Privacy Policy

Datashop Ltd is the data controller for your personal data.

Address: Station F, 5 Parvis Alan Turing, 75013 Paris, France

Email: privacy@datashop.xyz

• Scope we request: https://www.googleapis.com/auth/gmail.readonly — only when you click Connect Gmail.
• What we process:
• Always: message headers (From, Subject, Date).
• Sometimes (only if necessary): short, redacted text snippets to detect signals.
• What we store: Derived aggregates only (no message bodies).
• Your controls: Disconnect Gmail, Export, and Delete my data in-app (you can also disconnect from Google Account → Security).

• Data minimisation: headers-first; fetch minimal text only when needed to detect signals.
• Ephemeral handling: any text we read is processed in memory and not stored; we keep only derived results.
• Processing modes:
• Default: local processing on our servers.
• Optional (off by default): short, redacted snippets may be sent to a trusted AI processor (e.g., Google Gemini API or Microsoft Azure OpenAI) strictly to detect signals for your Data Value. If enabled, we disclose this clearly in-product. Providers do not train foundation models on your content under their terms.

We share data only with:

• Hosting & infrastructure: Vercel (hosting), Supabase (database), and similar providers needed to run Datashop.
• Optional AI processor (only if enabled): receives redacted snippets (≤ ~1,500 chars) strictly to detect signals for your Data Value.
• Compliance/security: when required by law or to protect rights.

We keep an up-to-date list of vendors at /en/sub-processors.

If you opt into offers or choose to share information with third parties, we enable that using non-Google sources (e.g., data you upload or connect that wasn't obtained via Google's APIs) or in ways that do not involve Gmail-sourced/derived data. Gmail-sourced/derived data stays purpose-limited to providing your Data Value and related in-product features.

• Session cookies: typically 7 days.
• Derived aggregates & your export files: user-controlled; deleted when you click Delete my data or after 12 months of inactivity.
• Security logs (no content): typically 30 days.

Minimal records may be retained to comply with legal obligations or resolve disputes.

You can Access, Port, Delete, Rectify, Object/Restrict, and Withdraw consent at any time (withdrawal affects future processing).

How: use in-app controls (Disconnect, Export, Delete) or email contact@datashop.xyz.

You can also complain to your local supervisory authority (e.g., ICO in the UK or your EU authority).

Your data may be processed outside your country. Where applicable, we rely on safeguards such as Standard Contractual Clauses. Ask us for details at contact@datashop.xyz.

We'll post updates here with a new effective date. For material changes, we may also notify you in-app or by email.