ARG168 Privacy Policy

Effective date: September 1, 2026

This Privacy Policy explains how ARG168 Mail Transaction ("ARG168", "the application", "we") accesses, uses, stores and shares information when a user connects a Google Account and uses the Gmail transaction-monitoring feature.

1. Google data we access

After the user explicitly authorizes the application, ARG168 may access the following Google user data:

• Basic Google Account information needed to identify the authorized account, including the account email address and basic profile identifiers.
• Gmail data under the Gmail read-only permission, including message identifiers, sender, subject, timestamps, labels, snippets and message body content needed to identify and parse supported transaction-notification emails.
• Gmail mailbox/history identifiers needed to operate Gmail push notifications and detect newly received messages.

Although the Gmail read-only permission is presented by Google as permission to view email messages and settings, ARG168 uses this access for read-only transaction-notification processing. The application does not send email and does not modify, move or delete Gmail messages or mailbox settings.

2. Why we use Google user data

Google user data is used only to provide and maintain user-facing features requested by the user, including:

• Detecting supported payment/transaction notification messages, including Cuenta DNI / Red Link notifications.
• Extracting transaction fields such as payment amount, transaction time, customer name, DNI, merchant, operation number, authorization/status and related payment details.
• Providing real-time payment alerts, voice notifications, transaction history and statistics.
• Maintaining the Gmail connection, preventing duplicate processing and troubleshooting service failures.

ARG168 does not use Google user data for advertising, ad targeting, marketing profiles, credit decisions, or sale of personal data.

3. Data processing and storage

ARG168 uses Cloudflare infrastructure to host the Gmail integration service. The service may store:

• An encrypted Google OAuth refresh token so the user does not need to authorize again on every request.
• A connection identifier and hashed client API keys used to authenticate the user's ARG168 browser/client.
• Gmail Watch/history state required for near-real-time Gmail notifications.
• Message metadata and body text processed from new inbox messages so the service can determine whether a message is a supported transaction notification.
• Parsed transaction records used for the user's payment history, alerts and statistics.

Refresh tokens are encrypted before storage. Client API keys are stored as cryptographic hashes. Network requests use HTTPS.

4. Sharing and disclosure

ARG168 does not sell Google user data and does not share it with advertisers or data brokers. Data is processed by service infrastructure providers, including Google (Gmail/OAuth) and Cloudflare (hosting, execution and storage), only as necessary to operate the application.

We may disclose information only when required by applicable law, to address security or abuse, or when the user explicitly requests or authorizes the disclosure.

5. Human access

ARG168 is designed for automated processing. Human access to Google user data is not used for advertising or marketing. Human access is limited to cases where it is necessary to provide user-requested support, investigate security/abuse, comply with applicable law, or maintain the service under conditions permitted by the Google API Services User Data Policy.

6. Retention and deletion

Connection credentials and processed Gmail/transaction data may be retained while the Gmail connection remains active and as needed to provide transaction history and operate the service. Revoking Google access stops future access by the application, but previously processed records may remain in service storage until they are deleted.

Users can revoke ARG168's Google access at any time from their Google Account's third-party connections page. For deletion of server-side ARG168 data, users may request deletion using the developer/support contact shown on the Google OAuth consent screen. After a verified deletion request, associated stored Gmail connection data and processed transaction records will be removed, subject to any limited retention required by law or security obligations.

7. User choices and control

• Google authorization is optional and requires an explicit user action.
• Users can revoke access from their Google Account at any time.
• Users can clear locally stored ARG168 connection credentials from the application.
• Users may request deletion of server-side data as described above.

8. Security

ARG168 uses reasonable technical safeguards including HTTPS, encrypted OAuth refresh-token storage, hashed API keys and access controls. No internet service can guarantee absolute security, so users should also protect their Google Account and device credentials.

9. Google API Services User Data Policy / Limited Use

ARG168's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

10. Changes to this policy

If ARG168 changes how Google user data is accessed, used, stored or shared, this Privacy Policy will be updated before the changed practice is used where required. The effective date at the top of this page identifies the current version.

11. Contact

For privacy questions, account-data deletion requests or support, use the developer/support contact shown on the ARG168 Google OAuth consent screen.

This policy applies to the Google/Gmail integration provided through ARG168 and the public OAuth service hosted at https://ggyz.arg168.com.