Privacy Policy

OttoMail is a business tool. Our customer is the business that connects its inboxes. The people who write to those inboxes — the business's own customers — are correspondents; their messages pass through OttoMail as part of the business's own mail handling, and the business remains the controller of that correspondence.

When a business connects an inbox, it grants access through Google's own consent screen. We request:

• gmail.readonly — to read incoming messages so they can be triaged and answered. We read only the Gmail labels the business selects when connecting. Spam, Trash, and Promotions are never read.
• gmail.send — to send the replies a person has approved, from the business's own address, so they appear in that inbox's Sent folder and thread correctly.
• gmail.labels — to read the label list so the business can choose which parts of the inbox OttoMail watches, and to mark handled threads.
• documents.readonly — to read the specific Google Doc the business links as its source of truth. We do not browse, list, or access any other document in the account.

We also store the name and email address of each person who signs in, to identify them and record who approved which reply.

Message content is used for exactly three purposes, all in service of answering that message:

• Triage — deciding whether a message is a routine question, or something a person must handle.
• Drafting — writing a proposed reply grounded in the business's own source-of-truth document.
• Review — a second, independent check of that draft for claims the source of truth does not support.

We also record which questions the source of truth could not answer, so the business can improve its own documentation. That record is the question, not the correspondent.

To perform the three tasks above, message content is sent to Anthropic's API, our AI processing sub-processor, over an encrypted connection. Each request is stateless: the content is used to produce that one response and is not retained by the model.

We do not use Google user data to develop, improve, or train any generalized or non-personalized AI or machine-learning model. OttoMail performs no model training or fine-tuning of any kind, and transfers no Google user data to any third party for that purpose. Our AI sub-processor is contractually bound not to train models on data submitted through its API.

What improves over time is the business's own source-of-truth document and its own record of which replies its staff approved — data belonging to that one business, used only for that business, and never mixed with any other customer's.

We do not sell Google user data. We do not use it for advertising. We do not transfer it to others except the sub-processors named in this policy, and only to provide the service.

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

OttoMail's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically: we use Google user data only to provide and improve the user-facing features described above; we do not transfer it except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition; we do not use it for advertising; and we do not allow humans to read it except with the business's explicit consent for specific messages, to comply with applicable law, for security purposes, or on data that has been aggregated and anonymized.

The business's own staff read drafts and the messages they answer — that is the point of the product.

OttoMail staff do not read customer message content in the ordinary course of operating the service. Access for support or debugging happens only with the business's explicit request or consent, and every such access is recorded in that business's own activity log, visible to them, not to us alone.

• OAuth tokens are encrypted at rest with AES-256-GCM. They are never displayed, logged, or transmitted anywhere except to Google.
• Each business's data is isolated by construction. Every database query is bound to one business; the design makes cross-business access structurally impossible rather than merely forbidden, and this is verified by an automated adversarial test suite.
• Data is encrypted in transit throughout.
• Message content is retained while the business uses the service. When an inbox is disconnected, its Google grant is revoked immediately and its synced content is deleted after a 30-day reconnection window. When an account closes, message content, the FAQ source of truth, and OAuth tokens are deleted from production systems within 90 days — a business can request its data before then, and deletion is confirmed in writing.
• Backups and sub-processors follow the same deletion, on their own clocks. Encrypted database backups age out on rotation within 35 days of a deletion. Our AI sub-processor deletes API inputs and outputs within 30 days of processing, except content its trust-and-safety systems flag, which it may retain longer.
• What survives a deletion, and for how long: billing records, account contacts, and a content-free record of decisions — what was decided, by whom, and when, with message content removed — kept for three years for audit integrity, then deleted. Every deletion also writes a permanent content-free record of what was deleted and when.

• Anthropic — AI processing of message content, as described above.
• Google — the source of the mail itself, via the Gmail and Google Docs APIs.
• Our hosting and database provider — stores the application data described above.

A business can disconnect any inbox at any time from within OttoMail, or revoke access directly at myaccount.google.com/permissions. Revoking access stops all reading and sending immediately.

Every OttoMail workspace also has a halt-all-sending control that stops outgoing mail at once, and a per-business setting for whether AI-assisted replies carry a disclosure to the recipient.

A business can request a copy of its data, or its deletion, at info@ottomail.ai — we act on a verified instruction from the business within 30 days, or earlier where the instruction names a statutory deadline.

If you are a customer of a business that uses OttoMail, that business controls your data — direct any request about your emails to them. We act on their instructions and support them in meeting yours; acting on requests from anyone else would mean processing their customers' mail without authority, which is exactly what we never do.

Material changes to this policy will be communicated to connected businesses before they take effect. Questions about it go to info@ottomail.ai.