Legal
Data Processing Agreement
Summary · Last updated: September 6, 2026
When you use Inbox Wingman, we act as a processor of Gmail-related personal data on your behalf for the purpose of providing the service (triage, drafts, briefs, account administration).
Scope
Categories include account identifiers, encrypted OAuth tokens, email metadata (sender, subject, snippet), AI-generated labels/summaries, and usage/billing records. We do not store full email bodies.
Instructions
We process data only to deliver the product features you enable, to secure the service, and to meet legal obligations. We do not sell personal data or use Gmail content for advertising.
Payments
Paddle.com Market Ltd is merchant of record. For card details, invoices, and tax, Paddle acts as an independent controller under Paddle's privacy policy. We receive only subscription status, plan, and Paddle customer/subscription ids needed to unlock the product.
Sub-processors
We use authorized sub-processors (including OpenAI for transient classification and drafts, Vercel for hosting, and Supabase for the application database). Current list: Sub-processors.
Security & deletion
Measures include encrypted tokens, access controls, and immediate deletion of stored data when you delete your account (unless law requires retention of billing records). Details in our Security and Privacy pages.
For a signed DPA for procurement, email support@inboxwingman.com.