BoxieAI ("BoxieAI," "we," "us," or "our") provides an AI-powered email triage and reply tool that connects to your Gmail account. This policy explains what information we collect, how we use it, who we share it with, and the choices you have. By creating a BoxieAI account, you agree to the practices described here.
1. Information we collect
We collect the following categories of information:
Account information
- Your name, email address, and profile picture, provided by Google when you sign in.
- An internal BoxieAI account identifier.
Gmail data, via Google's API
When you connect a Gmail account, we request the following Google OAuth scopes:
- gmail.readonly — to read your inbox so BoxieAI can classify and summarize messages.
- gmail.send — to send replies and new messages you compose or approve inside BoxieAI, on your behalf.
- email and profile — to identify your Google account.
Using these scopes, we store:
- Message metadata: subject, sender, recipient, received date, Gmail labels, and read/starred/archived status.
- The plain-text body of each synced message, up to about 8,000 characters (HTML formatting removed). Attachments are never downloaded or stored.
- Your OAuth access and refresh tokens, encrypted at rest (AES-256-GCM), used solely to sync and send mail on your behalf.
BoxieAI's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
AI-generated content
To classify and summarize your email, each message's sender, subject line and body text (up to about 4,000 characters) are sent to OpenAI's API. Messages Gmail has already filed under Promotions or Social are sorted without being sent to OpenAI. If you move an email to a different category, that correction (the sender, subject and the category you chose) is included with future requests so the AI follows your preferences. OpenAI returns a category (Urgent, Opportunity, or Noise), a short summary, a suggested reply on paid plans, and a confidence score, which we store against the relevant message. OpenAI does not use data sent through its API to train its models. See Section 3.
Rules and preferences
Any categorization rules you create, and settings such as your default reply tone, auto-archive preference, and notification toggles.
Billing information
If you upgrade to a paid plan, our payment processor Paystack collects your payment details directly — BoxieAI never receives or stores your card number, CVV, or bank details. We store your subscription plan, billing interval, status, and Paystack's customer/subscription reference identifiers, which we need to manage your subscription.
Usage and device information
Standard technical information such as IP address, browser type, and access timestamps, collected automatically for security and troubleshooting.
2. How we use your information
- To operate the core product: syncing, classifying, summarizing, and letting you reply to email.
- To send AI-drafted replies and new messages only when you review and choose to send them — BoxieAI never sends email without your action.
- To enforce plan limits (e.g. the number of connected Gmail accounts, access to AI replies and custom rules).
- To process payments and manage your subscription.
- To detect, prevent, and address technical issues, abuse, or security incidents.
- To communicate with you about your account, service changes, or support requests.
We do not use your Gmail content to train AI/ML models, and we do not sell your data.
3. Who we share information with
| Recipient | What they receive | Why |
|---|---|---|
| OAuth authorization requests | Authentication and Gmail API access | |
| OpenAI | Email sender, subject line and body text, plus your category corrections | AI classification, summarization, and reply drafting |
| Paystack | Your email and billing selections (not card details) | Payment processing and subscription billing |
Each of these providers processes data under their own privacy policy and terms. We do not share your data with any other third party for marketing or advertising purposes.
4. Data retention
- Account and Gmail metadata are retained for as long as your account is active.
- Emails categorized as Noise are auto-archived after 7 days (unless starred) but remain in our database, soft-archived, until you delete your account.
- When you disconnect a Gmail account, we revoke our access with Google and immediately delete that account's OAuth tokens, emails and AI results.
- When you delete your BoxieAI account, we do the same for every connected Gmail account and also delete your profile, rules and settings.
- Billing records are retained as required by applicable tax and accounting law.
You can delete your account and all associated data yourself at any time from Settings — see Section 6.
5. Data security
OAuth access and refresh tokens are encrypted at rest using AES-256-GCM. Data in transit is encrypted via TLS. Access to production systems is restricted to authorized personnel. No method of storage or transmission is 100% secure, and we cannot guarantee absolute security.
6. Your rights and choices
- Revoke access: you can disconnect a Gmail account at any time from Settings, or revoke BoxieAI's access directly from your Google Account permissions page.
- Access and export: you may request a copy of the data we hold about you.
- Deletion: you can permanently delete your account and associated data at any time from Settings → Delete my account, or by contacting us.
- Correction: you may update your account information at any time.
To exercise any of these rights, contact us at [email protected].
7. International data transfers
BoxieAI and its service providers (Google, OpenAI, Paystack) may process and store data in countries other than your own, including the United States. We rely on our providers' own safeguards for cross-border transfers.
8. Children's privacy
BoxieAI is not directed to individuals under 18. We do not knowingly collect data from children.
9. Changes to this policy
We may update this policy from time to time. Material changes will be communicated by updating the "Last updated" date above, and where appropriate, by email.
10. Contact us
Questions about this policy or your data can be sent to [email protected].