Privacy Policy
SendWeb is operated by BESTAI LABS LIMITED in New Zealand. This policy explains the data handled when customers connect Gmail accounts and use SendWeb to deliver transactional website form notifications.
Google user data we access
SendWeb requests Google identity scopes for sign-in and the single Gmail scope https://www.googleapis.com/auth/gmail.send. It cannot read, list, search, modify or delete messages in your mailbox.
What we retain
- Your account identity, connected Gmail address, site and form configuration.
- An application-encrypted OAuth refresh token required for unattended sending.
- Application-encrypted recipients and subject templates.
- Hashed site API keys and revocable AI Agent tokens.
- Short-lived hashed pairing, anti-abuse and idempotency identifiers, aggregate daily counters and content-free administrative audit events.
AI Agent connections
An Agent receives only a revocable configuration token after you sign in and approve a short-lived pairing code. Agent tokens cannot read Gmail, retrieve encrypted routing values or access prior form content. They can create configuration and site-scoped sending keys within the workspace you approved.
Zero message content retention
We do not persist website form fields, visitor names, visitor email addresses, phone numbers, message bodies, generated email bodies or Gmail API message responses. Content is processed in memory only for the synchronous send request. SendWeb does not support attachments. Application invocation logging is disabled and request bodies and authorization headers are never intentionally logged.
Where a sent copy exists
Gmail normally places a copy in the connected account's Sent folder. Google and Cloudflare may process infrastructure and security metadata under their own policies. “Zero message content retention” describes SendWeb's application storage, not connected or recipient mailboxes.
Use, security and deletion
Google user data is used only for the requested sending feature. We do not sell it, advertise against it or train models on it. Refresh tokens and routes use AES-256-GCM with keys separate from the database. Disconnecting Gmail revokes the token and removes token material. Request account deletion at jay@bestai.co.nz.
Contact
BESTAI LABS LIMITED, Unit 10, 18 Karengo Street, Long Bay, Auckland 0630, New Zealand.