a. Gmail Data (Read-Only Access with Attachments)

• Alona requests read-only permission to your Gmail account via Google OAuth (https://www.googleapis.com/auth/gmail.readonly).

• This scope allows us to view the following without modification:

  • Email metadata (e.g., subject lines, sender/recipient addresses, timestamps, labels).

  • Email message bodies (full text content).

  • Email attachments (e.g., PDFs, invoices, receipts) — only when necessary to identify subscription or billing details.

• Attachments are accessed only if:

  • The email is flagged as potentially related to a recurring payment (e.g., contains keywords like "invoice", "subscription", "receipt").

  • The attachment type is supported (e.g., PDF, text, image) and under 5 MB.

• We do NOT:

  • Send emails on your behalf.

  • Modify, delete, or move your emails or attachments.

  • Access or store your email passwords.

  • Download or retain attachments beyond temporary analysis (see Section 3).

b. Bank Transaction Data (PSD2 Access)

• Alona connects to your bank accounts via PSD2 APIs as an Account Information Service Provider (AISP).

• With your explicit consent (via Strong Customer Authentication - SCA), we access:

  • Transaction history (dates, amounts, payees, descriptions).

  • Account balances and identifiers needed to detect recurring payments.

• We do NOT:

  • Initiate payments or transfers.

  • Access full account or card numbers beyond PSD2-permitted identifiers.

  • Store login credentials.

c. Account Information

• Google sign-in: Your email address, display name, and unique user ID.

• Bank connection: Masked account identifiers and institution name.

• Consent logs for data access and negotiation actions.

d. Usage & Device Data

• Anonymized analytics (features used, session length).

• Device info (browser, OS, IP) for security and debugging.