1. Application identity and consent · 服务范围与授权
Scapice Account Assistant is operated by the Scapice Portal administrator for users authorized to maintain their own SHEIN accounts. It is not an official Google or SHEIN product. Users initiate account-update tasks and may stop them, use manual mode or disconnect Gmail. Gmail access starts only after affirmative Google OAuth consent.
The only requested Gmail scope is https://www.googleapis.com/auth/gmail.readonly. This scope technically permits mailbox-wide read access; Google does not restrict it to one label. The application limits its searches to the matching account label and the current task's time window. It does not obtain Gmail passwords or request email sending, modification or deletion permissions.
应用由 Scapice Portal 管理员运营，供已授权用户维护自己有权使用的 SHEIN 账户。用户主动选择账户并启动更新任务，可停止任务、改为手动操作或断开邮箱连接。
Gmail 连接通过 Google OAuth 获取 https://www.googleapis.com/auth/gmail.readonly 只读权限。此权限本身可以读取邮箱内容，并非由 Google 限定为单一标签；应用的查询和使用范围由下述功能规则限制。我们不获取 Gmail 密码，也不请求发送、修改或删除邮件的权限。
2. Data accessed and collected · 访问哪些数据
- Mailbox identity and labels: the connected Gmail address and label identifiers/names, used to confirm the connection and match the selected SHEIN account's email label.
- Selected verification emails: message identifiers, received timestamps, headers and message bodies from the matching label within the current task's time window. These are checked for sender authenticity, original recipient, freshness and an unambiguous code. The application does not download attachments.
- Google authorization records: access and refresh tokens, authorization time and token expiry, used to maintain the consented read-only connection.
- Separately supplied SHEIN account data: login names/passwords, resulting sessions, account identity and synchronized account data. These account records are not business information extracted from Gmail.
- Operational data: task status, error categories and technical records needed to operate the service. Servers may process request times, paths and IP addresses for operation and security. The public pages use no analytics or advertising scripts.
- Gmail 邮箱地址和标签标识、名称：确认连接状态，并匹配用户所选 SHEIN 登录邮箱对应的标签。
- 该标签中本次任务时间范围内验证邮件的标识、接收时间、必要邮件头及正文：核验发件来源、原始收件地址、时效和验证码。程序不下载附件。
- Google OAuth 授权凭据：访问令牌、刷新令牌、授权时间和有效期，用于保持用户已授权的只读连接。
- 用户另行提供的 SHEIN 登录名、密码，以及登录后取得的会话信息、账户身份和同步数据。这些不是从 Gmail 中读取的经营数据。
- 必要的任务状态、错误类别和运行记录。服务器可能处理访问时间、请求路径及 IP 等基础技术信息，用于运行与安全维护；本说明页不使用分析或广告追踪脚本。
3. Purpose and use of data · 如何使用数据
Google user data is used only to maintain the mailbox connection, match an account label, identify a fresh verification email and assist with that user's verification during a user-initiated update. A valid code may be submitted to SHEIN in automatic mode; in manual mode it is displayed to that user and entered in the verification field for the user's submission. This reduces manual copying of time-limited codes.
Google user data is not sold, used for advertising or profiling, or used for credit/lending decisions. This Gmail verification feature does not send email contents or verification codes to AI services or use them to train AI models. It uses a verification-email parser, does not generate images or video, and is separate from other Portal analysis features.
Staff do not routinely read emails. Human access to specific data is limited to the user's affirmative consent, necessary security investigation, legal requirements or other applicable policy-permitted situations.
Google 用户数据仅用于邮箱连接状态、账户标签匹配，以及用户所发起更新任务中的验证邮件识别和验证码填写。验证码只在当前任务中使用：自动模式可向 SHEIN 提交以完成验证；手动模式向本人显示并协助填写，由用户确认提交。
应用不出售 Google 用户数据，不将其用于广告投放、用户画像、信用或借贷判断，也不将邮件内容或验证码发送给大语言模型或用于训练通用 AI 模型。该 Gmail 功能与 Portal 的其他数据分析功能相互分离。
不会常态化由工作人员阅读邮件。对具体数据的人工访问仅限本人明确同意、必要的安全调查或法律要求等适用政策允许的情况。
4. Storage, retention and protection · 存储、保留与保护
- Google OAuth credentials and saved SHEIN passwords are encrypted on access-controlled servers. Sessions, synchronized data and operational records are protected by server access controls and are not served by these public pages.
- Email bodies are not saved as persistent application records. Verification codes are held briefly in current-task memory, cleared on task completion, stop or expiry, and not written to application logs.
- Message identifiers, task identifiers and processing times are retained to prevent code reuse. Records older than 24 hours are cleaned up when a subsequent code is successfully retrieved; this does not mean every operational log has a fixed 24-hour retention period.
- Label information is cached briefly in memory. Current authorization credentials are retained until disconnection, processing of revocation or administrator removal. Other account/task records and controlled backups are retained for operational needs; users may request deletion as explained below. No fixed automatic purge period is promised for all records or backups.
Connections to Google and SHEIN use HTTPS. The service infrastructure operates in China and Germany. Encryption and access controls reduce risk; no internet-connected system is guaranteed to be completely risk-free.
- Google OAuth 凭据及已保存的 SHEIN 登录密码加密保存在受控服务器。会话信息、同步数据及运行记录受服务器访问权限保护，不通过公开说明页提供。
- 邮件正文不作为应用持久化记录保存；验证码仅在当前任务内存中短暂使用，任务结束、停止或过期后清除，不写入应用日志。
- 防止重复使用验证码的邮件标识、任务标识及处理时间会保存；在后续成功读取验证码时，程序清理超过 24 小时的旧防重复记录。这不等于所有任务日志都只保留 24 小时。
- 邮箱标签信息短暂缓存在内存中。授权凭据保留至断开连接、撤销后处理或管理员删除；其他账户数据、任务记录及受控备份按运行维护需要保留，可申请删除。
应用通过 HTTPS 与 Google 和 SHEIN 通信；服务运行环境涉及中国和德国。我们采用加密与访问控制降低风险，但不承诺任何联网系统绝对无风险。
5. Sharing and third-party services · 共享与第三方服务
Google processes OAuth authorization and Gmail API requests. When the user authorizes an account update, the identified verification code is passed to SHEIN only to complete that account's verification. Necessary server service providers support application operation and may process required data under their maintenance permissions or legal obligations.
Google user data is not shared with advertising platforms or data brokers. Apart from consented user-facing functions, security needs or legal requirements allowed by applicable policies, it is not transferred or disclosed for other purposes. Google and SHEIN apply their own policies to the data they receive directly.
Google 处理 OAuth 授权与 Gmail API 请求；用户授权启动更新时，识别出的验证码仅为完成该账户验证而传递给 SHEIN。必要的服务器服务提供方支持应用运行，并可能按维护权限或依法处理必要数据。
Google 用户数据不提供给广告平台或数据经纪商。除用户授权的可见功能、安全需要或法律要求等允许情形外，不作其他转移或披露。Google 和 SHEIN 分别按其自身政策处理直接收到的数据。
6. Disconnect, revoke access and request deletion · 断开、撤销与删除
After completing or stopping an active task, choose Disconnect in the private application's Gmail connection area. This removes the application's currently saved Gmail grant and pending authorization for that Portal user and clears the corresponding label cache. It does not delete messages in Gmail.
Google access can also be revoked in Google Account third-party connections. After revocation, valid Gmail access cannot continue and reconnecting requires consent again.
For deletion of Google authorization records, retained message/label metadata or relevant backups, email 973407444yijing@gmail.com and identify the connected mailbox and data to remove. Do not email passwords, access tokens or verification codes. The administrator verifies data ownership and explains any records that must be retained for legal or security reasons. Disconnecting Gmail does not automatically remove separately saved SHEIN accounts, synchronized data, task history or backups; these can be included in a deletion request.
在 Portal 的邮箱连接区域点击“断开连接”，会移除应用当前保存的该用户 Gmail 授权凭据和待授权信息，并清除相应标签缓存。请先完成或停止正在运行的任务。
也可在 Google 账户的第三方连接设置撤销授权。撤销后应用不应继续获得 Gmail 访问权限，重新连接需要再次授权。
删除授权记录、保留的邮件或标签标识、相关备份及其他账户数据，可联系上述支持邮箱，说明关联邮箱与删除范围；不要发送密码、Token 或验证码。断开 Gmail 不会自动删除另行保存的 SHEIN 账户、已有同步数据、任务历史或受控备份。管理员应先核实身份与数据归属，并说明依法或因安全需要必须保留的内容。
7. Google API Limited Use · Google 数据的有限使用
Scapice Account Assistant uses Google user data only for the consented, user-facing mailbox connection and verification-code assistance described in this policy. Its use and transfer of Google API information adhere to the Google API Services User Data Policy, including Limited Use requirements, and the applicable Google Workspace user data and developer policy.
本应用对 Google API 数据的使用与转移遵循上述 Google API Services User Data Policy，包括其中的 Limited Use 要求，以及适用的 Google Workspace 用户数据与开发者政策；仅用于此政策所述、经用户同意且用户可见的邮箱连接和验证码协助功能。
8. Operator, contact and policy changes · 联系与政策变更
Operator: Scapice Portal administrator. Application: Scapice Account Assistant. Support, privacy and data-deletion contact: 973407444yijing@gmail.com, the application's configured Google OAuth user-support email.
Material changes to data access or purpose require an updated policy and in-application notice. Where new permission or consent is required, the new processing does not begin before consent is obtained.
运营方为 Scapice Portal 管理员。支持、隐私及数据删除请求请联系上述 Google OAuth 用户支持邮箱。实际数据访问或用途如有实质变化，应先更新政策并在应用内通知用户；需要新增授权或同意时，在取得授权前不执行新增处理。