Privacy Policy

Last updated: November 2, 2026

This Privacy Policy explains what data Support Gmail collects, how it uses that data, who it shares it with, how it is protected and how it can be deleted. It covers in particular the data that Support Gmail receives from Google APIs.

1. Who we are and what this policy covers

Support Gmail is an internal customer-support tool. It is operated by the business that runs the brand support mailboxes connected to it ("we", "us"), and it is used only by that business's invited support team. It is not offered to the public.

This policy applies to:

• the mailbox owner, who connects a brand's Gmail support mailbox and authorizes Support Gmail to access it through Google's consent screen;
• people who email those support mailboxes (customers and other senders), whose messages Support Gmail processes to help the team answer them;
• team members who sign in to Support Gmail with their Google account.

Contact for any privacy question or request: contact@eleanortalk.com.

2. Google user data we access

2.1 The connected support mailbox (Gmail)

When the mailbox owner connects a support mailbox, Support Gmail requests the Gmail scope https://www.googleapis.com/auth/gmail.modify. With it, Support Gmail accesses only that mailbox, and only the following data:

• Messages: for each email, the sender and recipient addresses and names, the subject, the date, the technical identifiers used to keep conversations together (Message-ID, In-Reply-To, References), and the text of the message body (HTML bodies are converted to plain text). Support Gmail does not download or store the content of attachments; it can only note that a message has attachments.
• Threads (conversations): the list of messages in each conversation, including the replies previously sent from the mailbox, so the team sees the whole exchange.
• Labels: the mailbox's label names and the labels applied to each message, so the dashboard and Gmail show the same organization.
• Drafts: the draft replies that Support Gmail creates in the mailbox, which it can update, replace or remove.
• The mailbox's own email address, to identify which mailbox is connected.

Support Gmail uses the same scope to send a reply from the mailbox once it has been approved (see section 3), to apply and remove labels, and to archive conversations once they are handled. It does not delete received or sent emails.

2.2 Team members who sign in with Google

Team members sign in with "Sign in with Google", which requests only the openid, email and profile scopes. Support Gmail stores the team member's name, email address and Google account identifier, and uses them only to recognize invited team members and show who did what in the tool. It does not store the profile picture and gets no access to the team member's own mailbox. For security, each sign-in session records its creation and last activity times, the IP address and the browser's user agent.

3. How we use the data

We use the data described above only to provide and improve the user-facing support features of Support Gmail, for the connected mailbox:

• retrieving new support emails and grouping them into conversations;
• linking a conversation to the customer's records in the business's own tools (orders, subscriptions, payments, refunds) and showing that context to the team;
• sorting each email by request type with rules set by the team and with AI classification;
• preparing draft replies with an AI model and saving them as Gmail drafts in the right conversation, for a team member to review, edit and approve;
• sending a reply from the mailbox when a team member approves it. Automatic sending happens only for reply types that the mailbox owner has explicitly enabled (it is off by default): such a draft is sent after a random delay of several minutes, and only if nobody edited, approved or cancelled it in the meantime;
• applying Gmail labels and archiving handled conversations so that Gmail mirrors the support dashboard;
• when a sender explicitly asks to stop receiving marketing emails, or in some full-refund cases chosen by the mailbox owner, unsubscribing that email address from the business's own email-marketing list (only when the mailbox owner has turned this on);
• alerting the team when a conversation needs attention, and keeping a history of what the tool and the team did (for quality checks, troubleshooting and security).

We do not use the data for advertising, we do not sell it, and we do not use it to build profiles for any purpose other than answering the customer's support request.

4. Service providers that process data

To provide these features, Support Gmail sends some data to the following service providers. Each receives only what it needs for its task.

• AI model providers, through OpenRouter (and, when the business selects it, Anthropic directly): the content of the conversation being handled (messages, sender name and address, subject) together with the customer context relevant to it and the team's reply instructions. This is sent only to classify that conversation and to draft the reply to it, one request at a time. Support Gmail does not send Google user data to AI providers for any other purpose, and does not use it to train AI models.
• typesafe.ai: the text of an incoming email, with the relevant parts of the conversation and of the customer context, to classify the request type (for example whether the email asks for a refund).
• Klaviyo (the business's own account): Support Gmail reads customer profiles and email-marketing consent from it, and sends it the sender's email address to find the matching profile and, when that feature applies, to unsubscribe the address from marketing emails.
• Whop (the business's own account): the sender's email address, to look up the customer's orders, memberships, payments and refunds.
• The business's own file storage and websites: when the business keeps records of the services delivered to a customer (for example a document prepared for a customer's order), Support Gmail can read them, using the customer's email address or a link stored in the customer's own profile, to give the team and the draft accurate context. These are read-only accesses.
• Discord: internal alerts sent to the team's private channels. An alert can contain the customer's name and email address, the conversation subject and the reason for the alert, but never the body of an email or the text of a draft.
• Fly.io: hosts the Support Gmail application.
• Supabase: hosts the database where Support Gmail stores its data.

We do not transfer Google user data to anyone else, except when required by law, to protect against fraud or abuse, or as part of a merger or acquisition with the affected users' prior consent where required.

5. Google API Services User Data Policy

In particular:

• We use Google user data only to provide and improve the user-facing support features described in this policy, which are prominent in the tool.
• We do not sell Google user data.
• We do not use or transfer Google user data for advertising, including personalized, retargeted or interest-based advertising.
• We do not use or transfer Google user data to determine credit-worthiness or for lending purposes.
• We do not use Google user data to develop, improve or train generalized or non-personalized AI or machine-learning models.
• No person reads Google user data, except: with the user's affirmative consent for specific messages; when it is necessary for security purposes (such as investigating abuse) or to comply with applicable law; or when the business's support team reads a support conversation in order to answer it, which is the purpose of the tool and is done at the mailbox owner's request. Data is also processed automatically by the tool and its service providers as described in section 4.

6. Storage and security

• The data is stored in a PostgreSQL database hosted by Supabase. The application runs on Fly.io.
• OAuth tokens (including the Gmail access granted by the mailbox owner) and the API keys of the connected services are encrypted at rest with AES-256-GCM, are never shown in the interface and are never returned by the API.
• All traffic between browsers, the application and the service providers uses HTTPS (TLS).
• Only invited team members can sign in. Each one has a role that limits what they can see and do, and access can be restricted to specific mailboxes. Sign-in sessions are stored as one-way hashes and can be revoked.
• Secrets and tokens are never written to logs.

7. Retention and deletion

• We keep the emails, conversations, drafts, customer context and activity history of a mailbox while that mailbox is connected and for as long as needed to provide support to its customers (for example to see earlier conversations with the same customer).
• The data of a team member is kept while they are a member of the team. Sign-in sessions expire after 30 days.
• You can ask for the deletion of your data at any time by writing to contact@eleanortalk.com. We delete it from the database promptly, and at the latest within 30 days, unless we must keep part of it to comply with the law. The mailbox owner can also ask us to delete all the data of a connected mailbox.
• Data that the tool wrote into Gmail (drafts, labels, sent replies) stays in the Gmail mailbox, under the control of the mailbox owner, like any other email.

Revoking access

The mailbox owner can revoke Support Gmail's access to the mailbox at any time from the Google Account permissions page: https://myaccount.google.com/permissions. Team members can revoke the sign-in access in the same place. Once access is revoked, Support Gmail can no longer read, draft, send, label or archive anything in that mailbox: new emails stop arriving in the tool and the team is alerted that the mailbox is disconnected. The data already stored is kept as described above until it is deleted on request.

8. Your rights

Depending on where you live, you may have the right to access the data we hold about you, to correct it, to have it deleted, to object to or restrict its processing, and to receive a copy of it. To exercise any of these rights, write to contact@eleanortalk.com. We answer within 30 days. You can also contact your local data-protection authority.

Support Gmail is not directed at children and does not knowingly process data of children under 13.

9. Changes to this policy

We may update this policy, for example when Support Gmail gains a feature or uses a new service provider. The date at the top of the page shows the latest version. If a change affects how Google user data is used, we will update this page before the change takes effect and, where required, ask for consent again.

10. Contact

For any question about this policy or about your data: contact@eleanortalk.com.