Privacy Policy

• Dashboard users: people a business authorizes to sign in to the Service’s dashboard.
• Mailbox owners: people who connect a Gmail or Google Workspace inbox to the Service, either directly or through an invite link.
• People who email a connected inbox: their messages are processed on behalf of the business that connected the inbox.

The Service is provided to businesses. The business that connects an inbox decides which inboxes are connected and who can see the dashboard.

Dashboard sign-in

When a dashboard user signs in with Google, we receive their name, email address and profile image from Google. We use the email address to check that the user is authorized. Sign-in sessions are kept in an encrypted browser cookie.

Connected inboxes (Google user data)

With the mailbox owner’s permission, the Service uses the Gmail API with the read-only scope (gmail.readonly). It reads and stores:

• the mailbox’s email address;
• message metadata: sender and recipients, date, subject, message and thread identifiers, reply-to, list-unsubscribe and authentication headers, and Gmail labels (such as Inbox, Sent or Spam);
• the plain-text body of each message (HTML is converted to text; very long bodies are truncated);
• an OAuth refresh token that lets the Service keep reading new mail, stored encrypted.

Attachments are not downloaded or stored. The Service cannot send, modify, label, move or delete email.

Information the Service generates

For each email thread, the Service stores a category, a confidence score, a short summary, topic tags, whether a reply is needed, a one-sentence reason for the category, and any job numbers, staff names or locations mentioned. It also stores daily and weekly reports built from this data, and any corrections dashboard users make.

Invites

When a dashboard user invites a mailbox owner, we store the invited email address, a label, the business name, and a single-use link, and we may email that link to the invited address.

Technical logs

Our hosting provider records standard request logs (such as time, URL path and status code). The Service’s own logs contain identifiers and counts, never email bodies.

We use the information above only to provide and maintain the Service for the business that connected the inbox:

• to read new mail and keep each inbox in sync;
• to classify and summarize email threads, detect spam campaigns and duplicate deliveries, and link related complaints;
• to show the dashboard, generate reports, and list threads that need a human reply;
• to authenticate dashboard users and send invite links;
• to keep the Service secure, fix problems, and comply with the law.

We do not sell data, use it for advertising, or build profiles of individuals for any other purpose. We do not use email content or Google user data to train or improve general-purpose artificial intelligence or machine learning models.

Inbox Triage’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

• Gmail data is used only to provide the user-facing triage and reporting features described in this policy.
• Gmail data is transferred to third parties only as needed to provide those features (see Section 5), to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to users.
• Gmail data is never used for advertising, never sold, and never used to determine credit-worthiness or for lending.
• No person at Chimcare LLC reads Gmail data unless the business that connected the inbox asks us to for support, it is necessary for security purposes (such as investigating abuse), or it is required by law. Email content is otherwise processed automatically and shown only to that business’s authorized dashboard users.

We share information only with the service providers that run the Service, under their terms, and only as needed:

• Anthropic (AI model provider): the text of email threads is sent to Anthropic’s API to produce the category, summary and other fields described above, and aggregate report data is sent to write report summaries. Under Anthropic’s commercial terms, data sent through its API is not used to train its models. See Anthropic’s privacy policy.
• Vercel (application hosting): runs the Service and processes requests.
• Neon (database hosting): stores the data described in Section 2.
• Resend (email delivery): receives the invited email address and invite message when an invite is emailed.
• Google: provides sign-in and the Gmail API.

Within a business, stored email content and reports are visible to that business’s authorized dashboard users. We may also disclose information if required by law, to protect the rights, safety or property of Chimcare LLC or others, or in connection with a merger, acquisition or sale of assets, in which case we will give notice.

• Data is encrypted in transit (HTTPS/TLS) and stored with hosting providers that encrypt data at rest.
• OAuth refresh tokens are additionally encrypted by the Service (AES-256-GCM) before they are stored.
• Gmail access is read-only, and only authorized dashboard users can view data or connect and remove inboxes.
• Invite links are single-use, expire after 7 days, and are stored only in hashed and encrypted form.

No method of transmission or storage is completely secure, but we work to protect the data we handle.

• Stored email data, classifications and reports are kept while the inbox is connected and the business uses the Service.
• When a business removes an inbox, its access token is deleted and revoked with Google. The business chooses whether to keep or permanently delete that inbox’s stored emails and classifications.
• Invite links stop working after 7 days or once used.
• You can ask us to delete data at any time by emailing info@chimcare.com. We will complete verified deletion requests within 30 days, except where we must keep information to comply with the law.

• Revoke access: a mailbox owner can disconnect the Service at any time at myaccount.google.com/permissions. This stops all further access. To also delete stored data, email info@chimcare.com.
• Access, correction and deletion: depending on where you live, you may have rights to access, correct or delete personal information, or to object to its processing. Email info@chimcare.com and we will respond.
• If you emailed a business that uses the Service: that business controls your message. Contact the business, or email us and we will help pass on your request.

The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect their data.

We may update this policy. We will change the effective date above and, for material changes, notify dashboard users before the change takes effect.

Chimcare LLC
Email: info@chimcare.com