AmarnaiAmarnaiBack to home

Privacy Policy

Last updated: July 16, 2026

This Privacy Policy describes how Amarnai (“we”, “our”, “us”) collects, uses, and protects information when you use our AI email triage service at amarnai.com (“the Service”).

Google API Data

Amarnai’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, Gmail data accessed through the Google API, and Outlook data accessed through the Microsoft Graph API, is used solely to provide the email triage and sorting features visible in the Amarnai interface. It is not used for advertising, transferred to third parties for purposes unrelated to providing the Service, or used to train generalized AI or machine learning models.

What We Collect

We collect only the data necessary to provide the Service:

We do not store full email bodies beyond what is required to display a thread in your Amarnai inbox.

How We Use Your Data

Gmail, Outlook, and account data is used exclusively to:

We do not use your email content for advertising, sell it to third parties, or use it to train models that are not specific to your account.

AI Processing

Thread classification, category suggestions, and reply drafts are produced by a third-party AI provider, Google, through the Gemini API. Embeddings used to organize and match your threads are also computed through the Gemini API. The content we send for processing is limited to what each task needs: typically the sender, the subject line, and excerpts of message bodies. This content is processed under the Gemini API Additional Terms of Service and Google’s Privacy Policy. We use the paid tier of the Gemini API, under which Google does not use submitted content to train or improve its models.

Third-Party Services

We use the following third-party services to operate the Service:

We do not share your email content, Gmail data, or Outlook data with any third party except as described above to provide the Service.

Analytics

On our website (amarnai.com) we use a privacy-focused, cookieless analytics service to understand how visitors find and use the site. It sets no cookies and stores no information on your device, and it does not track you across other websites. It collects only aggregated, anonymous statistics, such as pages viewed, referring site, browser, operating system, device type, and approximate country, derived without storing your IP address. This data cannot be used to identify you. We process it on the basis of our legitimate interest in measuring and improving the website. Analytics data is hosted in the European Union.

Data Retention

Thread metadata and content is retained while your account is active. When you delete your account, your account data, including thread metadata and content, is permanently deleted as part of the deletion request, with no recovery period. OAuth tokens are deleted immediately upon Gmail or Outlook disconnection or account deletion. Deletion is permanent and cannot be undone.

A narrow set of anti-abuse and billing-integrity records survives account deletion. First, a trial claim record: a one-way (SHA-256) hash of your normalized email address and, where a card was used, an opaque card fingerprint token provided by Stripe, together with the Stripe subscription identifier. This record exists so that the single free trial cannot be claimed again by deleting and recreating an account. The hash cannot be reversed to recover your email address, and the record cannot be used to contact you. Second, aggregate usage meters keyed on the normalized address of a connected inbox, containing only counters of AI processing consumed. These prevent repeated account resets from generating unlimited processing costs. We retain both kinds of record on the basis of our legitimate interest in preventing abuse of the Service and accounting for processing costs (Article 6(1)(f) GDPR). They contain no email content, no names, and no other profile data.

International Data Transfers

Amarnai is operated from the United States, and the third-party providers listed above (Google, Stripe, and Resend) are United States companies. Where personal data of users in the European Economic Area, the United Kingdom, or Switzerland is transferred to the United States, we rely on providers that are certified under the EU-US Data Privacy Framework (including its UK and Swiss extensions) or that are bound by Standard Contractual Clauses, together with the data processing agreements we hold with each provider. You can request a summary of the safeguards that apply to a specific provider by emailing privacy@amarnai.com.

Your Rights and Data Deletion

You can manage and delete your data at any time:

If you are in the European Economic Area, the United Kingdom, or Switzerland, you also have the right to access the personal data we hold about you, to have it corrected or erased, to receive a copy of it in a portable format, to restrict or object to certain processing (including processing based on our legitimate interests), and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your local data protection supervisory authority. To exercise any of these rights, or to ask questions about deletion, email privacy@amarnai.com. We respond to requests within one month.

Security

OAuth refresh tokens and API keys are encrypted at rest using AES-256-GCM before being written to the database, with encryption keys stored separately from the data they protect. Access tokens are short-lived, exist only in memory during a request, and are never persisted or logged. Email content is never written to application logs.

All data is transmitted over TLS. Access to production systems is restricted to authorized personnel and protected by multi-factor authentication. Because Amarnai accesses Gmail data, we undergo an annual third-party security assessment (CASA) conducted by a lab accredited by the App Defense Alliance, as required by Google for restricted-scope OAuth apps.

If you discover a security vulnerability in Amarnai, please report it to hello@amarnai.com. We will acknowledge your report within 2 business days and ask that you do not publicly disclose the issue until we have had a reasonable opportunity to address it.

Children

The Service is not directed at children under 13. We do not knowingly collect data from children.

Changes to This Policy

We will post any material changes to this policy on this page and update the “Last updated” date above. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

Contact

Questions about this policy or your data can be sent to privacy@amarnai.com.