Inbox Agent
Privacy Policy
1. Who we are, and what this covers
Inbox Agent is an internal email-triage service operated by Loop Resource Ltd. (“Loop Resource”, “we”, “us”), a corporation registered in British Columbia, Canada. It is made available to Loop Resource leadership and other authorized personnel (“you”) at inbox-agent.loopresource.ca.
This policy explains what personal information the service collects, why we collect it, who it is disclosed to, how long it is kept, how it is protected, and how to reach us. It covers the Inbox Agent service only — not Google Workspace, Slack, or any other system you use separately.
2. Information we collect
We collect only what the service needs in order to triage your mail and alert you.
- Account and identity
- Your Google account email address and display name, captured when you sign in with Google, and a cookie identifying your signed-in session.
- Email data from your mailbox
- For each new message in a mailbox the service has been authorized to watch: the Gmail message and thread identifiers, the sender, the recipients (To and Cc), the subject, the date, and the Gmail labels on the message; a short preview of the text; and, where the configured logging level captures it, the message body. Bodies are encrypted before they are stored.
- Classification decisions
- The priority tier assigned (ULTRA, HIGH, NORMAL or LOW), the category, a confidence score, the short reason given, which model produced the decision, the tokens and cost it consumed, and a fingerprint of the instructions in force at the time. We also record which alerts were sent, on which channel, whether they were delivered and acknowledged, and any correction you make.
- Your settings
- The triage instructions and guidance text you write, your notification preferences and quiet hours, retention preferences, and any delegate arrangements you set up.
- Contact details for alerting
- Your Slack user or channel identifier, if you connect Slack; and your mobile telephone number, only if you choose to turn on SMS alerts. See section 5.
- Operational records
- Timestamps, run outcomes, error details, and an audit trail of administrative actions taken on your account.
We do not buy or collect information about you from data brokers or other third parties, and we use no advertising, analytics or tracking cookies. The only cookies set are the session cookie that keeps you signed in and, where an administrator is acting on your account with authorization, a short-lived cookie recording that fact.
3. How we use it
- To classify each incoming message into a priority tier and apply the corresponding
Priority/*label in Gmail. - To alert you about interrupting mail on the channels you have chosen, and to batch lower-priority mail into a summary.
- To track follow-ups, reminders and messages that appear to await your reply.
- To give you a reviewable log of every decision made about your mail, and to suggest refinements when you correct one. Nothing is applied automatically — you confirm each change.
- To operate the service: detecting failures and stalled jobs, monitoring alert rates for anomalies, retrying work that failed, and keeping model costs within budget.
- For security, troubleshooting and audit.
We do not use your email content for advertising, for profiling unrelated to triage, or to train our own or a third party’s models.
4. Who we disclose it to
We use the following service providers, each processing data on our instructions and only for the purpose shown:
- Google LLC — the Gmail API and Cloud Pub/Sub: the source of your mail and of the change notifications that drive the service.
- Our language-model provider (currently one of OpenAI, Google or Anthropic, configurable by the operator) — classification. Only the sender, recipients, subject and the message text needed to judge priority are sent. Where the provider offers zero-data-retention endpoints, those are used.
- Slack Technologies, LLC — delivery of alerts, digests and nudges to your Slack account.
- Twilio Inc. — delivery of SMS alerts and one-time verification codes. Twilio receives your telephone number and the text of the message, which contains the priority tier, the sender and the subject. It never contains the body of an email.
- Railway Corp. — hosting of the application, its database and its queue.
Some of these providers are located in the United States, so your information may be stored or processed outside Canada, where it may be accessible to the courts and authorities of that jurisdiction.
We may also disclose information where we are required to by law, or where it is necessary to investigate a security incident or a breach of the Terms.
We do not sell your personal information. We do not rent, trade or otherwise disclose it to third parties for their own marketing purposes.
5. Mobile telephone numbers and SMS
SMS alerting is optional and off unless you turn it on. This section describes it specifically, because a telephone number deserves clearer treatment than a general statement.
- You opt yourself in. You enter your own mobile number on the Configure page and confirm a one-time code sent to that number. Until that code is confirmed, the number is held as unverified and receives nothing. No one else can enrol a number on your behalf.
- What we send. Transactional alerts about your own mailbox: one-time verification codes, alerts for mail classified ULTRA, reminders about an alert you have not yet acknowledged, and — if you agree to cover for a colleague — their relayed ULTRA alerts. We never send marketing, promotional or advertising text messages.
- What the message contains. The priority tier, the sender and the subject line. Never the body of the email.
- Who your number goes to. Twilio, our messaging provider, and no one else, solely to deliver the messages above.
- How to stop. Reply STOP to any message, or remove the number on the Configure page. Removing it deletes it from your settings.
No mobile information is shared with third parties or affiliates for marketing or promotional purposes. Your consent to receive text messages is never sold, rented, shared or transferred to any third party for any purpose.
The full messaging terms — programme description, frequency, cost, HELP and STOP instructions — are in section 6 of the Terms & Conditions.
6. How long we keep it
Deletion runs automatically, once a day, against these defaults:
- Captured message content (preview and, where captured, body): 30 days.
- Decision records (tier, category, reason, model, alert outcome): 365 days.
- Operational run records: 90 days.
These windows can be shortened for an individual on request. A legal hold may suspend deletion where we are required to preserve records. Disconnecting stops all processing immediately; records already held age out on the schedule above unless you ask us to delete them sooner. On request, an administrator can delete all of your data outright — which removes every per-person record, keeping only the administrative audit entry recording that the deletion took place.
7. How we protect it
- Message bodies and Google refresh tokens are encrypted at rest with an authenticated symmetric cipher; the key lives in the deployment’s secret store, never in source code.
- All traffic to the service is over HTTPS.
- The service holds no permission to send or delete email. It can read mail, and — only for a mailbox whose owner has consented — modify labels. No send or delete permission is requested anywhere, so it is not technically capable of sending mail as you.
- Access is least-privilege and split: broad access is read-only; the ability to write labels requires that person’s own consent, which they can withdraw at any time.
- Inbound webhooks are cryptographically verified (a signed Google identity token for mail notifications, an HMAC signature for Slack) so events cannot be forged.
- Reading a stored message body requires a separate administrative credential, and each read is itself recorded.
- Patterns configured as sensitive are redacted from message text before it is stored.
- Sensitive administrative actions are written to an audit trail that outlives the account.
No system is perfectly secure, and we cannot guarantee absolute security.
8. Your choices and your rights
Under Canada’s Personal Information Protection and Electronic Documents Act and British Columbia’s Personal Information Protection Act, you may access the personal information we hold about you, ask us to correct it, withdraw your consent, and complain about how we handle it.
- See what we hold. Your decision log shows every decision the service has made about your mail, and you can correct any of them.
- Withdraw consent. Disconnect on the Configure page revokes our access to your mailbox immediately and stops all labelling and alerting. Replying STOP, or removing your number, ends SMS.
- Copy, correction or deletion. Write to privacy@loopresource.ca. We will respond within 30 days.
- Complain. Please contact us first. You may also complain to the Office of the Privacy Commissioner of Canada, or to the Office of the Information and Privacy Commissioner for British Columbia.
9. Children
The service is a workplace tool. It is not directed to, and may not be used by, anyone under 18. We do not knowingly collect personal information from children.
10. Changes to this policy
We may update this policy. The date at the top always reflects the current version, and we will give notice in the application or by email before a material change takes effect.
11. Contact us
Questions, requests and privacy complaints go to our Privacy Officer at privacy@loopresource.ca — Loop Resource Ltd., British Columbia, Canada.