Privacy policy

What we access

Aidenly accesses your Google account identity (for login and account setup), read-only access to your Gmail messages, and read-only access to your Google Calendar events. These are the only Google permissions Aidenly requests, and all data access is read-only — Aidenly never writes to your Gmail or Calendar.

What we store

Aidenly stores encrypted OAuth tokens, account metadata, and information derived from your email and calendar: AI summaries, memory entries, the preferences you confirm, and guidance on your writing style. For each email it reads, it also stores the subject line, the sender's address, and a short preview of the message (up to 500 characters), plus facts it extracts, such as names, dates, amounts and contacts. It stores sender and contact email addresses to personalize filtering and routing. When an email has a document attachment (PDF, TXT or Markdown) that Aidenly reads closely, it stores the full text of that attachment so it can answer questions about it. Aidenly does not store full email message bodies. All of this is deleted when you delete your account.

Where your data lives

Your full Gmail messages remain in your Google account. Aidenly reads them via read-only Google APIs only when needed, processes the full message in memory, and does not persist the full message body. It does store the short previews and derived data described above, along with account metadata, in Supabase-backed application storage. Recent request results may be cached briefly for continuity.

Who can access it

Access is limited to you, Aidenly systems that need the data to provide the service, and service providers used to operate the product. Human access for support or operational investigation is limited to what is necessary for the request and should avoid raw content whenever possible.

How we share your data

We do not sell your data, and we do not share it for advertising. We do not transfer or disclose your Google user data to third parties except as described below.

To operate Aidenly, we share data with a small set of service providers (subprocessors) who process it on our behalf, under contract, and only to provide the service — never for their own purposes:

• Google Cloud Platform (Cloud Run) — hosting and compute that runs the Aidenly backend.
• Supabase — the database that stores your derived memory (summaries, preferences, metadata), short email previews, and the full text of some document attachments. It does not store full email message bodies.
• AI model providers — Anthropic, OpenAI, and Google — email and calendar content is sent to these providers transiently to extract memory and generate responses. It is processed in memory for the request and is not retained by us as raw content.

We may also disclose data if required by law, to protect our rights or users' safety, or in connection with a merger or acquisition (in which case we will notify you and this policy will continue to govern your data).

Use of AI models and model training

Aidenly uses third-party AI models (from Anthropic, OpenAI, and Google) to read and reason over your content. Your Google user data is sent to these providers only through their business/API offerings, under terms that do not permit your data to be used to train or improve their models. Aidenly does not use your Google Workspace data (Gmail or Calendar content) to train, develop, or improve any generalized or non-personalized AI/ML models. Any learning Aidenly performs is specific to your account — to serve you — and is deleted when you delete your data.

Limited use of Google user data

Aidenly's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google user data only to provide and improve Aidenly's user-facing features. We do not use it for serving advertisements, and we do not transfer or sell it to data brokers, information resellers, or for any other purpose.

Retention

Derived intelligence, short email previews, and stored attachment text are retained until you delete them or request account deletion. Full email messages fetched from Gmail are processed in memory for the duration of the request and are not stored. Session cache data is short-lived, with a target lifetime of roughly 5 to 10 minutes.

Revocation and deletion

You can revoke Aidenly's Google access in your Google account permissions at any time. You can also email privacy@aidenly.ai to request deletion of stored derived data and account metadata. We respond to verified data access, deletion, or correction requests within 5 business days.

Google API scopes used by Aidenly

Aidenly requests only the Google scopes listed below, and every data-access scope is read-only. Aidenly reads your Gmail and Calendar to power the assistant; it never sends, deletes, drafts, or modifies your mail, and never creates, edits, or deletes calendar events. Aidenly's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• openid

  Verify your Google identity during sign-in.

• email

  Read the email address on your Google account to identify you.

• profile

  Read your display name and basic profile info for account setup.

• https://www.googleapis.com/auth/gmail.readonly

  Read-only access to your Gmail messages, threads, and labels. Aidenly reads your mail to extract the facts worth remembering and to answer your questions with context. It never sends, deletes, drafts, or modifies your mail.

• https://www.googleapis.com/auth/calendar.events.readonly

  Read-only access to the events on your Google Calendar. Aidenly displays your upcoming events so the assistant understands your day. It never creates, edits, or deletes calendar events.

Contact

This policy applies to Aidenly, Inc., a Delaware corporation (incorporation in progress). Privacy and data requests should be sent to privacy@aidenly.ai. Legal notices related to this policy should be sent to legal@aidenly.ai.