Privacy Policy

Bundlwise ("Bundlwise", "we", "us") helps you find, track and manage your software subscriptions. This policy explains what data we collect, how we use it, where it is stored, who it is shared with, and the choices you have. It applies to bundlwise.com and app.bundlwise.com. Questions: hello@bundlwise.com.

I. Information we collect

• Account information — your email address, name and profile picture when you create an account or sign in with Google.
• Google user data (Gmail) — if you choose to connect your Google account, we access your Gmail with the read-only scope described in the next section.
• Usage data — basic technical logs (IP address, browser type, pages visited) used to operate and secure the service.

II. Google user data

Connecting Google is optional. If you connect it, this is exactly what happens:

What we access

• Gmail messages via the read-only scope (gmail.readonly): the subject line, sender and message body content. We never send, modify, delete or label your email.
• Basic profile information (email address, name, profile picture) to create your account.

How we use it

Solely to detect subscriptions, free trials, receipts and renewal notices in your inbox and show them to you in your own dashboard. We do not use this data for advertising, and we do not sell it to anyone.

How we store it

• Data is stored in Google Cloud Firestore (Google Cloud Platform).
• Your Google access and refresh tokens are encrypted at rest.
• For emails identified as subscription-related, we persist the subject, sender and a short excerpt of the message body (the first few hundred characters) needed to display and verify the subscription in your dashboard.

Who we share it with

To classify whether an email is a subscription receipt or renewal — a user-facing feature of Bundlwise — the subject, sender and the relevant portion of the message body (up to roughly the first few thousand characters) are sent to a third-party AI provider (currently OpenAI) via its API, strictly as a data processor. The provider is contractually bound not to use this data to train its models and not to retain it beyond what is needed to return a result. We do not transfer Google user data to any other third party, we do not use it for advertising, and no humans read it except (a) with your explicit consent, (b) for security and abuse investigations, or (c) where required by law.

Limited Use disclosure

Bundlwise's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Retention and deletion

• We keep Google user data only while your Google account is connected to Bundlwise.
• When you disconnect Google (or ask us to delete your data), we revoke our access token with Google, delete stored tokens immediately, and delete stored email-derived data within 30 days.
• You can disconnect at any time from your dashboard settings, or by emailing hello@bundlwise.com.

Revoking access

You can revoke Bundlwise's access to your Google account at any time from your dashboard ("Disconnect Google") or directly in your Google Account settings at myaccount.google.com/permissions.

III. Security

All traffic is served over HTTPS. OAuth tokens are encrypted at rest, secrets are managed with Google Cloud Secret Manager, and access to production systems is restricted. No method of transmission or storage is 100% secure, but we work to protect your data using industry practices.

IV. Your rights

You may request access to, correction of, or deletion of your personal data at any time by emailing hello@bundlwise.com. If you are in a jurisdiction with specific data-protection rights (e.g. GDPR), we honour those rights.

V. Children

Bundlwise is not directed at children under 13, and we do not knowingly collect their data.

VI. Changes to this policy

We may update this policy from time to time. Material changes will be announced on this page with an updated "Last updated" date.

VII. Contact

Bundlwise — hello@bundlwise.com