Privacy Policy

What RepeatDesk does

RepeatDesk connects to a business's Gmail account to read incoming customer emails, match them against a knowledge base the business uploads, and draft or send automated replies. This policy explains what data we collect, why, and how it's handled.

Data we access and why

When a business connects their Gmail account, we request access to read unread messages and send replies on their behalf, using Google's OAuth authorization flow. We only access the Gmail account the business owner explicitly connects. We do not access any other Google service or any other account.

Email content (subject lines and message bodies) is read to determine whether a message needs a reply, and to generate that reply using an AI model. Email content is not stored permanently — only a record that a given message was processed, plus summary metadata (subject, sender, whether a reply was sent), is retained for the business's own activity history.

Gmail refresh tokens, which allow us to maintain the connection without repeated logins, are encrypted at rest using AES-256-GCM before being stored. They are never logged or exposed in plaintext.

Documents you upload

Businesses may upload PDF documents (like FAQs or policy documents) to build a knowledge base for their AI agent. These documents are stored securely and processed to generate replies grounded in the business's own content. Uploaded documents are only used to serve that business's own automated replies and are never shared across businesses.

Third parties we use

We rely on the following service providers to operate RepeatDesk:

• Google — for Gmail account access via OAuth, to read and send email on the connected account.
• OpenAI — to generate embeddings for uploaded documents and to classify and draft email replies.
• Supabase — for account authentication and data storage.
• Resend — to deliver account-related emails (signup verification, password resets).
• Vercel — to host the application.

Each of these providers processes data only as needed to provide their respective service to us, and is bound by their own privacy and security commitments.

Data retention and deletion

A business can disconnect their Gmail account at any time from Settings, which stops all further email access immediately. A business can delete uploaded documents at any time. To request full account deletion, including all associated data, contact us at the email address below.

Your rights

You may request access to, correction of, or deletion of your personal data at any time by contacting us. We will respond to verified requests within a reasonable timeframe.

Changes to this policy

We may update this policy as RepeatDesk evolves. Material changes will be reflected by updating the "Last updated" date above.

Contact

Questions about this policy or your data can be sent to hello@repeatdesk.com.