How your mail data moves

1. 1

   You connect a mailbox

   You grant a minimum set of Google scopes — read mail, label it, send drafts you approve, and read calendar availability. Read-only is the default; we ask for nothing we do not use.

2. 2

   Your mail syncs into your account

   We pull the messages, headers, and metadata needed to show your inbox, sort it, and prepare a brief. A local cache keeps things fast; it is never the system of record and clears when you sign out.

3. 3

   AI reads what a feature needs

   When you ask for triage, a brief, a summary, or a draft, the relevant excerpts — not your whole mailbox — go to OpenAI's API directly. OpenAI does not train on them and keeps them for up to 30 days for abuse monitoring. We also run shadow checks: we send an incoming message's excerpt to a second decision model, from TypeSafe, to compare its triage answers with ours. We record the results and never act on them.

4. 4

   Search reads your mail by meaning

   To find mail by meaning, we send each message you send or receive to Voyage AI: the subject and the first 8,000 characters of the body. Thread digests, contacts, agent summaries and your search queries go too. Voyage may use the mail it receives to train and improve its models, and publishes no fixed retention period.

5. 5

   Results become objects you own

   Briefs, summaries, drafts, and receipts are saved in your account as things you can read, edit, and delete. Every AI answer carries source receipts so you can see what it read.

6. 6

   Nothing leaves without your say-so

   Drafts are suggestions until you approve them. Sending mail always requires an explicit confirmation. Reversible actions like archive can be undone. nagu never sends on its own.

We request the minimum scopes for the features you use, and we explain each one. Read-only is the default posture where it applies.

• Read your mail — so your inbox, briefs, summaries, search, and triage reflect what is actually there.
• Label and archive — so approved triage syncs back to Gmail (and stays reversible).
• Send drafts you approve — only after you confirm the send, never on our own.
• Read calendar availability — so briefs and drafts can be schedule-aware, without ever changing your calendar.

The full scope-by-scope justification is in the Privacy Policy.

When a feature needs a language model, the request goes to OpenAI directly; the gateway is a fallback route only, and TypeSafe runs shadow checks whose answers are recorded and never acted on. Voyage builds the search index and may train on what it receives; every other route carries a no-training posture. This list is generated from the same runtime manifest that routes live traffic, so it matches what is actually in use.

• OpenAI — Language-model processing for triage, briefs, summaries, reply drafts, and classification decisions, called directly.
• Vercel AI Gateway — Fallback routing only, used when the direct OpenAI route is not configured. Not a model-training destination for your content.
• Anthropic — Language-model processing only when a request is routed to Anthropic through the gateway fallback.
• TypeSafe — Shadow checks only: its answers are recorded to compare with our own and never change what happens to your mail.
• Voyage AI Innovations, Inc. — Search by meaning. It receives the text of mail we index and your search queries, and may use them to train and improve its models.

The full table, with regions and retention, is on AI processors.

These are three different things, and we keep them separate:

• We do not train general AI models on your mail.
• nagu learns your voice and habits only for your own features — a per-user model that is yours, account-scoped, and clearable any time.
• OpenAI and the fallback providers do not train on your content by their terms, and TypeSafe does not by its published privacy policy. Voyage, which builds the search index, may use the mail it receives to train and improve its models.

Retention is precise by surface: OpenAI keeps AI requests for up to 30 days for abuse monitoring, TypeSafe keeps shadow-check requests and Voyage keeps search-index requests for as long as each needs to run its service, with no fixed period published, the objects you create stay until you delete them, and the local cache clears on sign-out. The full breakdown is in the Privacy Policy. You can export or delete your data any time by contacting help@creative-int.com.