Privacy Policy

Last updated: August 3, 2026

1. Who we are

SANGI Tech Auto Response ("we", "us") provides automated reply tools for WhatsApp, email, websites, and e-commerce platforms. Contact: info@sangitech.com.

2. Information we collect

• Account info: name, email, profile photo.
• Messages, comments, and contacts you connect via Facebook, WhatsApp, Gmail, WordPress, or Shopify — used only to generate and send auto-replies on your behalf.
• Configuration data: bot prompts, FAQs, training content, API keys you provide.
• Usage logs for reliability and abuse prevention.

3. Google user data and Gmail scopes

We request only the minimum Gmail permissions required to operate the features you enable:

• https://www.googleapis.com/auth/gmail.modify — read the incoming messages in the connected mailbox so the assistant can understand the customer's question, and mark those messages as read / apply a label after a reply has been generated so the same email is not answered twice. A narrower scope is not sufficient because the app must both read message content and change message labels.
• https://www.googleapis.com/auth/gmail.send — send the auto-reply email from the user's own connected mailbox. This is the core user-facing feature of the product.

We do not request gmail.readonly (covered by gmail.modify), and we never request full-mailbox or delete permissions.

4. Limited Use disclosure

SANGI Tech Auto Response's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Google user data is used only to provide the user-facing auto-reply features described above.
• We do not sell, rent, or transfer Google user data for advertising or for any secondary purpose.
• We do not use, transfer, or allow the use of Google user data — raw, aggregated, derived, or anonymized — to create, train, fine-tune, or improve any foundational or generalized machine learning or AI model.
• Humans do not read Google user data except with your explicit consent, for security, to comply with law, or on aggregated anonymized data for internal operations.

5. AI processing of Google user data

When you enable AI replies, the text of the incoming email is sent to Google's Gemini API (Google AI / Generative Language API) solely to generate that single reply. Google's paid Gemini API terms state that prompts and responses submitted through the API are not used to train Google's models. No other third-party AI or ML provider receives Google Workspace user data. We do not send Google user data to OpenAI or any other model provider, and we do not retain prompts for model training of our own.

6. Data protection and security

• Encryption in transit: all traffic to our app and to Google APIs uses TLS 1.2+ (HTTPS only).
• Encryption at rest: our managed PostgreSQL database and backups are encrypted at rest with AES-256.
• Sensitive credentials: Google OAuth access and refresh tokens and any API keys you supply are stored server-side only, are never exposed to browser code, and are never logged. OAuth state values are HMAC-signed to prevent CSRF.
• Access control: row-level security isolates every account's data; only the authenticated owner can read their own mailbox data. Administrative access is restricted to a single named operator, protected by password authentication, and used only for support.
• Minimization: we store only the message metadata and body text needed to generate and audit a reply. Attachments and unrelated mailbox content are not downloaded.
• Monitoring & response: access and error logs are retained for abuse detection; suspected incidents are investigated immediately and affected users notified without undue delay.

7. Sharing

We share data only with the AI provider used to generate replies (Google Gemini API) and the infrastructure providers required to run the service (hosting, managed database). We do not sell your data.

8. Retention and deletion

We keep your data while your account is active. Disconnecting a Gmail account immediately revokes and deletes the stored tokens for that mailbox. You can request full deletion at any time — see our data deletion instructions.

9. Your rights

You can access, correct, export, or delete your data by emailing info@sangitech.com. You may also revoke our access at any time at myaccount.google.com/permissions.

10. Contact

Questions? Email info@sangitech.com.