Privacy Policy

Last updated: September 16, 2026

1. What SaaSClerk does

SaaSClerk connects to your email inbox with read-only access and scans your past 12 months of billing-related emails (invoices, receipts, renewal notices) to build a structured inventory of your SaaS subscriptions. We never send email on your behalf, we never delete anything, and we cannot read or change anything outside the scope you authorize.

2. What we collect

  • Account data: your email address and name (via email/password or Google sign-in).
  • Subscription records: tool name, price, billing cycle, renewal date, and vendor email extracted from billing emails.
  • Email access credential: either an OAuth token (read-only scope) or an IMAP authorization code, stored encrypted with AES-256.

We do not store the content of your emails. Email bodies are processed in memory during a scan and discarded. We do not sell, rent, or share your data with advertisers or data brokers — ever.

3. How access works

For Gmail, we request the gmail.readonly OAuth scope only. For IMAP providers (QQ Mail, 163, Outlook, custom), we store an authorization code — never your mailbox login password. You can revoke access at any time from your email provider's security settings or by deleting your SaaSClerk account.

4. Third-party processors

  • Neon — encrypted PostgreSQL database hosting (US region).
  • Vercel — application hosting.
  • Resend — transactional email delivery (verification and renewal reminders only).
  • Cloudflare — bot protection and security.
  • Waffo — payment processing. We never see or store your card details.
  • Google — sign-in and Gmail read-only access, governed by Google's own policies.

5. Data retention & deletion

Subscription records and encrypted credentials are kept while your account is active. Deleting your account removes your user record, credentials, and subscription inventory from our production database. You can also disconnect your mailbox at any time without deleting your account.

6. Your rights

You may request access to, correction of, or deletion of your personal data at any time. We honor GDPR and CCPA requests within 30 days.

7. Contact

Questions about this policy? Join our Discord community or open a GitHub issue. See also our Security · Terms of Service.