Privacy Policy

1. Who we are

The Service is provided by Tothiq AI Services & Solutions, a company based in the State of Kuwait ("Tothiq", "we", "us" or "our"). Tothiq is the controller of the personal data described in this policy.

2. Information we collect

We collect the following categories of information:

• Account information. Your name, email address, language preference and the settings you choose.
• Email account data. When you connect a mailbox, we access it through the official interfaces of your provider (Google or Microsoft) using the permissions you approve. Depending on your request, this may include message headers, sender and recipient details, subject lines, message content, attachment names and folder or label information.
• Messaging platform data. When you link a messaging app such as Telegram, we receive your account identifier on that platform, the chat used to talk to the assistant, and the messages you send to it.
• Activity records. A record of the searches, summaries, drafts and sends performed through your account, so you can review what the Service did on your behalf.
• Technical information. IP address, browser and device type, and service logs needed to keep the Service secure and reliable.
• Communications. Information you provide when you join the waitlist, fill in the contact form or contact support.

3. How we use information

We use information only to:

• provide the features you request, such as searching your email, preparing summaries and briefs, drafting replies and sending the replies you approve;
• authenticate you and link your messaging accounts securely;
• maintain, secure and troubleshoot the Service, and prevent fraud and abuse;
• communicate with you about your account, early access and important changes;
• comply with applicable laws and lawful requests.

We process your data to perform our agreement with you, on the basis of your consent (for example, when you connect a mailbox), for our legitimate interests in operating a secure service, and to meet our legal obligations.

4. Google and Microsoft user data

Inbox Whisper's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We apply the same standard to data received from Microsoft.

• We use email data only to provide and improve the user-facing features of the Service that you have chosen to use.
• We do not use email data for advertising, and we do not sell it.
• We do not use email data to train general artificial intelligence or machine learning models.
• Our staff do not read your email, except where you give explicit permission for specific messages, where it is necessary for security purposes such as investigating abuse, or where required by law.

5. Artificial intelligence processing

To answer a request, the relevant parts of your email are processed by artificial intelligence models operated by carefully selected providers. These providers act only on our instructions, under contracts that prohibit them from using your data to train their models or from keeping it beyond what is needed to complete the request. AI-generated summaries and drafts may contain mistakes, which is why every outgoing message requires your approval.

6. Messaging platforms

When you use the assistant inside a messaging app, your messages and the assistant's replies are delivered through that platform's infrastructure and are also subject to that platform's own terms and privacy policy. You can unlink a messaging app at any time from your settings.

7. How we share information

We do not sell or rent your personal data. We share it only with:

• Service providers who host, secure and operate the Service, including cloud hosting and AI processing providers, under written agreements that require confidentiality and appropriate security;
• Authorities, where disclosure is required by law or necessary to protect the rights, safety or property of our users or others;
• A successor business, in the event of a merger, acquisition or sale of assets, subject to this policy.

8. International transfers

Our providers may process data in countries other than your own. Where this happens, we take appropriate measures to ensure your data receives an adequate level of protection, consistent with applicable data protection laws.

9. Data retention

• Email content is processed to complete your request and is not kept permanently. Temporary copies are deleted once the request is complete.
• Summaries, search indexes and drafts linked to a mailbox are deleted within 30 days after you disconnect that mailbox.
• Activity records are kept for 12 months unless you delete them earlier.
• When you close your account, your data is deleted within 30 days, and removed from backups within 90 days, unless we must keep certain records by law.

10. Security

We protect your data with encryption in transit and at rest, encrypted storage of the keys used to access your mailbox, the minimum permissions needed for each feature, strict access controls and monitoring. No system is completely secure, but we work continuously to protect your information and will notify you and the relevant authorities of any breach as required by law.

11. Your rights and choices

Subject to applicable law, you have the right to:

• access the personal data we hold about you and receive a copy of it;
• correct inaccurate data;
• delete your data or close your account;
• withdraw your consent at any time, including by disconnecting a mailbox or messaging app;
• object to or restrict certain processing.

You can exercise most of these rights directly from your settings, or by writing to us through our contact form. We respond within 30 days. You can also revoke Inbox Whisper's access from your Google or Microsoft account settings at any time.

12. Cookies

We use only the cookies necessary to keep you signed in, protect the Service and remember your preferences. We do not use advertising or cross-site tracking cookies.

13. Children

The Service is intended for users aged 18 and over and is not directed to children. We do not knowingly collect personal data from children.

14. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you through the Service or by email before the changes take effect. The date at the top of this page shows when it was last updated.

15. Contact us

For questions about this policy or your personal data, please write to us through our contact form.

Tothiq AI Services & Solutions
State of Kuwait