Privacy Policy

This Privacy Policy outlines how Dubai Gmail Automation ("we," "our," or "the Application") accesses, collects, uses, stores, and protects data when you connect your Google Workspace or Gmail account to our service.

1. About Dubai Gmail Automation

Dubai Gmail Automation is an autonomous enterprise email ingestion and financial data extraction platform operating in Dubai, United Arab Emirates. The platform is designed specifically for registered corporate organizations to automate the extraction of supplier invoices, 15-digit UAE Tax Registration Numbers (TRN), 5% UAE Value Added Tax (VAT), and urgent customer support communications from designated business mailboxes.

2. Google User Data Accessed & Collected

When an authorized corporate administrator or client connects a mailbox via Google OAuth 2.0, our application requests the following specific permissions:

• Google Account Profile & Email (https://www.googleapis.com/auth/userinfo.email): Used solely to verify the identity of the authorized mailbox and bind it to the organization's account.
• Read-Only Message Access (https://www.googleapis.com/auth/gmail.readonly): Used to read incoming business emails, message headers (From, To, Date, Subject), message body text, and attachments (such as PDF invoices and receipts).
• Authorized Email Dispatch (https://www.googleapis.com/auth/gmail.send): Used exclusively when a user explicitly initiates an outbound email or reply from within the application interface or approves an AI-assisted draft.

3. How We Use Google User Data

We use information received from Google APIs strictly for providing and improving user-facing business features:

• Invoice & Tax Extraction: Scanning incoming vendor emails and PDF attachments to extract invoice numbers, billing totals in AED/USD/EUR, UAE TRN numbers, and due dates.
• Operational Categorization: Identifying customer inquiries, quotation requests, and shipping/logistics updates to route them to the appropriate company department (Accounts, Sales, Operations).
• Webhooks & ERP Integration: Pushing structured, HMAC-signed JSON data of extracted invoices to the client's internal accounting or CRM systems.
• Executive Copilot Assistance: Answering executive inquiries regarding pending company bills and operational alerts based on historical mailbox records.

4. Data Storage, Security & Encryption

Security is our highest priority:

• Encryption at Rest: All Google OAuth refresh tokens and credentials are encrypted using industry-standard AES-256-GCM encryption before being stored in the database.
• Encryption in Transit: All communications between your browser, our servers, and Google APIs are secured with TLS 1.3 encryption.
• Multi-Tenant Isolation: Data is strictly isolated by client organization identifier (client_id). No client or organization can ever view, search, or access another organization's emails or records.

5. Prohibitions & Strict Protections

To ensure absolute privacy for our enterprise clients:

• No Selling of User Data: We do not sell, rent, lease, or monetize user data or email content to any third parties or data brokers under any circumstances.
• No Advertising: Google user data is NEVER used or disclosed for serving advertisements, retargeting, or personalized marketing.
• No Human Viewing: No humans (including our engineers or staff) read your private email messages, unless:
  1. You have given explicit, written consent for a specific support investigation; or
  2. It is strictly necessary for security purposes (such as investigating a bug or abuse) and aggregated/anonymized; or
  3. Required by applicable UAE or international laws.
• No Generalized AI Model Training: Google user data is not used to train or improve generalized AI, machine learning, or foundation models without explicit user consent.

6. Google API Services User Data Policy Compliance (Limited Use)

7. Data Retention & Deletion Instructions

You maintain complete control over your corporate data:

• Disconnecting an Account: You may disconnect any mailbox at any time directly from the Connected Mailboxes dashboard. Disconnecting revokes all future synchronization.
• Revoking Access in Google: You can revoke Dubai Gmail Automation's access at any time by visiting your Google Account Security Settings > Third-party apps with account access.
• Requesting Data Deletion: To request permanent deletion of all stored messages, extracted records, and tokens associated with your organization, email us at privacy@yourdomain.com or support@yourdomain.com. All records will be permanently purged within 7 business days.

8. Contact Information

If you have questions, feedback, or concerns regarding this Privacy Policy or our data practices, please contact us at:

Dubai Gmail Automation
Attn: Privacy & Data Protection Officer
Dubai, United Arab Emirates
Email: support@yourdomain.com / privacy@yourdomain.com