Privacy Policy

Vaxon operates EmailFlow AI. This Privacy Policy explains what information we collect, how we use and protect it, how Google user data is handled, and the choices available to users.

EmailFlow AI helps users turn email-based work into reviewable tasks, summaries, priorities, due-date suggestions, and source-linked workflow records. This Privacy Policy applies to the EmailFlow AI website, application, and related services (collectively, the “Service”).

1. Information we collect

Account information

When you create or use an EmailFlow AI account, we collect the information needed to provide and secure your account, including:

• Your name and email address
• A securely hashed password if you register using an email address and password
• Authentication and session information used to sign you in and protect your account
• OAuth access and refresh tokens when you choose to connect a Google account

Google account and Gmail data

When you choose to connect Gmail, EmailFlow AI uses read-only Gmail access to provide the user-facing features described in this Policy. The Service accesses the following Google data when needed for those features:

• Google account profile information, including your name and email address
• Gmail message subject lines and relevant email body content
• Sender and recipient information
• Message dates, timestamps, thread identifiers, message identifiers, and other email metadata needed to sync, display, and link messages to tasks
• The Gmail account connection status and synchronization timestamps

The current Service does not send, delete, archive, label, or otherwise modify Gmail messages. It does not access or process Gmail attachments as part of the current production service.

Email-derived information

When the Service analyses an email, it creates information derived from that email so the user can review and manage work. This includes:

• Suggested task titles and task summaries
• Suggested due dates and priority levels
• Project, matter, or workflow classifications
• Links between a task and its source email
• Review status and the user's edits, approvals, or rejections of suggestions

Usage and technical information

We collect limited usage and technical information that does not require us to analyse Gmail content, including:

• Actions taken within the Service
• Synchronization and processing timestamps
• Device, browser, session, and approximate network information
• Error logs, security events, latency, uptime, and other reliability information

We use this information to operate, troubleshoot, secure, and improve the reliability and usability of the Service. We do not create aggregated or anonymized datasets from Gmail content for advertising, model training, or unrelated product development.

2. How we use information

We use information only for the purposes described in this Policy, including to:

• Create and secure your EmailFlow AI account
• Connect to and synchronize your Gmail account after you authorize access
• Display relevant email information within the Service
• Identify emails that may require action
• Generate reviewable task suggestions, summaries, due dates, priorities, and classifications
• Maintain links between tasks and their source emails
• Allow you to review, edit, accept, reject, organize, or delete generated records
• Maintain, monitor, debug, and protect the Service
• Send account, password reset, security, and other service-related communications
• Comply with applicable law and respond to valid legal requests

We do not use Google user data for advertising, credit or lending decisions, data brokerage, surveillance, unsolicited commercial email, email warming, or any purpose unrelated to the user-facing features of EmailFlow AI.

3. Google Workspace API data and Limited Use

EmailFlow AI uses information received from Google Workspace APIs only to provide and improve user-facing features that are visible to the user, including Gmail synchronization, task extraction, summaries, priority classification, due-date suggestions, and source-linked workflow records.

Limited Use statement: The use of information received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, EmailFlow AI:

• Does not sell Google user data
• Does not use Google user data for advertising or personalized advertising
• Does not transfer Google user data to data brokers, advertisers, information resellers, credit agencies, or other parties for their independent purposes
• Does not use raw, derived, aggregated, or anonymized Google Workspace API user data to develop, train, or improve generalized or non-personalized artificial intelligence or machine learning models
• Does not transfer Google Workspace API user data to a third-party AI or machine learning provider that uses the data to train or improve generalized or non-personalized models
• Does not use Gmail data to send unsolicited commercial emails, warm email accounts, or operate mass-marketing or cold-email services

4. AI processing

EmailFlow AI uses automated processing to generate user-facing task suggestions and summaries. When a user asks the Service to analyse an email, the Service sends only the information needed for that analysis to contracted AI processing providers. Depending on the requested feature, this information can include the email subject, relevant portions of the email body, message context, and limited metadata required to produce the requested result.

AI processing providers receive this information only as service providers acting on our instructions and only to deliver the requested EmailFlow AI feature. They are not permitted to sell the information, use it for advertising, or use Google Workspace API data to train or improve generalized or non-personalized AI or machine learning models.

AI-generated results can be incomplete or inaccurate. EmailFlow AI presents tasks, summaries, priorities, and due dates as reviewable suggestions. Users are responsible for reviewing these suggestions before relying on them.

5. When we disclose information

We do not sell personal information or Google user data. We disclose information only in the following limited circumstances:

• Service providers: to providers that perform cloud hosting, database storage, authentication, security, logging, email delivery, customer support, or AI processing on our behalf. They receive only the information necessary to perform their contracted function and must protect it under applicable confidentiality, security, and data protection obligations
• Legal and safety requirements: when disclosure is required by applicable law, a valid legal process, or is reasonably necessary to protect users, prevent fraud or abuse, or investigate a security incident
• Business changes: if Vaxon is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred subject to this Policy and applicable law. Google user data will not be transferred for an independent purpose prohibited by the Google API Services User Data Policy
• With your direction or consent: when you explicitly ask us to share particular information or authorize a specific integration

We do not share Gmail content with other EmailFlow AI users unless the account holder deliberately uses a Service feature to share a task or record and that feature clearly identifies what will be shared.

6. Human access to Gmail content

Vaxon personnel do not routinely read Gmail content. Authorized personnel may access specific Gmail content only when:

• The user gives explicit consent for authorized support personnel to access specific data needed to resolve a support request
• Access is necessary to investigate or respond to a security incident, fraud, abuse, or a technical failure affecting the user
• Access is required to comply with applicable law or a valid legal process

Any permitted access is limited to the minimum information necessary, restricted to authorized personnel, and subject to access controls and logging where technically available.

7. Data storage and security

We use technical and organizational safeguards designed to protect personal information and Google user data. These safeguards include:

• Encryption in transit using HTTPS/TLS
• Encrypted cloud infrastructure and protected storage for application data and credentials
• Secure password hashing for accounts created with a password
• Scoped OAuth authorization and separation of OAuth credentials from user passwords
• Role-based and least-privilege access controls for production systems
• Logging and monitoring for suspicious activity, errors, and service reliability
• Restricted access to production data and secrets by authorized personnel
• Security review and incident response procedures appropriate to the nature of the Service

EmailFlow AI never receives or stores your Google password. No method of transmission or storage is completely secure, but we take reasonable measures to protect information against unauthorized access, alteration, loss, misuse, or disclosure.

8. Data retention and deletion

While your account is active

We retain account information, OAuth credentials, synchronized Gmail information, and email-derived records only for as long as needed to provide the Service, maintain account security, and meet the purposes described in this Policy. OAuth access and refresh tokens are retained only while the Gmail connection remains active.

Disconnecting Gmail

You can disconnect Gmail from the EmailFlow AI settings at any time. When you disconnect Gmail:

• New Gmail synchronization stops immediately
• The Service revokes or deletes the stored Google OAuth access and refresh tokens as soon as technically practicable and no later than 7 days after disconnection
• Previously created tasks, summaries, priorities, and other email-derived records remain in your EmailFlow AI account so that you can continue using them, unless you delete them or request their deletion
• Previously synchronized Gmail content retained by the Service is deleted from active systems within 30 days after disconnection, unless you reconnect the account or retention is strictly required by applicable law or for a documented security investigation

Deleting your account or requesting deletion

You can delete your account through the Service where that option is available, or request deletion by emailing support@vaxon.org. After account deletion or a verified deletion request:

• Personal information, stored Google OAuth tokens, synchronized Gmail content, and email-derived records are deleted from active systems within 30 days
• Residual copies may remain in encrypted backups for up to 90 days before being overwritten through the normal backup cycle
• Limited security, fraud-prevention, billing, or legal records may be retained only where required by applicable law or reasonably necessary to investigate a documented security incident. These records are isolated from normal product use and are not used for advertising, AI training, or unrelated purposes

Technical and security logs

Routine technical and security logs are generally retained for up to 90 days, unless a longer period is reasonably necessary to investigate a specific security incident, prevent abuse, or comply with applicable law. We avoid placing Gmail message content in logs unless it is technically necessary to diagnose a specific user-authorized issue.

9. Your choices and rights

Depending on your location and applicable law, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Request deletion of your account, Gmail data, or email-derived records
• Request a portable copy of certain information
• Object to or restrict certain processing
• Withdraw consent by disconnecting Gmail or revoking access through your Google Account settings

To exercise a privacy right or request deletion, contact support@vaxon.org. We may need to verify your identity before completing a request. We will respond within the period required by applicable law.

10. Third-party services

EmailFlow AI relies on service providers to operate the Service, including providers of cloud infrastructure, database storage, authentication, security, logging, email delivery, customer support, and AI processing. These providers process information only to perform services for Vaxon and are subject to applicable contractual or service-term restrictions concerning confidentiality, security, retention, and data use.

When you connect a Google account, your use of Google services is also governed by Google's own terms and privacy policies. You can review and revoke EmailFlow AI's access from the third-party access section of your Google Account.

11. International data processing

Information may be processed or stored in countries other than the country in which you live. Where required, we use reasonable safeguards designed to ensure that personal information remains protected in accordance with this Policy and applicable privacy law.

12. Children

EmailFlow AI is not directed to children under 13 years of age or the minimum age required to use the Service under applicable law. We do not knowingly collect personal information from children. If you believe a child has provided personal information, contact support@vaxon.org so that we can investigate and delete it where appropriate.

13. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to the Service, legal requirements, security practices, or data handling. If we make a material change, we will update the “Last updated” date and provide notice through the Service, by email, or by another appropriate method before the change takes effect where required.

14. Contact us

For privacy questions, deletion requests, security concerns, or other questions about this Policy, contact: support@vaxon.org

This Policy describes EmailFlow AI's current production data practices. Features and permissions not currently offered are not covered as active capabilities.