Privacy policy

Who is responsible

Teven is provided by Miquel Gomis, tax ID 52768567N, Calle Embajadores, 29, 2.º F, 28012 Madrid, España. For anything about your data, write to support@teven.es.

There are two different roles. For your account data (who you are, your balance, your purchases), Teven is the controller. For the contacts in your spreadsheet, you are the controller: you decide who you write to and why. Teven processes them on your behalf, only to write and send your emails, under the terms of use.

What data we process and why

• Your Google account: the identifier Google gives us and your email address. They tell us it's you; there are no passwords.
• Permission to send from your Gmail: the keys Google gives us, stored encrypted (AES-256). They're used only to send the emails you approve.
• Your balance and purchases: credits, their movements and the Stripe payment reference.
• A record of each send: how many emails, when, how many went out and how many failed, and the statement you make before sending about where your list comes from, with its date. No recipients, no content.
• The contacts in your spreadsheet and the written emails: only while they're being written, reviewed and sent.

We process them under the contract you accept by using Teven and, for purchases, our tax and accounting obligations.

Your spreadsheet and the AI provider

Your file is opened in your browser and is never uploaded whole. But to write each email, some data leaves our server for the AI provider, Anthropic (United States), which processes it and returns the text. This also happens with the first emails you see before paying.

• What is sent: your example email, your corrections and, for each contact, the columns you leave switched on.
• What is not sent: your contacts' email addresses or the columns you switch off.

Teven doesn't keep that data. Anthropic doesn't use it to train its models and deletes it within 30 days, unless its safety system flags a request for breaching its usage policies or the law requires otherwise. The transfer to the United States is covered by the European Commission's standard contractual clauses.

Your Gmail

Teven asks Google for a single email permission, https://www.googleapis.com/auth/gmail.send, which only allows sending. We use it to send, in your name, the emails you've approved, and nothing else. We cannot read, search, change or delete your email.

Because the permission only allows sending, Teven receives nothing from your mailbox, so no data from your Gmail ever reaches the AI provider.

Teven's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't use it for advertising, we don't sell it, we don't pass it to third parties and we don't use it to train AI models.

You can withdraw the permission at any time at myaccount.google.com/permissions. If you do it during a send, the send is paused.

How we protect it

• Everything travels encrypted (HTTPS) between your browser, our server and our providers.
• The keys Google gives us to send from your Gmail are stored encrypted with AES-256-GCM, and the key to decrypt them is not in the database.
• The database is encrypted at rest and every table has access rules: your browser can only read what's yours, and not even that for your Google keys. Sensitive data is only read by our server.
• Only authorised people can access the admin panel, with their Google account, and every page checks it.

How long we keep it

• Before you pay, your campaign lives only in your browser. It's deleted when you finish or start over, and you can delete it yourself from your browser data.
• From payment on, contacts and pending emails are on our server: each email is deleted as soon as it's sent, everything is deleted when the send finishes and, if you abandon the campaign, after 48 hours.
• The text of sent emails and their recipients are never stored. The only copy is in your Sent folder.
• At the AI provider, 30 days at most.
• Your account, balance and send records, while you use Teven. Gmail keys are deleted when you withdraw the permission.
• Purchases, for as long as tax and accounting law requires: up to six years.

Who we share it with

Only with those needed to provide the service, always under contract:

• Supabase: the database, in the European Union (Ireland).
• Vercel: hosting for the website and server, running in the European Union (Ireland).
• Anthropic: writing the emails, as explained above.
• Google: sign-in and sending from your Gmail.
• Resend: the notices Teven sends you, such as the one when a send finishes, from no-reply@teven.es. It only receives your address and the notice text, and processes them in the European Union (Ireland).
• Stripe, through Link: payments. Link sells the credits on our behalf and handles your payment details under its own privacy policy; we never see your card.

Cookies

We only use technical cookies: your session, a ten-minute one for coming back from Google, and your language. Your browser also stores your campaign before you pay and whether you've seen the welcome screen. There's no third-party analytics or advertising, which is why there's no cookie banner. To know whether Teven works, we count, per day, how many times the homepage is loaded, a file is uploaded and the first emails are seen: just those numbers, with no cookies, nothing stored in your browser and no way of knowing who you are.

Your rights

You can ask to access, correct, delete or take away your data, or to object to or restrict its processing, by writing to support@teven.es. We reply within a month. If you're not satisfied, you can complain to the Spanish Data Protection Agency (aepd.es) or to the authority in your country.

If you've received an email sent with Teven, the person who wrote to you is responsible for your data: reply to them. Teven doesn't keep your address.