Privacy Policy

1. Data controller

The data controller is the publisher of MyCleark, domiciled in Belgium. Data protection contact: [email protected].

2. Data collected

We collect and process the following data:

• Account data: name, email address, profile picture (provided by Google upon login);
• Connection data: Google OAuth access tokens (Gmail, Calendar) necessary for the service;
• Billing data: Stripe customer ID and subscription (no payment card data is stored on our servers);
• Usage metadata: activation date, subscription status, interface preferences;
• GDPR consent: date and time of your acceptance of these terms.

We do not access the content of your emails for commercial analysis or profiling purposes. The automated processing of your emails is performed by your personal AI assistant, operating exclusively within the European infrastructure described below.

3. Hosting and data sovereignty

4. Purposes and legal bases

5. Sub-processors and transfers

We use the following sub-processors:

• PostgreSQL (self-hosted) : database hosted on our own servers in a data centre located in Germany (EU);
• n8n (self-hosted) : workflow automation engine hosted on our own servers in the same data centre in Germany (EU);
• Stripe, Inc. (USA) : secure payments, PCI-DSS certified, covered by standard contractual clauses (SCC) compliant with GDPR;
• Google LLC (USA) : OAuth authentication and Gmail/Calendar API, subject to the Google Workspace GDPR agreement and SCCs.

For transfers to the United States (Stripe, Google), appropriate safeguards under Article 46 GDPR are in place (European Commission standard contractual clauses).

6. Retention periods

• Account data: retained for the duration of the subscription + 30 days after cancellation;
• Billing data: 7 years (Belgian accounting obligation);
• OAuth tokens: deleted immediately upon account closure;
• Technical logs: rolling 90 days.

7. Your rights

In accordance with the GDPR and the Belgian law of 30 July 2018 on the protection of personal data, you have the following rights:

• Right of access (Art. 15 GDPR): obtain a copy of your data;
• Right to rectification (Art. 16): correct inaccurate data;
• Right to erasure (Art. 17): delete your account and all your data;
• Right to data portability (Art. 20): receive your data in a structured format;
• Right to object (Art. 21): object to certain processing;
• Right to withdraw consent at any time (without affecting prior processing).

To exercise these rights, use the "Delete my account" button in your dashboard, or contact us at [email protected]. We respond within a maximum of 30 days.

You also have the right to lodge a complaint with the Belgian Data Protection Authority (APD), or with any supervisory authority in your country of residence.

8. Cookies and trackers

MyCleark uses only strictly necessary cookies for service operation (authentication session, interface theme preference). No third-party advertising or analytics cookies are set.

9. Security

We implement appropriate technical and organisational measures to protect your data: encryption in transit (TLS 1.3), encryption at rest, access restricted on a least-privilege basis, encrypted stored OAuth tokens. In the event of a data breach likely to create a risk to your rights, you will be notified within the timeframes set by Article 34 GDPR.

10. Google API Services data (Limited Use)

MyCleark's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google OAuth scopes used and their exclusive purposes:

• gmail.modify: read your emails to classify them with AI, apply priority labels, and generate your daily and weekly digest reports;
• calendar.events.owned: read events from your calendars to contextualise the classification of appointment-related emails, and automatically create an event when an appointment-related email is detected, limited to calendars you own.

This data:

• is used exclusively to provide the service described above, for your personal benefit;
• is never used to develop, improve, or train any generalised or non-personalised AI or machine learning model;
• is never sold or transferred to third parties for advertising or any purpose unrelated to the service;
• is never read by humans, except as required by law, for security, or fraud prevention, with your explicit consent.

You may revoke MyCleark's access to your Google account at any time via myaccount.google.com/permissions.

11. Contact

For any questions regarding this policy or your personal data:
[email protected]