Privacy Policy

ByeByePromo connects to your Gmail account, with your explicit consent, only to measure where a test email lands in your inbox (for example, the Primary, Promotions, or Updates tab). Our use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• What we access. We request the minimum Gmail scope needed to read message metadata — the labels and headers (such as the subject) of the test messages associated with your account. We use this only to determine which Gmail category a test message was filed under.
• What we do not access. We do not read, store, or process the body of your personal emails through the Gmail API. The email copy that ByeByePromo analyses and rewrites is the content you paste into the app yourself, not content retrieved from your mailbox.
• How we use it. Gmail data is used solely to provide and improve the user-facing inbox-placement feature that is central to the Service.
• No advertising. We do not use Gmail data for advertising of any kind.
• No AI/ML training. We do not use data obtained through Google APIs to develop, improve, or train generalised or non-personalised artificial intelligence or machine-learning models.
• No human reading. We do not allow humans to read your Gmail data, except where you give specific consent, where required for security purposes (such as investigating abuse), to comply with applicable law, or where the data has been aggregated and anonymised for internal operations.
• No selling or unauthorised transfer. We do not sell Gmail data and do not transfer it to third parties except the subprocessors described below that store or process it on our behalf to operate the Service, or as required to comply with applicable law.

You can revoke ByeByePromo’s access to your Google account at any time from your Google Account permissions page or by disconnecting your account within ByeByePromo’s settings.

• Account information. When you sign up, we collect your name and email address through our authentication provider so we can create and secure your account.
• Google account data. With your consent, we store an encrypted Google OAuth refresh token and the email address of the connected Gmail account, and we read the metadata (labels and headers) of test messages as described above.
• Content you provide. The email content you paste into the app for analysis, along with any sending-domain settings, ESP templates, and configuration you create.
• Billing information. If you subscribe to a paid plan, our payment processor collects and processes your payment details. We do not store full card numbers on our servers.
• Usage and technical data. Basic technical information such as log data needed to operate, secure, and debug the Service.

• To provide, operate, and maintain the Service.
• To send test emails and report which Gmail tab they landed in.
• To analyse the email content you paste and generate rewrite suggestions (this uses a third-party AI provider, applied only to the content you submit — never to Gmail data).
• To process payments and manage subscriptions.
• To send you emails about your account and billing (such as receipts, invoices and failed payment notices) and occasional product announcements. Every announcement has a one-click unsubscribe link; unsubscribing does not stop the emails about your account and billing.
• To secure the Service, prevent abuse, and comply with legal obligations.
• To respond to your support requests.

We share data only with the service providers needed to run ByeByePromo. Each acts as a processor on our behalf:

On our public pages (home, sign-in and sign-up, pricing and checkout, and these legal pages) we use Google Analytics, Google Ads and the Meta Pixel to understand how people find and use ByeByePromo and to measure our advertising. They receive your IP address, your browser and device details, the page you are on and the ad you came from. The legal basis is your consent, which you give or refuse in our cookie banner and can withdraw at any time from Cookie preferences. Until you accept, including after you refuse, Google's tags run without cookies or identifiers and send cookieless measurement pings, which still include your IP address. If our cookie banner says so, scrolling the page after the banner appears counts as consent.

None of these tools runs inside the app, where your test results and connected inboxes are shown, and no data obtained through the Gmail API is ever shared with Google Analytics, Google Ads or Meta. Details, cookie by cookie, are in our Cookie Policy.

When you have an account, we store on it your cookie consent choice, with when you made it and against which version of our Cookie Policy. If you accept marketing cookies, we also store your IP address and your browser identification, together with the advertisement identifiers of the visit that brought you and the browser identifier set by Meta; if you accept analytics cookies, the browser identifier set by Google Analytics. We use them to measure which advertising leads to a subscription. This data is kept for as long as your account exists and deleted with it; withdrawing a consent removes the data it allowed (withdrawing marketing consent removes the IP address, the browser identification and the advertisement and Meta identifiers). When you sign up, your consent choice (and, only with marketing consent, the advertisement identifiers) travel with the sign-up form through our authentication provider, Clerk, and that copy is deleted once applied to your account.

We also send conversions from our own servers, only with your consent, so that a subscription you start or pay after you have closed the page is still counted. With marketing consent, Meta receives your account email in hashed form (the email of your ByeByePromo account or the one you give at checkout), your country in hashed form, your IP address, your browser identification, the Meta browser identifier and the advertisement click identifier, and the event (sign-up, trial started, payment) with its value and currency. With analytics consent, Google Analytics receives the Google Analytics browser identifier, our internal account identifier, the event (trial started, payment, renewal, cancellation, refund) with its value and currency, and your consent choice, but no email address and no IP address. Google Ads conversions come only from the browser tag: with marketing consent, Google Ads receives the sign-up conversion with its event identifier and, on the page shown after checkout, the trial or payment conversion with its event identifier and value, together with your account email, hashed by Google's tag in your browser before it is sent (Enhanced Conversions). The event identifiers sent to Meta and Google contain internal references: our account identifier for a sign-up, and the Stripe checkout or invoice reference for a trial or a payment. Until sent, these events wait in a queue on our servers, deleted 30 days after sending (90 days if sending failed) and with your account. Withdrawing consent stops further sends and removes the copies still waiting in the queue; it cannot recall what was already sent. Nothing obtained through the Gmail API is ever included.

We keep your data for as long as your account is active or as needed to provide the Service. You can disconnect your Google account at any time, which deletes the stored OAuth token. When you delete your account, we delete or anonymise your personal data within a reasonable period, except where we are required to retain it to comply with legal obligations.

We use industry-standard safeguards to protect your information. Google OAuth tokens are encrypted at rest, data is transmitted over TLS, and access to production systems is restricted. No method of transmission or storage is completely secure, but we work to protect your data and to limit access to it.

Depending on your location, you may have the right to access, correct, export, or delete your personal data, to restrict or object to certain processing, and to withdraw consent. Under the EU/UK GDPR, you also have the right to lodge a complaint with your local data protection authority. To exercise any of these rights, contact us at hello@byebyepromo.com.

You can disconnect your Gmail account from within ByeByePromo’s settings or at your Google Account permissions page. To delete your entire account and associated data, email us at hello@byebyepromo.com and we will process your request.

Our service providers may process data in countries outside your own, including the United States. Where required, we rely on appropriate safeguards (such as the European Commission’s Standard Contractual Clauses) for these transfers.

The Service is not directed to children under 16, and we do not knowingly collect personal data from them.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, notify you.

If you have any questions about this Privacy Policy or how we handle your data, contact us at:

Sefirot Srl
Via Vittorio Amedeo Cignaroli 8, 10152 Turin, Italy
VAT: IT11963260010
hello@byebyepromo.com(product & privacy requests)
info@sefirot.it (company)