Your privacy deserves white glove care.

Last draft revision: 10 November 2026. This policy must be legally reviewed and completed with the operating company's details, privacy contact, subprocessor information, international transfer safeguards, and verified retention periods before public launch.

Who operates CloudMaid?

The legal controller identity, registration address, and privacy contact must be published before accepting public customer data. Until then this page is a draft and the service should not be presented as production ready.

What we access

After your explicit Google authorization, CloudMaid requests permission to view and manage Google Drive files. It indexes metadata such as filename, file type, file size, timestamps, sharing principal identifiers, permissions, ownership, and limited Drive links. It does not download file contents as part of the primary scan. An encrypted Google refresh token is stored so you can continue using the service until you disconnect.

Why access is broad

Scanning all accessible files and revoking direct sharing permissions require the restricted Google Drive scope. Google's verification and any required security assessment must be completed before opening this service to the public. We do not use Google Drive data for advertising or training general purpose models.

Optional AI advice

MaidMind is off by default. When you enable it and request an explanation for a particular file, the system sends a minimized structured summary of selected metadata signals to an AI provider, not the filename, file content, Google file ID, links, or collaborator email addresses. The application requests that provider not to store response data, but the provider's current processing and retention terms must be disclosed in the final policy. AI never executes cleanup.

Payments and fraud prevention

If paid subscriptions are enabled, a payment provider processes purchase and billing information. CloudMaid stores subscription identifiers and entitlement records, not payment card details. Server side operational logs may contain connection metadata and security events. Final retention periods and subprocessor locations must be confirmed.

Your choices and rights

You can disconnect Google accounts, turn AI assistance off, revoke CloudMaid in Google Account security settings, and request account deletion. The application has a self service account deletion flow, subject to cancellation of active paid subscriptions. Local index records are removed by that flow; operational backup retention requires published limits and verification. Applicable privacy law may grant access, correction, deletion, portability, and objection rights.

How we protect information

Production configuration requires encrypted refresh tokens, HTTPS, signed secure sessions, CSRF checks and revalidation before cleanup actions. Security architecture is not a substitute for an external penetration test, vulnerability management, incident response, access reviews, and required Google audit approvals.

Contact and complaints

Privacy contact: TO BE PROVIDED BEFORE LAUNCH. Where GDPR applies, you can also contact the relevant supervisory authority.