Privacy Policy

What Inbox Wingman does

Inbox Wingman connects to your Gmail account (with your explicit consent via Google OAuth) to categorize incoming email, create reply drafts, and send you a daily summary. Inbox Wingman never sends email on your behalf.

Google user data we access

With your consent, we access: your Google account email address and basic profile (name, avatar) to create your account; and your Gmail messages via the Gmail API — we read message headers and content to categorize mail and generate summaries and reply drafts, apply/remove labels and archive messages according to your preferences, and create reply drafts in your Drafts folder. Message content is processed transiently and is not stored on our servers (see below).

Data we store

We store email metadata only: sender, subject, a short snippet, the assigned category, and a one-sentence AI summary. We do not store full email bodies. Your Google refresh token is encrypted at rest with AES-256-GCM.

Limited Use disclosure (Google API Services)

Inbox Wingman's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to provide the features you see in the product. It is never used for advertising, never sold, and never used to train generalized AI or machine-learning models.

AI processing

Email content is sent to our AI provider (OpenAI) transiently to classify messages and generate drafts. Per OpenAI's API terms, this data is not used to train their models; OpenAI may retain API data for up to 30 days solely for abuse monitoring, after which it is deleted. We never store the AI provider's copy of your content ourselves.

If you opt in to voice matching, we derive a short writing-style profile from emails you select or recently sent. This profile personalizes drafts for your account only — it is never used to train, develop, or improve any generalized AI/ML model, and it is deleted with your account.

Payments

Purchases are handled by Paddle as merchant of record. We never see or store your card details; we only store your plan, subscription status, and credit balance.

Your controls

You can disconnect Gmail at any time from your Google Account's security settings, or delete your Inbox Wingman account from Settings — deletion immediately and permanently removes your profile, encrypted tokens, message metadata, rules, and usage records. For access, export, or correction requests see Data request or email support@inboxwingman.com.

GDPR: legal bases

For users in the EU/EEA and UK, we process personal data on these bases: performance of a contract (providing triage, drafts, and briefs you signed up for), consent (Gmail access via Google OAuth, which you can withdraw at any time), and legitimate interests (securing the service and preventing abuse).

GDPR: your rights

You have the right to access, correct, export (data portability), delete, and restrict or object to the processing of your personal data. Deletion and Gmail disconnection are self-serve (Settings); for anything else use Data request. We respond within 30 days. You may also lodge a complaint with your local supervisory authority.

International transfers

Our infrastructure and sub-processors may process data in the United States and other countries. Where GDPR applies, transfers rely on appropriate safeguards such as Standard Contractual Clauses or the EU–US Data Privacy Framework, as offered by each provider.

Retention

Message metadata and account data are kept while your account is active and deleted when you delete your account. Billing records are retained by our payment provider as required by law. We use only strictly necessary cookies (your login session) — no advertising or analytics trackers.

Sub-processors

See our Sub-processors list and DPA overview.