Gmail privacy and data use

Last updated: 15 October 2026

This notice covers the Gmail integration of SARA — Smart Automated Retail Assistant, operated by ALABDAE ALSAHRIU TECHNOLOGIES L.L.C. The integration puts a business’s authorized mailbox in its private SARA dashboard.

Account choice and permission

The mailbox owner chooses a Google account and authorizes access on Google’s consent screen. An email address or verification code alone does not grant mailbox access. SARA does not ask for the Google account password. An administrator can prepare the business’s panel, but Google authorization still belongs to the mailbox owner.

Our current connection flow requests https://www.googleapis.com/auth/gmail.modify for reading messages, composing and sending email, managing drafts, and changing labels, read state, archive or Trash state. The ordinary delete action moves messages to Gmail Trash; it does not permanently erase them from Gmail.

Data accessed and stored

We process the connected address; message and thread identifiers; senders and recipients; subjects, snippets, dates and labels; attachment information; message bodies and attachments requested by the user; local drafts and scheduled-message payloads; synchronization state; and authorization credentials. Security records identify actions and results without copying email text into the disconnect audit.

Purpose and background access

Data is used to display and search the mailbox, retrieve requested content, save drafts, send authorized messages, apply requested message changes and keep the mailbox synchronized. Continued background access uses Google-issued credentials until access is revoked or disconnected. Mailbox resources and access are scoped to the relevant business and its authorized users. The current receiving-only scheduler does not run automated outbound replies or marketing campaigns.

Google data and AI. Email AI is currently disabled at the mail-to-model entry points. Connecting Gmail does not authorize sending its content to a general conversation model. Any future email AI feature requires a separately reviewed processing path, appropriate provider restrictions and informed mailbox-owner consent.

We limit Google API information to the disclosed, user-benefiting mail features. We do not sell it, use it for advertising, or use it to train general-purpose AI models. We handle Google API information under the Google API Services User Data Policy, including its Limited Use requirements.

Storage and access protection

Data is hosted on server infrastructure provided by Hetzner and operated by us. Google access and refresh credentials and cached message bodies use application-level authenticated encryption. Access to message metadata and local drafts is restricted by tenant-scoped authorization and operational access controls. These protections do not represent a claim that Google has completed verification or that an independent security assessment has been completed.

The current PostgreSQL database files, including transaction logs, and Redis persistence are stored on an encrypted filesystem. The retained pre-migration data-directory copy and legacy recovery files are protected as separately encrypted archives. Encryption keys remain on the server under restricted administrative access. We do not claim physical erasure of all historical copies or hosting-provider snapshots.

Authorized business users can access their business’s mailbox. Staff do not read email content for routine operation. Reading specific mail data requires the user’s affirmative agreement for that data, a necessary security investigation, or an applicable legal obligation. Data is not made available to another business’s users.

Retention and deletion

Message metadata and local drafts remain for the connected mailbox’s features until removed through the service or the account is disconnected. Cached message bodies normally have a seven-day validity period. Periodic expiry maintenance removes expired caches; tenant retention preferences, legal holds or an integrity problem can delay cleanup. Expiry is not a promise that every copy is physically erased at an exact hour.

The mailbox owner can disconnect in the dashboard’s email Accounts section or revoke access in Google account settings. A successful SARA disconnect erases stored connector credentials, redacts mailbox identity and removes the connector’s synchronized local messages, related caches, local drafts and scheduled-message payloads. It does not delete messages held in Gmail. Active sends, preservation holds or a failed cleanup can prevent completion; the panel reports an unsuccessful operation rather than claiming complete deletion.

If Google cannot confirm remote revocation, SARA still erases its local credentials and asks the owner to revoke SARA in Google account settings. Revocation at Google alone does not automatically remove SARA’s existing local records.

Content-free audit records and separately protected recovery copies have separate operational retention. Mailbox disconnection does not edit historical backup images. If you previously used email AI, any separate historical conversation records also require review. Contact us for a deletion request that includes recovery copies or historical records; we will identify the relevant records and explain any preservation obligations before closing the request.

Support and changes

For access, correction, deletion or privacy questions, contact sara@toplevel-ai.com. Material changes to Gmail data use require an updated notice and any additional consent required for the changed feature.