Legal
Privacy policy
Last updated 31 August 2026
Executive Email Copilot reads a mailbox you connect, decides what deserves your attention, drafts replies, and holds every outbound action until you approve it. Doing that requires access to your mail. This page says exactly what we access, why, where it goes, who else sees it, and how to get it back or destroy it.
The short version. We read your mailbox to run the copilot for you and nothing else. Your mail is never used to train or improve any machine-learning model, ours or a vendor's. Nothing is sent to a recipient without you pressing approve. You can export everything or erase the whole workspace yourself, at any time, without asking us.
Who we are
Executive Email Copilot ("we", "the service") operates this application and is the controller of the personal data described here. Questions, requests, and complaints: the contact form.
What we access, and why
When you connect a mailbox we ask your provider for a specific, listed set of permissions. We request the narrowest set that lets the product work. Every scope below is used; none is requested speculatively.
Google (Gmail)
| Scope | What it permits | Why the product needs it |
|---|---|---|
| gmail.modify | Read messages, and apply or remove labels | Reading the message is the product: triage, risk and deadline signals, the promises it contains, and the draft itself are all derived from it. Labels are how a decision is recorded back in your mailbox (spam filed, deferred, escalated). |
| gmail.compose | Create and send drafts | A reply you approved is created and sent; an escalation is written as a draft for a colleague. Only ever after you approve it. |
| openid, email | Your account's email address | To label the connection so you can tell two mailboxes apart. |
Microsoft 365
| Scope | What it permits | Why the product needs it |
|---|---|---|
| Mail.Read | Read messages in your mailbox | The same triage and drafting as above. |
| Mail.ReadWrite | Categorize and file messages, create drafts | Recording a decision back in the mailbox, and holding a draft. |
| Mail.Send | Send a message | Sending the reply you approved. Never without that approval. |
| offline_access | Keep working when you are not signed in | The copilot triages your inbox in the background so the queue is already full when you open it. Without this it could only work while you watched. |
| openid, email | Your account's email address | To label the connection. |
What we store, and for how long
We do not keep a copy of your mailbox. For each message the copilot processes we store a working record: the sender, the subject, the first 500 characters of the body, the timestamp, the provider's message and thread identifiers, and the signals the copilot inferred (priority, risk tag, deadline, an estimate of business value). Alongside it we store the action the copilot proposed, the draft text if it wrote one, the verification result for that draft, and your decision.
We also store an append-only audit record of security-relevant events in your workspace: sign-ins, mailbox connections and disconnections, syncs, and every approval or rejection. That log exists so you can answer the question "what did this thing do on my behalf?" without taking our word for it.
All of it lives for as long as the workspace does. Disconnecting a mailbox immediately deletes every stored message and action derived from it. Deleting the workspace deletes everything, permanently. See Your controls.
Credentials
The OAuth access and refresh tokens for your mailbox are the one genuinely dangerous thing we hold, and they are stored encrypted at rest with an authenticated cipher, keyed from a server secret that is never written to the database. They are never returned by any API response and never included in a data export. Passwords are stored only as a salted hash.
Who else sees it
Writing a draft means sending the message it answers to a large language model. That is a real disclosure and we would rather name it than bury it:
- Our LLM provider. By default this is OpenAI, via its API. The subject and body of a message being drafted for, plus the draft being verified, are sent to it. It is a processor acting on our instructions.
- Our hosting and database provider, which stores the data described above.
- Our email provider, for transactional mail only (password resets, invitations). Your mailbox contents are never sent through it.
We do not sell personal data, we do not share it with advertisers, and we do not disclose it to anyone else except where the law requires it.
Google API Services Limited Use disclosure
Executive Email Copilot's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically: we do not use Gmail data to develop, improve, or train generalized or non-personalized artificial-intelligence or machine-learning models. We do not transfer or sell Gmail data for serving advertisements, for credit assessment, or for lending purposes. No human reads your Gmail data except with your explicit consent for a specific support request, where it is necessary for security purposes, or where the law requires it.
The copilot does learn from your workspace: drafts you approve and edits you make are fed back as examples so its wording sounds more like yours. That learning is scoped to your workspace alone. It never crosses into another customer's workspace, and it never becomes training data for a general model.
Your controls
- Nothing sends itself. Every reply and every escalation waits for you in the approval queue. You can edit the wording before you approve it, and what you approve is what gets sent.
- Disconnect a mailbox at any time from Mailboxes. This revokes our stored tokens and deletes every message and action derived from that mailbox.
- Export everything as JSON from Settings, at any time, without contacting us. Secrets are excluded; everything else is there.
- Delete the workspace from Settings. This is a hard purge, not a flag: messages, actions, members, audit entries, and the workspace record are removed. There is no undo.
- Revoke access at the provider. You can also cut us off from your side, at Google account permissions or Microsoft My Apps.
If you are in the UK, EEA, or another jurisdiction with equivalent rights, you have the right to access, correct, export, restrict, or erase your personal data, and to object to its processing. The controls above deliver most of that immediately; for anything they do not cover, write to the contact form.
Security
- Mailbox tokens encrypted at rest with an authenticated cipher.
- Every customer-owned row carries its workspace id, and all access goes through workspace-scoped queries.
- Sessions are signed, HTTP-only cookies; every state-changing form carries a CSRF token bound to the session.
- Incoming mail is treated as untrusted input, including for prompt injection.
- Passwords are stored as salted hashes and are never recoverable.
No service can promise perfect security, and we will not pretend otherwise. If you find a vulnerability, please report it privately through GitHub's private vulnerability reporting.
Children
The service is for professional use and is not directed at anyone under 16. We do not knowingly collect their data.
Changes
If we change this policy in a way that materially affects how your mailbox data is handled, we will tell you before it takes effect. The date at the top always reflects the current version.
Questions: the contact form · Terms of service