Privacy Policy

1. Who we are

OneBoxflow (oneboxflow.com) is a collaborative inbox published by Pureplayer SAS. This page explains which data we process when you use the service, in particular when you connect a Gmail or Google Calendar account.

2. The data we access in your Google account

When you click "Connect Gmail", you authorize OneBoxflow, and only if you accept it on Google's screen, to:

• read, organize and modify your Gmail messages (gmail.modify): display your messages, threads, labels and attachments, mark them as read, archive them, apply labels, move them to trash or spam at your request;
• send messages on your behalf (gmail.send), only when you click Send or schedule a message;
• read and create events in your calendar (calendar.events), to show your appointments and create the ones you schedule from OneBoxflow;
• know your email address and name (userinfo.email, userinfo.profile, openid), to identify the connected mailbox.

If you use "Continue with Google" to sign in, we only receive your email address and name.

3. Why we use this data

Only to provide the features you use in OneBoxflow: displaying and searching your messages, sorting them, sharing them with the team members you invited, replying, sending, and assistance features (automatic categorization, summaries, suggested replies). We do not sell your data, we do not use it for advertising and we do not read it manually, except at your explicit request for support, for security, or when required by law.

4. Google API data — Limited Use

OneBoxflow's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google API Services User Data Policy

In particular: Gmail data is only used for user-facing features; it is never used to train generalized artificial intelligence models, nor transferred to third parties except to operate these features, for security, or to comply with the law.

5. Artificial intelligence features

Categorization, summaries and suggested replies send the necessary content (sender, subject, message excerpt) to a language model at the time the feature runs, solely to produce the displayed result. This model is hosted on our servers or, depending on the feature, by a model provider acting as a sub-processor (OpenRouter).

6. Storage and security

• Your data is hosted on our own servers, located in the European Union (Germany).
• Google access tokens are encrypted at rest (AES-256-GCM); they are never displayed or sent to your browser.
• Connections are encrypted in transit (HTTPS/TLS). Access to each organization's data is isolated: a member only sees the mailboxes of their organization.

7. Retention

Synced messages are kept as long as the mailbox stays connected. Your organization's administrator can set retention periods ("Retention" settings); trash and spam are emptied after 30 days by default.

8. Deleting your data

• Disconnecting a mailbox (Settings → Mail accounts) deletes the mailbox and all synced messages, threads and folders attached to it, along with its access tokens.
• Deleting your account (Settings → Privacy) deletes your connected mailboxes and their messages, your drafts and pending sends, anonymizes your profile and removes you from your organizations. You can also export your data there.
• You can revoke OneBoxflow's access to your Google account at any time at myaccount.google.com/permissions.
• Backup copies are erased as they rotate, within 30 days.

9. Your rights

Under the GDPR, you have the right to access, rectify, erase, port and object. You may also lodge a complaint with the French data protection authority (CNIL, cnil.fr).