Privacy policy

Isaac Business OS processes information entered or created by authorized workspace users, including account and profile information, professional contacts and companies, prospecting and outreach records, tasks, referrals, opportunities, mortgage workflow records, and operational measurements.

The application also processes the identifiers, status information, and audit history needed to operate connected services and preserve accountable business workflows.

The Gmail integration requests only the restricted OAuth scope https://www.googleapis.com/auth/gmail.readonly. This permission is read-only.

When an authorized user connects a mailbox, Business OS may read the mailbox profile, message and thread identifiers, history information, message headers, and message content needed to find known outbound messages and identify inbound replies from the corresponding business contacts. Unrelated or ambiguous messages are not intentionally added to Business OS records.

Business OS does not use the Gmail API to send email, modify messages or labels, or delete mailbox content.

Gmail data is used to reconcile sent-message identity and synchronize inbound replies that are relevant to known Business OS outreach. Matched replies become operational records so authorized users can review the response and decide on any follow-up.

If an authorized user deliberately requests reply classification, the relevant inbound reply and limited thread and business context are sent to the configured AI service provider to produce a user-facing classification proposal. The model request is made with provider storage disabled, and the proposal requires human review before it can drive a workflow decision.

Gmail data is not used for advertising. Isaac Business OS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Connected-mailbox metadata, synchronization checkpoints, matched message identifiers, and normalized reply records are stored in the application's database. Gmail OAuth refresh credentials are encrypted before storage and kept in a server-only data boundary that is not available to authenticated browser roles.

Access to internal records is restricted through authenticated sessions, workspace membership checks, role checks for privileged actions, and database-level row access controls. No method of storage or transmission is completely risk-free.

Information is disclosed to service providers only as needed to operate Business OS features, including application hosting, database services, and—if an authorized user requests classification—the configured AI service provider. Gmail data is not sent to the separate outbound email provider for Gmail reply synchronization.

Information may also be disclosed when required to comply with applicable law or protect the security and integrity of the service.

Operational records are retained while they are needed for the private business workflows and audit history maintained in Business OS. A fixed retention period is not currently codified.

Disconnecting Gmail removes the stored OAuth refresh credential and attempts to revoke it with Google. Disconnecting does not automatically delete reply records previously synchronized into Business OS. Requests concerning those records can be directed to the contact below and will be evaluated against operational and applicable legal requirements.

Gmail access begins only after an authorized workspace administrator completes Google OAuth for a mailbox that matches a trusted sender identity. Authorization can be revoked by disconnecting the mailbox inside Business OS or by removing the application's access from the connected Google Account.

After access is revoked, Business OS can no longer perform new Gmail synchronization unless the mailbox is authorized again.