Decipher OSDecipher OSBack to home

Legal

Privacy Policy

Last updated: August 7, 2026

Decipher OS (the "Service") is operated by Cloudsheer Consulting ("Cloudsheer," "we," "us," or "our"), based in Brooklyn, New York. This Privacy Policy explains what information the Service collects, how and why we use, share, store, and protect it, the legal bases we rely on, and the rights and choices you have. It applies to everyone who signs in to and uses the Service.

By signing in to or using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

Permission-based use

Decipher OS is for permission-based email only. You supply your own recipient lists and are responsible for having a lawful basis and the recipient's consent to contact them. Before each campaign you must confirm that every recipient has consented to receive commercial email from you, and every message we send includes a one-click unsubscribe and a visible unsubscribe link so recipients can opt out at any time.

Our role: controller and processor

For the account information you give us directly (your name, email, and login), Cloudsheer is the data controller. For the recipient and campaign data you bring into the Service - your contact lists and the personal data in your Google Sheet and mailbox - you are the controller, and Cloudsheer acts as your processor, handling that data only on your instructions to provide the Service. You are responsible for the lawful basis to process your recipients' data and for responding to their requests.

Information we collect

We collect only the information needed to run the permission-based email campaigns you configure.

  • Account information. When you sign in with Google, we receive your name, email address, and profile picture from your Google account. When you sign in with email and password, we store your email address and a securely hashed version of your password.
  • Google Drive / Sheets data. For the specific spreadsheet you select through the Google file picker, we read the rows and columns you choose (for example recipient names, email addresses, and any fields you use to personalize messages), and we may write campaign status back into that same spreadsheet. We access only the file you explicitly select - never your other Google Drive files.
  • Gmail data. With your permission, we send the campaign emails you compose through your own Gmail account, and we read message metadata and content in your mailbox solely to detect replies and bounces to those campaigns. When a reply is detected, its subject and text are analyzed to categorize the reply's intent (for example "interested," "meeting request," or "unsubscribe") so we can show you reply segmentation and analytics. See "How we share information" below for the AI provider involved in this step.
  • Campaign data. We store the campaigns you create, including subject lines, message templates, recipient lists, consent confirmations, schedules, and delivery results such as sends, opens, clicks, replies, bounces, and unsubscribes.
  • Technical and usage data. Like most web services, our infrastructure automatically logs basic technical data such as IP address, browser type, and timestamps for security and reliability. We use a strictly necessary session cookie to keep you signed in.

How we use Google user data

The Service requests the following Google API scopes, each for a single, clearly defined purpose, and uses the data only to provide the corresponding user-facing feature:

  • Google Drive - per file (drive.file). To read the recipient and personalization data from the specific spreadsheet you select through the Google file picker, and to write campaign status back to it. This scope limits our access to only the files you choose, not your entire Drive.
  • Gmail send (gmail.send). To send the campaign emails you create from your own Gmail account, so they come from your real address.
  • Gmail read (gmail.readonly). To detect when a recipient replies or a message bounces (so the Service can stop following up), to let you read replies in the app, and to categorize each reply's intent for your campaign analytics and reply segmentation.

We do not sell your data, and we do not use your data - including your Gmail content, replies, and Google Sheet data - for advertising or to train AI or machine-learning models. The AI reply categorization described above is used only to label the intent of your own replies for your analytics; it does not train any model on your data. No human at Cloudsheer reads your Gmail content except where necessary for security, to comply with the law, or with your explicit consent (for example, when you contact support).

Legal bases for processing

Where data-protection laws such as the GDPR apply, we rely on the following legal bases: performance of a contract (to provide the Service you sign up for); legitimate interests (to secure, maintain, and improve the Service and prevent abuse, balanced against your rights); consent (which you may withdraw at any time by revoking Google access or deleting your account); and legal obligation (to comply with applicable law). Where you act as controller of your recipients' data, you are responsible for establishing your own legal basis to process it.

Limited Use disclosure

Decipher OS's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We only transfer Google user data to others where necessary to provide or improve the Service, to comply with the law, or as part of the safeguards described below.

How we share information

We do not sell your personal information or your Google user data. We share data only in these limited cases:

  • Service providers (sub-processors). We use trusted providers to run the Service: Vercel (application hosting), Neon (database hosting), and Anthropic (AI processing). Anthropic's Claude models process the subject and text of detected replies solely to categorize each reply's intent for your analytics; this content is processed transiently on our behalf and is not used to train models, not sold, and not used for advertising. All these providers process data only on our instructions and only to operate the Service.
  • Google APIs. Sending email and reading sheet and mailbox data necessarily involves Google's own services, which process that data under Google's terms.
  • Legal and safety. We may disclose information if required by law, regulation, or valid legal process, or to protect the rights, safety, and security of Cloudsheer, our users, or the public.
  • Business transfers. If Cloudsheer is involved in a merger, acquisition, or sale of assets, data may be transferred as part of that transaction, subject to this Privacy Policy.

How we store and protect your data

Data is stored in a managed PostgreSQL database and transmitted over encrypted (HTTPS/TLS) connections; our providers encrypt data at rest. Access tokens, refresh tokens, and password hashes are stored only as needed to operate the Service, are never displayed back to you, and are never shared. We apply the principle of least privilege and limit access to the people and systems that need it to provide and maintain the Service. No method of transmission or storage is completely secure, but we work to protect your data using appropriate technical and organizational measures.

International data transfers

We and our providers are based in, or process data in, the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States and other countries where our providers operate, which may have different data-protection laws. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for these transfers.

Cookies and similar technologies

We use a strictly necessary session cookie to authenticate you and keep you signed in. We do not use advertising or cross-site tracking cookies, and we do not sell information for advertising.

Data retention and deletion

We retain your data for as long as your account is active or as needed to provide the Service, and then delete or anonymize it, except where we are required to keep it to comply with the law, resolve disputes, or enforce our agreements. You can:

  • Revoke access to your Google account at any time from your Google account permissions page. Once revoked, the Service can no longer access your Google data.
  • Request deletion of your account and associated data by emailing us at tools@cloudsheer.com. We will delete your stored data within 30 days, except where we are required to retain it by law.

Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or receive a portable copy of your personal data, to object to or restrict certain processing, and to withdraw consent. Under US state laws such as the CCPA/CPRA, you have the right to know, delete, and correct your personal information and not to be discriminated against for exercising those rights; we do not sell or share personal information for cross-context behavioral advertising. To exercise any right, contact us at tools@cloudsheer.com; we may need to verify your identity. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data-protection authority.

Children's privacy

The Service is intended for business use and is not directed to children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above, and significant changes will be communicated through the Service or by email where appropriate.

Contact us

If you have any questions about this Privacy Policy or how we handle your data, or to exercise your rights, contact the data controller, Cloudsheer Consulting, at tools@cloudsheer.com.