1. Data Controller

CleanMyCSV is published and operated by CleanMyCSV. As the data controller, we are fully committed to ensuring that the collection and processing of your data comply with GDPR and relevant privacy laws.

2. Data Retention & Lifecycle

We enforce a strict retention policy to guarantee your privacy:

• Ephemeral Processing: Your files are processed entirely in-memory on our Cloud Run instances.
• Secure Access: Generated download links (Signed URLs) automatically expire after 15 minutes.
• Permanent Deletion: Files temporarily stored in our secure buckets are automatically wiped within 24 hours via strict automated lifecycle rules.

3. Third-Party Services & Security

To provide a seamless experience, CleanMyCSV relies on trusted industry-leading partners:

• Stripe: Your payment data is securely processed exclusively by Stripe. CleanMyCSV never touches or stores your credit card numbers (PCI-DSS compliant).
• Vercel Analytics and Umami Cloud: We measure website traffic using anonymized data. No personally identifiable information (PII) is ever collected through this tool.
• Google Cloud Storage: Your files are strictly isolated in private, encrypted storage buckets.

4. Export Security & CSV Injection

Our algorithm actively neutralizes potentially malicious formulas (CSV Injection) by sanitizing suspicious characters during the normalization process. This protects your local machine when opening the output file in Excel or Google Sheets.

5. Infrastructure Security

Our servers are equipped with advanced firewalls that automatically block standard web vulnerabilities (such as XSS and Clickjacking) and limit the number of requests to prevent brute-force attacks and ensure maximum uptime for all users.