Privacy policy

TOO YOU CONSULT & GO, a French simplified joint-stock company (SAS) with a share capital of 500 €, registered with the RCS Soissons 108 067 133, whose registered office is at 1 rue de la Haie au Cours, 02400 Château-Thierry, France. Contact: serenbox@proton.me.

Serenbox never reads, stores or shares:

• the content (body) of your emails;
• your attachments;
• your passwords: you sign in through Google, which never shares them with us.

To provide the service, Serenbox processes:

• Your account: email address, name and identifier provided by Google when you sign in, and your preferences (language, weekly summary).
• Your email headers: sender, recipients of emails you sent, date, subject, Gmail category, read/unread status and unsubscribe information. They are read to compute statistics; subjects and unsubscribe links are not stored.
• Statistics per sender: number of emails, unread emails, frequency, sorting suggestion.
• Your sorting choices (Spam, Important, Priority) and clean-up history.
• Technical identifiers of the emails Serenbox changed (opaque identifiers, no content), only so a clean-up can be undone.
• A Google access token (refresh token), encrypted (AES-256-GCM), to act on your inbox when you're not using the app.
• A security log (sign-ins, deletions, exports), with no email content.
• The feedback you send with “Give feedback” (category, rating, message, screen concerned), to improve the service.
• If you sign up for the beta on the home page: your email address, the site language and an encrypted fingerprint (HMAC) of your IP address, used only to block abusive sign-ups. The address is only used to invite you to the beta.

Serenbox's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice, your mailbox data is used only for the sorting you ask for. It is never sold, never used for advertising, never used to train artificial intelligence models, and never read by a human, except with your explicit consent, for security reasons or to comply with the law.

• Providing the service (analysis, sorting, clean-up, undo, filters, unsubscribing): performance of a contract (GDPR art. 6.1.b).
• Securing the service and preventing abuse (security log): legitimate interest (art. 6.1.f).
• Meeting legal obligations (invoicing, lawful requests): legal obligation (art. 6.1.c).

Your data is never sold or rented. It is processed only by:

• Vercel Inc.: website hosting, servers in the Paris region.
• Supabase Inc.: database, hosted in the European Union.
• Resend (Plus Five Five, Inc.): sending beta-related emails (email address and message content only), from the European Union.
• Google LLC: sign-in and access to your Gmail inbox, according to the permissions you grant.

Vercel, Supabase and Resend are US companies. Data is hosted in the European Union; access from the United States remains possible for maintenance. Such transfers are covered by the EU-US Data Privacy Framework and/or the European Commission's standard contractual clauses.

• Account, statistics, sorting choices and history: as long as your account is active; fully and immediately erased when you delete your account.
• Identifiers of changed emails: 30 days at most, the period during which a clean-up can be undone.
• Security log: 12 months, then deleted; it is detached from your account as soon as the account is deleted.
• “Give feedback” messages: 12 months, and deleted with your account.
• Beta sign-ups: until the end of the beta, and 12 months at most. You can ask for deletion at any time by email.

Serenbox only uses strictly necessary cookies: sign-in session and Google sign-in security. No advertising or third-party analytics cookies, so no consent is required.

Encrypted connections (HTTPS), Google token encrypted in the database, data access restricted to each user (row-level access rules), minimal Google permissions: Serenbox never asks for permission to permanently delete your emails.

You have the right to access, rectify, erase, restrict, object to and port your data. From Settings: export your sorting rules (portability) and delete your account (erasure). For any other request: serenbox@proton.me. We reply within one month.

You can also remove Serenbox's access to your Google account at any time at https://myaccount.google.com/permissions.

If you disagree with how we handle your request, you can contact the French data protection authority (CNIL, www.cnil.fr) or your local authority.

The service is intended for people aged 15 and over.

This policy may change. If there is a significant change, you'll be informed in the app or by email.