLC and Microsoft Corporation are certified under this framework. Where your mailbox is stored at Google or Microsoft is their responsibility. You can obtain a copy of the applicable safeguards at [email protected].

6. Retention periods

• Account data: until your account is deleted;
• Billing data: 7 years (Belgian accounting obligation);
• OAuth tokens: deleted immediately upon account closure;
• Data from your classified emails (sender, subject, excerpt, category, appointment) and per-sender statistics: as long as the mailbox is connected; deleted when you disconnect it or delete your account;
• Automation execution logs, which may contain the content of the emails processed: rolling 14 days;
• Data sent to Mistral AI: kept by Mistral for the time of processing and, at most, for the period provided by its terms for abuse prevention, then deleted; never used to train its models;
• Technical and security logs (including security events containing the IP address and user agent): rolling 90 days;
• Free trial history: 3 years after the trial ends, including after account deletion (purpose: preventing abuse of successive free trials, legitimate interest);
• History of granted subscriptions: 3 years, including after account deletion (purpose: proof of consented commercial grants and accounting justification, legitimate interest);
• Administrator activity log: 1 year (purpose: traceability of access to your data, security, legitimate interest).

7. Your rights

In accordance with the GDPR and the Belgian law of 30 July 2018 on the protection of personal data, you have the following rights:

• Right of access (Art. 15 GDPR): obtain a copy of your data;
• Right to rectification (Art. 16): correct inaccurate data;
• Right to restriction (Art. 18): ask for the temporary freezing of the use of your data;
• Right to erasure (Art. 17): delete your account and all your data;
• Right to data portability (Art. 20): receive your data in a structured format;
• Right to object (Art. 21): object to certain processing;
• Right to withdraw consent at any time (without affecting prior processing).

To exercise these rights, use the "Delete my account" button in your dashboard, or contact us at [email protected]. Exercising your rights is free of charge. Write to us from the address linked to your account; we only ask for proof of identity where there is reasonable doubt. We respond within one month, extendable by two months for a complex request, in which case we will let you know.

Account data and access to your mailbox are necessary for the contract: without them, the service cannot be provided. The classification of your emails is automated, but it produces no legal effect or similarly significant effect within the meaning of Article 22 GDPR: it sorts and flags your emails, without deleting anything or deciding anything in your place.

You also have the right to lodge a complaint with the Belgian Data Protection Authority (APD), or with any supervisory authority in your country of residence.

8. Cookies and trackers

MyCleark sets only the cookies required for the service to work. No advertising cookies, no analytics tools and no third-party trackers are used; fonts are self-hosted, with no call to an external service.

• Authentication session : keeps you signed in to your account.
• Form and OAuth sign-in security : short-lived state values, a few minutes long, that prevent a third party from hijacking a sign-in in progress.
• Language preference (locale) : set only when you explicitly choose a language on the site, to display the site in that language; kept for six months.
• Sign-up source (signup_src) : remembers the page of the site you come from when you start a sign-up, to know which pages bring in our customers; kept for ten minutes at most and read only once when the account is created.

Because these cookies are strictly necessary for the service you request, or limited to interface personalisation, setting them does not require your prior consent (Article 5(3) of Directive 2002/58/EC). You may delete them at any time from your browser settings; deleting the session cookie will sign you out.

9. Security

We implement appropriate technical and organisational measures to protect your data: encryption in transit (TLS 1.3), encryption at rest, access restricted on a least-privilege basis, encrypted stored OAuth tokens. In the event of a data breach likely to create a risk to your rights, you will be notified within the timeframes set by Article 34 GDPR.

10. Google API Services data (Limited Use)

MyCleark's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google OAuth scopes used and their exclusive purposes:

• gmail.modify: read your emails to classify them with AI, apply priority labels, and generate your daily and weekly digest reports;
• calendar.events.owned: automatically create an event in a calendar you own when an appointment-related email is detected, and check that this event still exists.

This data:

• is used exclusively to provide the service described above, for your personal benefit;
• is never used to develop, improve, or train any generalised or non-personalised AI or machine learning model;
• is never sold or transferred to third parties for advertising or any purpose unrelated to the service;
• is never read by humans, except as required by law, for security, or fraud prevention, with your explicit consent.

You may revoke MyCleark's access to your Google account at any time via myaccount.google.com/permissions.

11. Microsoft API data

For an Outlook.com, Hotmail or Microsoft 365 account, MyCleark requests the following permissions, for these purposes only:

• Mail.ReadWrite: read your emails to classify them with AI, sort them into folders, apply priority categories to them and generate your daily and weekly reports. MyCleark sends no email from your mailbox and only moves to the bin the emails that you explicitly ask it to delete (Space option);
• Calendars.ReadWrite: create an event in your calendar when an appointment-related email is detected, and check that this event still exists. This permission technically gives access to your whole calendar; MyCleark does not read your other events;
• openid, email, profile, offline_access: identify you and keep you signed in without asking for your password again.

This data is used exclusively to provide you with the service. It is never used to train general AI models, never sold or transferred to third parties for advertising purposes, and never read by a human, except as required by law, or for security or fraud prevention with your explicit consent.

You can disconnect your mailbox from your dashboard, which deletes our access tokens, or revoke MyCleark's access at Microsoft: account.live.com/consent/Manage for a personal account, myapps.microsoft.com for a work or school account.

12. People who write to our users

If you write to a MyCleark user, your email may be analysed by our service on behalf of that user, in order to classify it in their mailbox. We then process your name, your email address, the subject and content of your message and, if it announces an appointment, its date, place and title. This data comes from our user's mailbox. It is used only to organise their mailbox; it is not used for any other purpose, not sold, not used to train AI models, and is kept as long as the user's mailbox is connected to MyCleark. We do not inform you individually, which would require disproportionate effort (Article 14(5)(b) GDPR); this section serves in its place. You can exercise your rights at [email protected].

13. Contact

For any questions regarding this policy or your personal data:
[email protected]