Privacy Policy

1. Who We Are

Kaname is an AI-powered email inbox and CRM application for founders and sales teams, operated by Elvento ("we", "us", or "our"). The application is available at kaname.email and is developed and maintained by Kaname / Elvento. This Privacy Policy describes how we collect, use, store, share, and protect your data — including Google user data — when you use our website and application (collectively, the "Service").

2. Google OAuth Scopes We Request

When you connect Google to Kaname, we request OAuth 2.0 scopes to power identity, mail, calendar-aware scheduling features, sending, inbox sync, CRM automation, and AI-assisted follow-ups. The scopes below match Google's sensitivity categories and the user-facing descriptions shown on the OAuth consent screen.

Non-sensitive scopes

• https://www.googleapis.com/auth/userinfo.email — See your primary Google Account email address.
• https://www.googleapis.com/auth/userinfo.profile — See your personal info, including any personal info you've made publicly available.

Sensitive scopes (approval / verification may be required by Google)

• https://www.googleapis.com/auth/calendar.events — View and edit events on all your calendars.
• https://www.googleapis.com/auth/calendar.readonly — See and download any calendar you can access using your Google Calendar.
• https://www.googleapis.com/auth/gmail.send — Send email on your behalf.

Restricted Gmail scopes

• https://www.googleapis.com/auth/gmail.modify — Read, compose, and send emails from your Gmail account.

Through these scopes, we may access the following categories of Google user data:

• Email messages and metadata: Email headers (subject, sender, recipients, timestamps), email body content, thread structure, and message IDs.
• Gmail labels and settings: Label names and thread categorisations used to organise your inbox within Kaname.
• Push notification subscriptions: Gmail Watch API subscriptions to detect new messages in real time and trigger automatic CRM updates.
• Google account identity: Your Google account email address and display name, collected at sign-in.
• Calendar data: When calendar scopes are granted, event titles, times, attendees, and availability relevant to scheduling features you use inside Kaname (for example suggested meeting times or creating events you confirm).

In addition to Google user data, we also collect:

• IMAP / SMTP credentials: If you connect a non-Gmail mailbox, we store your host, port, username, and password in encrypted form to fetch and send mail on your behalf.
• CRM data you create: Leads, contact details, pipeline stages, notes, tasks, follow-up history, and conversation summaries.
• Usage data: Pages visited, features used, error logs, and device / browser information collected to maintain and improve the Service.
• Billing data: Subscription plan, billing status, and transaction identifiers managed via Dodo Payments. We do not store full payment card numbers.

3. How We Use Each Scope and Why It Is Needed

We use Google user data only to provide user-requested Kaname features. Identity-only scopes are not sufficient to read mail, sync threads, update mailbox state, or send messages from your connected email account.

• https://www.googleapis.com/auth/userinfo.email — We use your primary Google Account email to identify and link the correct mailbox to your Kaname account.
• https://www.googleapis.com/auth/userinfo.profile — We use basic profile details you make available (such as display name) to personalise the in-app experience.
• https://www.googleapis.com/auth/calendar.readonly — We use read access to your Google Calendar to understand availability and suggest or display meeting times in scheduling-related flows you initiate.
• https://www.googleapis.com/auth/calendar.events — We use this scope only where you explicitly create or update calendar events through Kaname (for example confirming a proposed meeting). We do not bulk-edit your calendar without your action.
• https://www.googleapis.com/auth/gmail.send — We use this scope so you can send email from Kaname on your behalf when you compose a message, reply, or send a follow-up you approve.
• https://www.googleapis.com/auth/gmail.modify — We use this restricted scope to read and sync your messages and settings, display your unified inbox, create and update drafts, send messages as part of compose flows, and apply mailbox changes you request (for example read/unread or label-related updates tied to CRM triage). gmail.readonly alone is not sufficient because Kaname must perform user-directed mailbox updates and outbound send flows, not read-only access.

Sensitive scope justification (for Google verification): Kaname requests calendar access to power scheduling features tied to your workflow, and gmail.send so you can send mail you initiate in the product. We do not send messages or change calendar events without your action; outbound email and event writes are limited to actions you trigger (including optional AI-suggested drafts you choose to send).

Restricted scope justification (for Google verification): Kaname is an inbox and CRM workspace that reads thread content to classify leads, show your mail, and keep pipeline state aligned with your Gmail. The gmail.modify scope matches these read-and-update behaviors. More limited scopes that only expose profile or email address cannot deliver inbox sync, CRM features, or user-directed send and thread updates.

Features enabled by these scopes

• Inbox display: We read your Gmail threads to display them in the Kaname unified inbox.
• Lead capture and CRM pipeline: We analyse incoming email content to automatically classify threads as leads, assign urgency scores, detect intent, and create CRM lead records in your pipeline.
• AI-suggested replies: Email content and thread summaries are sent to OpenAI's API to generate context-aware follow-up reply suggestions. OpenAI acts as a data processor under our agreement with them and does not use your data to train its models.
• Sending emails: When you compose or reply to an email through Kaname, we use the Gmail API to send it on your behalf.
• Real-time inbox updates: We use Gmail push notifications to detect new messages and update your inbox and pipeline automatically.

We do not use Google user data for any of the following purposes:

• Targeted, personalised, retargeted, or interest-based advertising
• Selling data to third parties or data brokers
• Providing data to information resellers
• Determining credit-worthiness or for lending purposes
• Creating or enriching user profiles for sale or commercial transfer
• Training AI or machine learning models (including our own or third-party models)
• Any purpose unrelated to providing or improving the Kaname Service

4. Google API Services — Limited Use Disclosure

Kaname's use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

• We only access Gmail data to provide features explicitly requested by you (inbox display, lead capture, AI replies, email sending).
• We do not use Gmail data for advertising of any kind.
• We do not allow humans to read your Gmail messages, except when you explicitly request support assistance or when required by law.
• We do not transfer Gmail data to third parties except as strictly necessary to operate the Service (see Section 5 below) or as required by law.
• We do not use Gmail data to create, train, or improve AI or machine learning models.
• You can revoke Kaname's Gmail access at any time via myaccount.google.com/permissions or by disconnecting the mailbox inside the Kaname application.

5. How We Share, Transfer, and Disclose Google User Data

We do not sell your Google user data or any other personal data to any third party. We share data only with the following sub-processors, and only as strictly necessary to operate the Service:

• OpenAI: Email content and thread summaries are sent to OpenAI's API to generate AI lead classifications and reply suggestions. OpenAI processes this data as a data processor under our data processing agreement. OpenAI does not use your data to train its models.
• Google / Firebase: Authentication and identity management via Firebase Authentication (Google sign-in). Gmail API access is governed by Google's own privacy policy.
• Dodo Payments: Web subscription billing and payment processing. Only subscription identifiers and billing status are shared; we do not share email content with Dodo Payments.
• Cloud infrastructure providers: Hosting, database storage, and server infrastructure providers used to run the Kaname backend. These providers process data only on our instructions.

We do not transfer or disclose Google user data to any third party for the following purposes:

• Targeted, personalised, or interest-based advertising
• Sale to data brokers or information resellers
• Credit-worthiness assessment or lending decisions
• Any commercial purpose unrelated to operating the Kaname Service

We may disclose data if required by applicable law, regulation, or valid legal process, and will notify you where legally permitted to do so.

6. Data Security and Protection

We implement industry-standard security procedures to protect your Google user data and all other personal information:

• Encryption in transit: All data transmitted between your browser, the Kaname application, and our servers is encrypted using HTTPS / TLS.
• Encryption at rest: Sensitive data — including IMAP/SMTP passwords and stored email content — is encrypted at rest in our databases.
• Access controls: Access to production systems and user data is restricted to authorised personnel only, on a strict need-to-know basis.
• OAuth token security: Gmail OAuth tokens are stored securely and are never exposed in client-side code or logs.
• While we implement these safeguards, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security, and we encourage you to use strong account credentials.

7. Data Retention and Deletion

We store your personal information for a period consistent with our business purposes and legal obligations:

• We retain your account data and CRM records for as long as your account is active or as needed to provide the Service.
• When the data retention period expires for a given type of data, we delete or destroy it securely.
• If you delete your account, we will delete or anonymise your personal data — including all stored Gmail data and CRM records — within 30 days, except where we are required to retain data by law (e.g., billing transaction records).
• Cached email content and thread data may be retained for up to 90 days after you disconnect a mailbox, to allow time for data export before permanent deletion.
• You may request deletion of your data at any time by contacting us at [email protected]. We will process deletion requests within 30 days.

8. Your Rights and Choices

You have the following rights regarding your data:

• Access: Request a copy of the personal data — including Google user data — we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your account and all associated personal data, including Gmail data stored by Kaname.
• Revoke Gmail access: Revoke Kaname's OAuth access to your Gmail account at any time via myaccount.google.com/permissions or by disconnecting the mailbox inside Kaname. Revoking access stops all future Gmail data collection immediately.
• Data portability: Request an export of your CRM leads and pipeline data.
• Opt out of AI processing: Contact us to disable AI processing for your account. AI suggestions will no longer be generated and no email content will be sent to OpenAI.

To exercise any of these rights, contact us at [email protected]. We aim to respond within 5 business days.

9. Cookies and Tracking

• We use essential cookies to maintain your authenticated session.
• We may use analytics cookies to understand aggregate usage patterns and improve the Service. You can disable non-essential cookies in your browser settings.
• We do not use advertising cookies, third-party tracking pixels, or sell your browsing data.

10. Children's Privacy

Kaname is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us at [email protected] and we will delete it promptly.

11. International Data Transfers

Kaname is operated from India. If you access the Service from outside India, your data may be transferred to and processed in countries where our infrastructure and sub-processors operate, including the United States. We ensure all such transfers are subject to appropriate contractual and technical safeguards.

12. Changes to This Privacy Policy

We will notify users of any material changes to this Privacy Policy via email or a prominent in-app notice at least 7 days before they take effect. The updated policy will be effective from the date shown at the top of this page. Continued use of the Service after that date constitutes your acceptance of the updated policy. This Privacy Policy is hosted at kaname.email/privacy-policy and is always current.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your data — including your Google user data — please contact us at:

• Email: [email protected]
• Application: Kaname (kaname.email)
• Developer / Organisation: Elvento

We aim to respond to all privacy-related inquiries within 5 business days.