Privacy Policy

1. Who we are

• Service operator: Opsaflow SAS, operating Dioveo
• Address: 60 RUE FRANCOIS IER 75008 PARIS
• Privacy contact: [email protected]

Opsaflow SAS is the controller for account administration, billing, support, security, and optional analytics. For mailbox-derived data processed on your documented instructions, we act as a processor as described in the Data Processing Addendum in Section 22 of our Terms of Service. The applicable role depends on the purpose and circumstances of the processing.

2. Scope

This Policy applies to our website, application, Gmail companion tools, attachment Library, downloads, connected cloud destinations, document extraction, semantic search, MCP connections to AI assistants, workflows, support, and product communications. A feature processes data when you request it or enable an automation that uses it.

3. Data we collect

a) Account & billing

• Name and email address (sign-in is via Google; we do not store passwords).
• Subscription status, invoices, and limited payment metadata from our payment processor (we do not store full card numbers).

b) Email integrations (Gmail / Google Workspace)

If you connect a Google account, we access data only to provide the features you enable. For example:

• Message metadata: sender, recipients, subject, date, labels, and size.
• Message preview line: the short preview Gmail itself generates for a message, stored alongside the index so you can recognise an attachment by the mail it arrived in. We do not read, extract, or store the body of your emails.
• Attachment metadata: type, size, and filename, processed securely when required for search or attachment management features.
• OAuth tokens: stored encrypted at rest; their values are never included in data exports.

Changes we make in your mailbox. Dioveo can move a message to Trash, add a label, mark it as read, or archive it. Each of these happens only when you ask for it, either by using that action in the app or by configuring a workflow that applies it. Dioveo never moves, deletes, or alters mail on its own, and reading or downloading your attachments changes nothing in Gmail.

You can disconnect your Google account at any time from within Dioveo or directly in your Google Account → Security → Third-party access.

b1) File integrations (Dropbox, Google Drive, OneDrive)

If you connect a file storage provider (Dropbox, Google Drive, or OneDrive) for workflow automation, Dioveo only uploads files that you explicitly select or that originate from your email attachments as part of enabled workflows.

To let you choose a destination, Dioveo can list folder names, identifiers, and paths in your connected storage account. Cloud saving does not require reading the contents of unrelated files already stored there.

Access is limited to the minimum data strictly required to perform the upload action, including:

• Folder metadata used by the destination picker, and the destination folder you choose
• File metadata necessary for upload (such as filename and file size)
• OAuth tokens required to authenticate and authorize the upload

We also keep delivery status, destination paths, and provider file identifiers needed to track uploads and avoid repeating completed deliveries. Files already delivered to your cloud account are governed by that provider's settings and are not removed by clearing Dioveo's extraction cache.

OAuth tokens for all file storage integrations are stored securely and encrypted at rest, with the same protections across all providers.

You may disconnect any file storage integration at any time from Dioveo settings or directly from the provider's account settings (for example, under "Connected Apps").

b2) Document extraction, semantic search, and AI assistants

When you ask Dioveo to read an attachment, extract fields, populate a spreadsheet, or run an extraction workflow, we fetch the selected attachment from Gmail and process its contents. Depending on the document, this includes native text extraction, optical character recognition (OCR), or structured field extraction. Requested AI field extraction and semantic search use Amazon Bedrock, configured for EU processing, including an EU geographic inference profile where applicable.

• Raw extracted text: page-linked text and technical extraction metadata, such as file type, method, page count, processing status, and expiry date.
• Structured results: only the fields requested by you or an enabled workflow, together with status, source excerpts, page references, and processing-usage metadata.
• Semantic search: extracted passages and numerical representations of their meaning (embeddings), linked to your account and source documents. We send selected extracted text and semantic search queries to the embedding provider to index documents and find relevant passages. These representations are derived data, not a guarantee of anonymity.
• Collections and comparisons: saved document selections, filters, filenames and source references, processing runs, requested fields, results, errors, and retention dates. Exact-duplicate checks use file-content fingerprints; revision comparisons use extracted fields and their evidence.
• AI-assistant access: a compatible assistant can access Dioveo only after you approve its OAuth permissions. It receives the results of the tools it calls; connecting an assistant does not automatically send your mailbox or attachment index to it.
• Connection and usage records: client identifiers, authorized scopes, authorization and refresh-token records, approval records, and processing counters needed to enforce permissions and plan limits. Credentials are excluded from account-data exports.

Bedrock receives the text needed for the requested extraction or embedding, and semantic search queries. Redaction of assistant responses happens separately; it does not mean the model provider receives anonymized input. Model-provider retention and processing depend on the model and service configuration. We do not promise zero provider retention for every model or service.

The AI assistant you choose is a separate recipient. Its provider and your workspace settings govern copies it receives, including its own storage, international processing, and any use for model improvement. Review those terms before connecting it. Revoking Dioveo access stops future authorized requests but does not delete information already received by that assistant.

Recognized bank details, payment cards, identification numbers, birth dates, addresses, contact details, person names, private links, and strongly identified health or payroll content are redacted from AI-assistant text and structured results by default. Automated detection can miss or misclassify information, so this is an additional safeguard, not a guarantee of anonymity. Releasing unredacted text requires confirmation of the specific request in Dioveo. Search excerpts and spreadsheet exports remain subject to redaction. Original-file downloads use a separate permission and contain the original, potentially sensitive values; the text-release confirmation is not an approval step for each original download.

When unredacted content is explicitly released, Dioveo records the account, tool, number of referenced documents, detected category labels, and confirmation time for accountability. The released values are not copied into that audit record.

MCP can prepare collections, exports, downloads, and workflow drafts within the permissions you approve. A draft must be reviewed and activated in Dioveo before it processes future matching attachments. Automated extraction and comparison can be inaccurate; review evidence before using results for consequential decisions.

c) Product usage

• App events (clicks, views), device/browser info, IP-based coarse location (city/region), crash logs.
• Cookie/LocalStorage identifiers for sessions and preferences (see Cookies).

d) Support & feedback

• Messages you send us and any files you attach.

Sensitive correspondence. Your mailbox may contain health information or other sensitive data, including in senders, subjects, and filenames. Processing on your instructions can include that data and derived text, fields, or embeddings. Professional customers are responsible for the applicable lawful basis and any special-category condition for their processing. Google OAuth and assistant permission screens authorize technical access; they do not by themselves establish GDPR consent or a lawful basis for another person's sensitive data. Personal or household exemptions do not remove our own obligations.

e) Public Gmail query translator

If you use our public natural-language Gmail query translator, the description you type is sent to Amazon Bedrock in the EU solely to generate a Gmail search query. The tool does not connect to or read your Gmail account, and Dioveo does not save your description or generated query in its database.

To prevent abuse, we transform your IP address into a one-way hash and keep only a daily request counter in Redis. The counter and hash expire automatically after the next 00:00 UTC reset.

4. Google API disclosure (Gmail/Workspace)

• We comply with the Google API Services User Data Policy, including Limited Use requirements.
• Gmail/Google Workspace data is accessed only to provide user-facing features, including attachment search, extraction, semantic indexing, collections, downloads, approved assistant access, and workflows you configure.
• We do not use Google data for advertising and do not sell personal data.
• Transfers for these features include service providers acting on our instructions and the cloud destinations or AI assistants you authorize. Other disclosures are limited to what Google's Limited Use rules and applicable law permit.
• Human access to Google data is rare, limited to security/abuse prevention or support you request, and is logged and restricted.
• We request least-privilege OAuth scopes and store OAuth tokens encrypted at rest; data is protected in transit with TLS.
• Requested features can retain extracted text, structured results, semantic embeddings, saved collection results, and prepared downloads as described below. Generating results or embeddings with an existing model is not a model-training feature.
• You can revoke access at any time in Dioveo settings or via Google Account → Security → Third-party access.
• We do not read emails for unrelated purposes and do not make automated decisions with legal or similarly significant effects.
• On disconnection or account closure, data is handled per our retention policy (see Section 10).

5. How we use data (purposes & legal bases)

• Provide & operate the Service: administer your account and provide requested search, extraction, semantic indexing, collections, downloads, assistant access, and workflows.

  Legal basis: Performance of a contract for our controller activities. For mailbox-derived processing carried out as a processor, we follow your documented instructions; the relevant controller determines its lawful basis.

• Safety & integrity: authentication, abuse/fraud detection, troubleshooting, securing tokens, preventing misuse.

  Legal basis: Legitimate interests and/or legal obligation.

• Optional audience measurement: usage analytics and related cookies used to understand how the product is used.

  Legal basis: Consent. Essential operational monitoring needed to secure and run the service is handled separately under the safety and integrity purpose.

• Billing & support: payments, invoicing, tax compliance, responding to support requests.

  Legal basis: Contract / legal obligation.

• Optional updates: product tips, feature announcements, onboarding messages you opt into.

  Legal basis: Consent and/or legitimate interests (you can opt out anytime).

• Your choice: You may withdraw consent at any time in settings or by emailing [email protected].

6. Library organization

• Library folders are created and filled manually by you.
• When automatic classification is enabled, Dioveo can use message subjects, attachment filenames, preview snippets, redacted excerpts of document text, or an image of a document’s first page to suggest categories. Content-based classification sends these inputs to Amazon Bedrock using an EU region. First-page images are not automatically redacted and may contain personal or sensitive information. Requested document extraction and semantic search also process attachment contents as described in Section 3. Moving items into Library folders follows your actions or configured workflows.
• Moving an attachment into a Dioveo folder does not move or change anything in Gmail.

7. Sharing & sub-processors

We use the following service providers and integrations. Providers processing data on our behalf are subject to applicable processing agreements. Services you connect yourself can have a separate role under their own terms:

• Hosting & databases: Hetzner (Germany)
• Network & DNS: Cloudflare, which proxies traffic to our site and so sees connection data such as your IP address
• Authentication, Gmail & Google Drive: Google
• Payments: Stripe
• Object storage for prepared downloads, backups, and operational records: DigitalOcean Spaces, configured in Frankfurt
• Transactional email (for example, telling you an export is ready): Resend
• Operational logging: self-hosted Grafana and Loki on Hetzner, with log storage in DigitalOcean Spaces
• Google Cloud infrastructure: Pub/Sub delivers Gmail change notifications containing mailbox identifiers; Cloud KMS protects the encryption keys used for integration credentials.
• Natural-language query generation, requested document-field extraction, and semantic embeddings: Amazon Web Services (Amazon Bedrock), configured for EU processing when you use those features
• Cloud destinations you connect yourself: Google Drive, Dropbox, or Microsoft OneDrive. These receive your files only when you ask us to send them.
• AI assistants you connect yourself: the provider of the client you approve, for example Anthropic for Claude, OpenAI for ChatGPT or Codex, or the provider operating your Cursor workspace. It receives permitted tool results and, with download permission, requested original files. These providers are not automatically Dioveo sub-processors simply because you connect them.
• Audience measurement, only if you accept: Google Analytics. Nothing is loaded or sent unless you accept the banner.
• Optional error monitoring, where enabled: Sentry, subject to your consent. This is separate from the operational logging needed to run and secure the service.

A current list of sub-processors is available on request at [email protected].

We do not sell personal data.

8. International transfers

If data is transferred outside your region, we use appropriate safeguards (e.g., EU Standard Contractual Clauses) and perform transfer risk assessments.

Primary hosting region: Europe/Germany

EU primary hosting does not mean every connected service processes data only in the EU. Assistant providers and cloud destinations may process data elsewhere under their own terms and your account settings. EU geographic Bedrock profiles can route requests among supported EU regions. You may request information about applicable transfer safeguards, including a copy where available, from our privacy contact.

9. Security

• In transit: every connection between you and Dioveo, and between Dioveo and the APIs it calls (Google, Stripe, your cloud drive), uses TLS. Traffic between our own services runs inside a private network that is not reachable from the internet.
• Prepared downloads are encrypted before they are stored, and the stored copy expires automatically after 7 days.
• Encrypted OAuth tokens; least-privilege scopes.
• Role-based access controls and centrally managed secrets.
• Report security issues: [email protected].

No method is 100% secure, but we work continuously to protect your data.

10. Retention

• Your account, index, connections, folders, workflows, and history: retained to provide the service while your account is active, subject to your erasure rights. Account deletion initiates removal across our systems, but is not a guarantee that every copy is removed instantly. Contact our privacy team if deletion fails or you need confirmation of its scope and completion.
• Database backups: MongoDB is configured to retain 30 nightly backup sets; our PostgreSQL backup system is configured for 14 days. Copies can remain until the backup containing them expires. These configured schedules are separate from live-account deletion. Recovery must reconcile completed erasure requests before restored data is returned to service.
• Prepared downloads: the zip we build for you is encrypted in storage and deletes itself after 7 days.
• Raw extracted attachment text: kept in your private per-user cache for up to 365 days by default. A response shows its expiry. You can select a shorter period of 1–365 days when requesting extraction, clear one cached document, or clear the entire text cache. Expired text is excluded from reads immediately and removed by a scheduled cleanup.
• Semantic passages and embeddings: tied to retained source text. Shortening text retention shortens their retention; clearing the source text removes its derived semantic data. Semantic search sessions last up to 15 minutes.
• MCP collections and saved processing results: a 30-day default retention, configurable up to 365 days. Inactive collections can be deleted. Clearing the raw-text cache does not separately erase saved structured or collection results, or reset usage counters.
• MCP original-download sessions: authenticated access expires after 4 hours; this access window is separate from the prepared archive's storage lifetime of up to 7 days.
• Sensitive-release approvals: the permission to perform the exact unredacted read expires after 10 minutes and is single-use. Approval and audit records are separate from the short-lived permission.
• Structured extraction results and evidence: kept with your account so identical requests can be reused without another model call and removed when your account is deleted.
• Sensitive-data release audit events: contain the confirmation metadata described in Section 3, not the released values, and are removed when your account is deleted.
• Erasure-request records: pending requests retain the minimal identity and status needed to complete cleanup. Completed request metadata in the account service expires after 180 days. Separate minimal service identifiers prevent erased data from being recreated by old jobs or backups; their removal depends on confirming that the relevant replay and backup windows have expired.
• Operational logs: Loki is configured for 30-day retention with a subsequent deletion delay. Logs can contain account identifiers, email addresses, and technical details needed for security and troubleshooting. We aim to minimize these details and restrict access; log retention is separate from account deletion.
• Public query translator: descriptions and generated queries are not stored in our database. The one-way IP hash and its request count expire after the next daily reset at 00:00 UTC.

You may request deletion at any time (see Your rights). Copies you download or send to an assistant, spreadsheet, or cloud provider are outside Dioveo's cache-deletion controls. Disconnecting an integration stops future access; it is not the same as erasing your Dioveo account or copies already delivered elsewhere. Stripe retains payment records under its own applicable accounting and legal obligations after deletion of your Dioveo account. Our support and email-provider records are reviewed separately when handling a rights request.

11. Your rights

Depending on your location, you may have the right to access, rectify, erase, restrict, port, and object to processing. You may also lodge a complaint with your local authority (e.g., CNIL in France, ICO in the UK).

California residents have rights under the CCPA/CPRA (including access and deletion). We do not sell or share personal data as defined by the CPRA.

Requests: [email protected]. For GDPR requests, we respond without undue delay and normally within one month. Where a permitted extension is necessary, we explain the reason within that first month; the extension can be up to two further months. Requests are normally free, and we ask only for information reasonably needed to verify your identity.

Account settings provide export and deletion tools. These tools do not limit your right to request access to all relevant personal data, correction, restriction, objection, or erasure through our privacy contact. If an export omits data or a self-service action is unavailable, contact us for review. You can also contact the CNIL.

Privacy requests when self-service is unavailable

You can submit a privacy request even if a subscription or active workflow prevents self-service deletion, or your Google connection has expired. Email [email protected] with the right you wish to exercise; do not attach mailbox files or identity documents unless we specifically need them through a secure channel. We review necessary billing retention separately from erasure of mailbox-derived data.

12. Cookies & similar technologies

• Strictly necessary: authentication/session, CSRF, preferences (always on).
• Optional analytics and browser error reporting: only with your consent. Use Cookie settings in the site footer, or Privacy on your Profile page in the app, to accept or withdraw at any time. Both choices last 180 days, after which we ask again; withdrawing stops future reporting and removes our analytics cookies and locally stored attribution. Choices are stored per browser and site origin, so review them separately on the marketing site and app if you use both.

13. Changes to this policy

We update this notice when our processing changes. Material changes will be explained before they take effect, with renewed authorization or consent where required. A revised notice does not by itself authorize a new use of your Gmail data.