Your email is never used to train AI
We don't train models on your email, and we don't let anyone else do it either. Email content goes to Anthropic's commercial API only to triage and draft for you; under Anthropic's commercial terms, API inputs and outputs are not used to train their models. Your mail is never sold or shared for advertising.
Who you're dealing with
Email Triage AI is built and operated by TelaLoom (ABN 65 366 917 788), Australia. TelaLoom is the contracting party for every plan, and our Terms are governed by the laws of New South Wales, Australia. Questions go to the contact form and reach a person, not a ticket queue.
Exactly what we can access
| Permission | Asked when | Why |
|---|---|---|
| openid, email, profile | Sign-in | Your name and email address, to create your account. |
| gmail.readonly | Connecting Gmail | Read incoming mail so it can be categorised, prioritised and summarised; read Sent mail for follow-up reminders, writing-style learning and the cold-email check. |
| gmail.modify | Connecting Gmail | Apply "Email Triage/…" labels and archive mail when you turn on mailbox sync, and send replies you approve (or that Autopilot sends, if you switch it on). It cannot permanently delete mail. |
| calendar.freebusy | Optional — only if you click "Connect calendar" | See when you are busy, to offer free meeting times in drafts. It shows busy blocks only: no event titles, attendees or descriptions. |
Microsoft
| Permission | Why |
|---|---|
| Mail.Read | Read incoming mail to triage it. |
| Mail.ReadWrite | Apply "Email Triage:" categories and move mail to Archive when you turn on mailbox sync. |
| offline_access | Keep working in the background without asking you to sign in again. |
Nothing is changed in your mailbox unless you turn it on: labels and archiving need mailbox sync, and nothing is ever sent without your click unless you enable Autopilot for a category. You can revoke access any time by disconnecting the account in Settings or at your Google / Microsoft account permissions page.
What we store, and for how long
- Sender, subject, date and the first 10,000 characters of each email body, so the dashboard, drafts and corrections work.
- AI results: category, priority, reasons, summaries and drafts.
- Your settings, rules, and any knowledge-base text or pages you add.
- Calendar: nothing. Busy times are looked up when a draft needs them and not saved; only the times offered in the draft are kept, as part of the draft.
- We do not store attachments.
Data is kept while your account is active. When you disconnect a mailbox or delete your account, the related data is permanently removed within 30 days.
Subprocessors
| Service | Purpose | Data involved |
|---|---|---|
| Anthropic (Claude API) | AI categorisation, priority, summaries and drafts | The email being processed (subject, sender, body up to ~4,000 characters); for drafts, matching snippets from your knowledge base and free calendar times |
| Sign-in, Gmail and (optional) Calendar access | OAuth tokens; API requests for your mailbox | |
| Microsoft | Sign-in and Outlook access | OAuth tokens; API requests for your mailbox |
| Stripe | Subscription billing | Name, email, billing details (we never see or store card numbers) |
| Brevo | Account emails and the daily digest | Your email address and the digest content (subjects, senders, priority reasons) |
| Cloudflare | Content delivery, DDoS protection, cookie-less analytics | Request metadata (IP address, user agent) |
| Contabo | Application servers and database hosting (EU) | Everything we store, encrypted in transit |
If you add your own Anthropic API key, AI calls for your account go to Anthropic under your own account instead of ours.
How it's protected
- OAuth tokens and your own API key (if you add one) are encrypted at rest with AES-256-GCM and only decrypted in memory when used.
- All traffic is HTTPS. We never see your Google or Microsoft password.
- Web pages you add to the knowledge base are fetched through a guard that refuses private and internal network addresses.
- Every prompt we send to the AI is published, byte for byte, on our transparency page.
Certifications
We don't hold SOC 2 or ISO 27001 certification. We'd rather say so plainly than imply it. If your organisation needs a security questionnaire answered, send it through the contact form.
See also our Privacy Policy and Terms.