Privacy Policy

1. Who we are

Email Digest (the "service", available at this website) is operated by ViaTech (viatech.ae), referred to as "we" or "us". We are responsible for the personal information described in this policy. You can contact us at support@viatech.ae.

Email Digest reads the email that arrived in your Gmail inbox since your previous digest, uses an AI model to summarize each message and sort it into "Needs action" or "FYI", and sends you one digest email, from your own Gmail account to yourself, at the times set for your account.

2. Data we access through Google

When you sign in with Google, we ask for these permissions (OAuth scopes), and use each one only as described:

• openid, email and profile: your Google account ID, email address, name and profile picture. We use them to sign you in, to identify your account, and to show which Google account is connected.
• gmail.readonly ("Read your email"): we read the messages in your inbox that arrived within the digest window, that is between your previous digest and the current one (24 hours for your first digest). For each message we read the sender, recipients, subject, date and text content so that it can be summarized and classified. We use this access only to build your digest. We never modify, label, move or delete your email, and we do not read messages outside the digest window.
• gmail.send ("Send email on your behalf"): we use it only to send the digest email from your own Gmail account to your own email address. We never send email to anyone else, and never send anything other than your digest.

You can see and revoke these permissions at any time at myaccount.google.com/permissions.

3. What we store, and what we never store

We store only what the service needs to work:

• Your Google profile: email address, name, profile picture URL and Google account ID.
• A Google refresh token, which lets the service run your digest on schedule while you are away. It is encrypted with AES-256-GCM before it is saved, and only once an administrator has approved your access.
• Your digest settings: schedule times, time zone, days, and related options.
• Run history: when each digest ran, the time window it covered, how many emails it covered, which AI model was used, and whether it was sent or failed (with a short technical error message if it failed). Run history contains no email content, senders, subjects or summaries.

Sign-in requests are reviewed. The first time you sign in, an administrator of the service reviews your request before you can use it. Until it is approved we keep only your Google profile (above), and the Gmail access Google grants at that sign-in is revoked straight away without being stored. Once approved, you sign in again to connect Gmail.

We never store your emails: not their body, attachments, senders, subjects or Gmail message IDs, and not the AI-generated summaries either. Email content is held in memory only while your digest is being prepared and is discarded as soon as the digest has been sent. The digest email itself, including its "Open in Gmail" links and summaries, lives only in your own Gmail account, not on our servers.

4. How AI processing works

To summarize an email, we send the AI provider configured for the service the email's sender, recipients (To and Cc), subject, date and text content, plus your name and email address (so the model can tell whether you were addressed directly) and today's date in your time zone. This is sent over an encrypted (HTTPS) connection, solely to produce that email's summary, classification and action items.

By default the provider is the OpenAI API. An administrator of the service may instead configure Anthropic, Google Gemini or another OpenAI-compatible API provider for an account; the service only accepts encrypted (HTTPS) endpoints.

We use these providers only through paid or enterprise API accounts, under terms in which they do not use API inputs or outputs to train their models (we never use free tiers, such as free Google Gemini API keys, whose inputs may be used to improve the provider's products). Providers may keep API inputs and outputs for a limited period, typically up to 30 days, solely to monitor for abuse, and then delete them. We do not use your data to develop, improve or train any AI or machine-learning models, ours or anyone else's.

5. Google API Services User Data Policy and Limited Use

Email Digest's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, for data we receive from Google APIs (including your Gmail data):

• We use it only to provide and improve the user-facing digest feature that you see and use in Email Digest.
• We do not transfer it to others, except as necessary to provide or improve that feature (for example, to our hosting, database and AI processing subprocessors listed below), for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets with your prior consent.
• We do not use or transfer it to serve advertisements, including retargeting, personalized or interest-based ads.
• We do not sell it, and we do not use it to determine credit-worthiness or for lending purposes.
• No human reads it, except (a) with your affirmative agreement for specific messages, for example when you ask us for support with a particular email, (b) when necessary for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) when it has been aggregated and anonymized and is used for internal operations.
• We do not use it to develop, improve or train generalized or non-personalized AI or machine-learning models.

6. Who we share data with

We never sell your data, and we do not use it for advertising. We share it only with the service providers (subprocessors) that run the service for us, and only as needed to provide it:

• Vercel: hosts the website and runs the digest jobs, in the United States (Washington, D.C. region).
• Supabase: hosts our Postgres database (the stored data described in section 3), on Amazon Web Services in India (Mumbai region).
• The configured AI provider (OpenAI by default; or Anthropic, Google, or an OpenAI-compatible provider if an administrator configures one): receives email content only to produce summaries, as described in section 4.
• Google: we call the Gmail API on your behalf to read your inbox and send your digest.

This means your data is transferred to and processed in countries other than your own, including the United States (the website, digest jobs and the default AI provider) and India (the database). These providers protect it with encryption in transit and access controls, and process it only on our instructions to provide the service.

We may also disclose information if required by law or a valid legal request, or where necessary to protect the security of the service or its users.

7. How long we keep data

• Email content and AI summaries: never stored by us (see section 3). AI providers may keep the content they receive for a limited period for abuse monitoring, as described in section 4.
• Run history: deleted automatically after 90 days.
• Operational logs kept by our hosting and database providers, which record technical events with account, run and Gmail message IDs (never email content, tokens or keys): deleted automatically within 7 days.
• Account data (profile, settings, encrypted token): kept until you delete your account.
• Access requests: while a request waits for review we hold only your Google profile, and you can delete it yourself from the Settings page. If a request is declined or your access is revoked, we revoke our Gmail access at Google and erase the token, settings and run history, and keep only your Google profile so the decision stays in place. Email us to have it deleted.
• If you disconnect Gmail, we revoke our access at Google and erase the stored token immediately. If you delete your account, we delete your profile, token, settings and run history immediately and revoke our access at Google. If Google cannot confirm the revoke, we tell you so you can remove it yourself. Copies in our database host's encrypted backups, if any, are overwritten within 7 days.

8. Your choices and controls

• Disconnect Gmail on the Settings page: revokes our access and pauses digests.
• Delete your account on the Settings page ("Delete my account and data"): permanently deletes everything we store about you.
• Revoke access from Google at any time at myaccount.google.com/permissions. Digests stop immediately.
• Ask us for a copy of your data, a correction, or deletion by emailing support@viatech.ae. We respond within 30 days.

9. Security

All traffic to the service and to Google, our database and AI providers is encrypted in transit (HTTPS/TLS). Google refresh tokens and AI provider API keys are encrypted at rest with AES-256-GCM. Access to production systems is limited to the people who operate the service. Sessions use signed, HTTP-only cookies, and our logs record only metadata such as account, run and Gmail message IDs (never email content, tokens or keys). No system is perfectly secure, but if we become aware of a breach affecting your data we will notify you and the relevant authorities as required by law.

10. Children

Email Digest is not directed at children and may not be used by anyone under 16 (or the minimum age for consent in your country). We do not knowingly collect data from children; if you believe a child has used the service, contact us and we will delete the account.

11. Changes to this policy

We may update this policy from time to time. We will change the effective date above, and for material changes (especially to how we use Google user data) we will notify you by email or in the app before they take effect. We will ask for your consent before using your data in a way not described here.

12. Contact

Questions, requests or complaints: support@viatech.ae (ViaTech, viatech.ae). See also our Terms of Service.