Proflow Holding

Privacy Policy

Last updated 2 August 2026

Proflow Holding operates internal software for the private use of its owner and staff. These applications are not offered to the public and have no external user base. This policy explains what data they touch and how it is handled, with particular attention to Google user data, as required by the Google API Services User Data Policy.

Who this covers

The applications described here are single-operator tools. Access is restricted to an explicit allowlist of accounts belonging to Proflow Holding. No third party can create an account, authorise the application, or obtain access to data held by it.

Google user data we access

With the account owner's explicit consent, our internal mail assistant requests the gmail.modify scope against mailboxes owned by the operator. It uses that access to:

• read and search messages, in order to summarise and triage them;
• create drafts, which are never sent automatically and always await human review;
• apply and remove labels, including archiving a message by removing it from the inbox.

The application deliberately implements no capability to send or permanently delete mail. Every action it can take is reversible by the account owner.

We also request openid and email to confirm the identity of the person connecting, so access can be refused to anyone outside the allowlist.

How the data is handled

• Storage. Message content is not copied into any database or archive. It is fetched from Google on demand, used to answer the request at hand, and discarded. Only OAuth refresh tokens are stored, on private infrastructure, with filesystem permissions restricting them to a single system account.
• Processing. Message content is passed to an AI assistant (Anthropic's Claude) so it can summarise, classify, and draft replies. Anthropic processes this content under its own terms and does not use business-tier API data to train models. This is the only third party that ever sees message content.
• Transfer. All traffic is encrypted in transit over HTTPS.
• Disclosure. We do not sell, rent, or share Google user data. It is not used for advertising, profiling, or any purpose beyond the operator-facing features above.
• Human access. Only the account owner can reach the data. Access requires passing a Google sign-in whose result is checked against the allowlist.

Limited Use

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Retention and revocation

Because message content is never retained, revoking access removes our ability to read anything further. The account owner may revoke it at any time at myaccount.google.com/permissions, which immediately invalidates the stored tokens. Stored tokens are deleted when an application is decommissioned.

Other data

This website itself sets no cookies, runs no analytics, and collects no personal information from visitors.

Contact

Questions about this policy: contact@proflowholding.com.