Privacy policy

Loomwork AI (a sole proprietorship operated by Henry Mallos), trading as Loomwork AI.

Registered address: 287 Lake Sherwood Dr, Westlake Village, CA 91361.

Contact for anything in this policy, including deletion requests: henrymallos.media@gmail.com.

We are the data controller for the information described below.

If you join the waitlist, we hold what you typed into the form.

If you become a client and connect your inbox, we read your incoming mail so we can sort it and write draft replies.

We never send a reply you have not approved, unless you have switched on automatic sending yourself for a specific category. That switch is off for everything by default.

Your data is kept in a database used by your business alone. It is never pooled with another client's and never used to train any AI model.

You can disconnect us in two clicks, at any time, from your own Google account.

If you fill in the waitlist form we store your name, the email address you gave, your business name, your answers to the form questions, the timezone your browser reports, and the date you signed up. We use it to contact you about the service and to prepare a walkthrough for your business. Nothing else.

We do not run advertising trackers, we do not sell anything to anybody, and we do not build a profile of you across other websites.

This section applies only once you are a client and have connected your inbox. Until you do that, we have no access to your email at all.

When you connect, Google asks you to grant two permissions. These are the narrowest ones that let the service do its job:

Read your email messages and settings (gmail.readonly). We use this to fetch new mail so it can be sorted and so a reply can be written.

Manage drafts and send emails (gmail.compose). We use this to create the draft reply, and to send that reply once you approve it.

We want to be exact about the second one, because it matters. Google does not offer a permission that allows creating a draft but not sending. gmail.compose is the narrowest one that exists, and the ability to send comes with it. So the promise that nothing goes out without your say-so is kept by how the software is built and not by the permission itself: replies sit in a queue until you press approve, every send is written to an activity log you can read, and you can stop the whole system with one switch.

We never request permission to delete your mail, change your account settings, or read your contacts. We do not have those permissions and cannot obtain them without asking you again.

Used: to classify each incoming message, to draft a reply in your voice, to propose appointment times against your calendar availability, to read details off invoices you receive, and to produce your weekly summary. That is the entire list.

Stored: in a Postgres database provisioned for your business alone, not shared with any other client. The token that lets us reach your mailbox is encrypted before it is written down. We keep the text of messages we have processed so the activity log and the queue make sense to you; we do not keep copies of attachments.

Shared: with two categories of provider, and nobody else. Our hosting and database providers (Vercel and Upstash) store the data on our behalf. Our AI provider, Anthropic, receives the text of messages in order to classify them and produce draft replies; under Anthropic's commercial terms that content is not used to train their models. We do not sell data, we do not share it with advertisers, and we do not transfer it to anyone else except where the law requires it.

Loomwork AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

https://developers.google.com/terms/api-services-user-data-policy

In particular: we use Google user data only to provide and improve the features described above; we do not transfer it except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with your notice; we do not use it for advertising; we do not allow humans to read it except with your explicit permission, for security purposes, to comply with applicable law, or where the data has been aggregated and anonymised; and we do not use it to develop, improve, or train generalised AI or machine learning models.

Waitlist entries: until you ask us to remove you, or until we close the list.

Client data: for as long as you are a client. When you stop being a client, we delete your database and the credentials that go with it within 30 days, and confirm when it is done.

You can ask for deletion at any time without cancelling. Email henrymallos.media@gmail.com.

The token that reaches your mailbox is encrypted at rest, and the part of the system your dashboard runs on has no way to decrypt it — approving a reply writes a status that a separate process acts on. Each client's data lives in a separate database.

What that buys is real but specific: a stolen database backup is useless without a key that is not in it. It is not a claim that we cannot be compromised, and anybody who tells you their system cannot be is guessing. If we ever suffer a breach affecting your data we will tell you what happened and what was exposed, in plain language, without waiting to be asked.

You can disconnect us from your Google account at any time, without asking us and without notice. Go to your Google Account permissions page and remove Loomwork AI:

https://myaccount.google.com/permissions

The moment you do, our access token stops working. We can no longer read your mail or create anything in your account. Nothing further is drafted and nothing further is sent.

Revoking access does not by itself delete the copies we already hold. To have those deleted as well, email us at henrymallos.media@gmail.com and we will delete them within 30 days and confirm when it is done.

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Email henrymallos.media@gmail.com and we will respond within 30 days.

Depending on where you live you may have further rights under the GDPR or the CCPA, including the right to complain to a supervisory authority. We will not make you fight for any of this.

This is a service for businesses. It is not directed at anyone under 18 and we do not knowingly collect their data.

If we change this policy in a way that affects what we do with your data, we will email every client before it takes effect rather than quietly changing the date at the top.