Privacy at InboxDraftWriter

Draft for legal review — Surge Software Solutions Pvt Ltd, Bengaluru.

What we read

Email headers and bodies in the mailboxes you connect, your sent mail (to learn your writing style) and your calendar's free/busy times.

What we store

• Message metadata (sender, recipients, subject, date, label) and — unless you choose metadata-only — the plain-text body, until your retention window ends (default 90 days).
• Drafts we wrote, bills we extracted, commitments and follow-ups.
• OAuth tokens, encrypted with AES-256-GCM.

What we never do

• We never train AI models on your email.
• We never send an email unless you, or an auto-send rule the workspace owner confirmed, do so.
• We never sell or share your data for advertising. Use of data from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

Where AI runs

First on Surge's own AI server in Bengaluru. Only if it is unavailable or its answer fails our checks do we fall back to Anthropic's Claude API, which does not train on API data. Choose Residency: Surge server to switch the fallback off entirely.

Your controls

Disconnect a mailbox to delete everything stored for it. Workspace owners can delete all data from Settings. Questions: [email protected].