Privacy Policy
Last updated: 23 August 2026
DataMadeClean ("we", "us", "this service") is a data-cleaning tool: you upload a spreadsheet (or connect a Google Sheet), we detect and fix common data-quality problems, and you get the cleaned result back. This page explains what we collect, why, how long we keep it, and what rights you have over it.
This policy describes only behaviour that's actually implemented in the product today - nothing here is aspirational.
What we collect, and why
| Data | Why |
|---|---|
| Account email address | Only if you create an account. An account is entirely optional - the tool works fully anonymously, including for a paid Professional-tier file purchase. Creating an account only saves your cleaning preferences and lets you revisit past uploads. |
| Password | Only for account holders. Stored as a salted PBKDF2-HMAC-SHA256 hash (600,000 iterations) - we never store, log, or have access to your actual password. |
| The file(s) you upload, or the Google Sheet you connect | To clean them, and to show you a report of what changed. This routinely includes personal data about other people - your own customers' or contacts' names, emails, phone numbers, and addresses - not just your own. We only process this data to perform the cleaning you asked for; we don't use it for any other purpose, and we don't sell it. |
| IP address | Collected incidentally, to enforce upload rate limits and prevent abuse. Not linked to your account or stored long-term beyond what the rate limiter itself needs. |
| Google account access (only if you connect it) | If you choose to connect a Google account to clean a
private Google Sheet, we request only the narrow
drive.file permission - access to the
specific file(s) you explicitly select via Google's own
file picker, never blanket access to your Drive. Your
OAuth tokens are encrypted at rest and used only to fetch
the sheet(s) you've selected. |
How long we keep it
- Anonymous uploads (no account): deleted automatically 1 hour after processing.
- Account holders: you choose - 1 day, 30 days, or (on a paid plan) indefinitely - in your account settings. This applies retroactively to files you've already uploaded, not just future ones.
- You can delete any of your uploads immediately at any time, or delete everything at once, from "My uploads" - this is the only way to remove a file set to indefinite retention.
- If you connected a Google account, disconnecting it (from your account settings) deletes the stored access tokens immediately and revokes them with Google.
Third parties
We use a small number of third-party services to run DataMadeClean. Each only sees the minimum it needs to do its job:
- Stripe - payment processing, for a paid plan or a one-time Professional-tier purchase. Stripe sees your email address and payment details; we never see or store your card details ourselves.
- Resend - sends account-related emails (e.g. password reset). Sees your email address and the content of those emails.
- Google - only if you choose to connect a Google account to clean a private Google Sheet (see above). Google's own privacy policy governs how they handle your Google account data.
None of these third parties are permitted to use your data for their own purposes beyond providing the service we use them for.
Security
- Passwords are hashed, never stored in plain text.
- Google OAuth tokens are encrypted at rest.
- Uploaded file data is not yet encrypted at rest on our servers - this is an area we're actively improving (the planned fix is host-level disk encryption, which most managed hosting providers offer with no extra effort). We're stating this plainly rather than overstating our current security posture.
- Traffic to this site is encrypted in transit (HTTPS) once deployed to production.
Your rights
You can access, download, and delete your uploaded files at any time via "My uploads" (see Retention above). Full account deletion (removing your account and email address entirely, not just your uploaded files) isn't available yet as a self-service action - contact us (below) and we'll action it manually in the meantime.
DataMadeClean is an Australian-based service and follows the Australian Privacy Principles (APPs). If you're located outside Australia, please contact us before using this service with data subject to other privacy laws (e.g. the EU's GDPR), as we don't currently make specific representations about compliance with those frameworks.
Changes to this policy
If we make a material change to how we collect or use data, we'll update this page and change the "Last updated" date above.
Contact us
Questions about this policy, or a request relating to your data (including full account deletion)? Email [email protected].
A privacy request sent here is treated as a privacy request whichever address it arrives at - there is no separate queue it needs to reach.