Privacy Policy

AdaptoInbox is operated by AdaptoIT LLC. It connects to your Gmail or Microsoft 365 mailbox and uses AI to sort, categorise and flag your email according to rules you define.

This policy explains exactly what we access, what we send elsewhere, what we keep, and how to make us delete it.

When you connect a mailbox you grant specific permissions. We request the narrowest set that makes the product work:

• Read and modify mail, to read incoming messages so they can be categorised, and to move, label, flag or archive them as your rules direct.
• Mailbox settings (Microsoft only), to create your categories in your mailbox so they appear in colour in Outlook.
• Send mail, used only to send your own daily briefing to you, and only if you turn it on.
• Calendar, to show your agenda and to create events when you turn an email into one. We only read and write events; we never create, delete or share calendars themselves.
• Tasks (Microsoft 365 only), to add a follow-up to your to-do list when you ask.

We never read mail in a mailbox you have not connected, and disconnecting an inbox stops all access to it immediately.

Categorising email requires a language model to read it. For each incoming message we send:

• The sender's name and address
• The subject line
• The first 1,000 characters of the message body

We do not send the full message body for categorisation, and we do not send attachments at any point.

When a message needs a reply, we send the subject and the first 2,000 characters of that one message so a draft can be written. This happens automatically for mail we flag as needing a response, and on demand whenever you press “Draft reply”. You can turn the automatic drafts off at any time in Settings. If you are waiting on a reply to something you sent, we may also write a short follow-up nudge. For that we send only the subject line and the recipient's name, never any message body. In every case the result is saved to your Drafts folder for you to review: nothing is ever sent automatically, and nothing is ever deleted.

So that those drafts sound like you rather than like a machine, we also read a small number of your most recent sentmessages and keep short excerpts of them as writing samples. These are your own words only. We remove the quoted parts of a reply so that nobody else's writing is kept, and they are used for nothing except shaping the drafts we write for you. They are refreshed about once a week and deleted when you disconnect the mailbox.

On adaptoinbox.com the model is Claude, operated by Anthropic. Content sent to Anthropic's API is used solely to return a result to you. It is not used to train Anthropic's models or ours. For customers on a dedicated deployment, the model runs inside your own Microsoft Azure subscription and your email content never reaches our infrastructure or Anthropic's at all.

For each processed message we keep a record containing:

• The sender's name and address, the subject line, and when it arrived
• The message's ID in your mail provider, so we don't process it twice
• Which categories were assigned and what action was taken

We do not store the body of your incoming email. The preview sent for categorisation is held in memory for the duration of the request and is never written to our database.

The one exception is the writing samples described above: short excerpts of mail yousent, kept so that drafts sound like you. They are never shown to our staff, never used for anyone else's drafts, and removed with the mailbox.

We also store your account details, the categories and rules you create, your follow-up list, and your conversations with Ada, our setup assistant.

Access tokens for your mailbox are encrypted at rest using AES-256-GCM with a key held separately from the database.

AdaptoInbox's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we do not:

• Sell, rent or trade your Google user data to anyone
• Use it for advertising, or transfer it to advertising platforms or data brokers
• Use it to develop, improve or train generalised AI or machine-learning models
• Allow humans to read it, except with your explicit consent for a specific support request, where required by law, or where necessary for security purposes such as investigating abuse

Google user data is used only to provide and improve the features you can see in the product.

We use a small number of providers to run the service. Each processes data only to deliver the service to you:

• Vercel, hosting for the application
• Neon, the database where your records are stored
• Anthropic, the Claude model that categorises email and drafts replies
• Google and Microsoft, your mail provider, accessed with the permissions you granted
• Stripe, payment processing, if and when paid plans are introduced. Stripe receives billing details; it does not receive your email data.

We do not sell your data, and we do not share it with anyone for their own purposes.

By default, processing records are kept while your account is open so the product can show your history and avoid reprocessing the same message.

You can set a retention period. In Settings, choose to keep your history for 3, 6, 12 or 24 months and anything older is deleted automatically, every day, without you having to ask. This covers what we store about your mail: senders, subject lines, what was filed where, along with your follow-up history, your conversations with Ada, the writing samples described above, and any meeting notes you uploaded.

If you have connected more than one inbox, you can also set a shorter period for one of them on its own. A per-inbox period covers that mailbox's filing history, follow-ups and reply watches. Your conversations with Ada and any meeting notes you uploaded do not belong to a single inbox, so they follow your account-wide setting.

Two things are deliberately left alone. Your categories and rules are configuration you built, not history, so they are never removed by retention. And a follow-up that is still open stays until you close it. Deleting an outstanding task because it had got old would quietly take something off your list.

Deleting your account permanently deletes your data. Use Delete Account in Settings. This removes your user record and everything attached to it: connected mailboxes and their stored tokens, categories, rules, processing history, follow-ups and chat history. It is immediate and cannot be undone.

Disconnecting a single mailbox removes that mailbox's stored tokens and ends our access to it, while leaving the rest of your account intact.

You can also revoke our access directly at any time, from your Google account permissions or your Microsoft account.

Nothing we delete on our side changes your actual mailbox. Emails we moved or labelled stay where they are, in your control.

Mailbox tokens are encrypted at rest. All traffic is served over HTTPS. Access to production systems is limited to the people who operate the service.

No system is perfectly secure. If we discover a breach affecting your data, we will notify you.

Depending on where you live you may have rights to access, correct, export or delete your personal data, and to object to certain processing. Account deletion is available to everyone, immediately, in Settings. For anything else, contact us and we will action it.

AdaptoInbox is not intended for anyone under 16, and we do not knowingly collect their data.

If we change this policy we will update the date at the top. If a change materially affects how we handle your email data, we will tell you in the product before it takes effect.

Questions about privacy, or a request about your data: privacy@adaptoinbox.com

AdaptoIT LLC