Privacy policy

Scope

This policy covers the velista.net website and the Gmail connectors operated by Velista. A connector links a Gmail mailbox to an AI assistant so that its owner can search and read their own messages.

These connectors are for internal use. They are not sold or offered to the public, and every connection is set up by the Google account owner.

The velista.net website

The site sets no cookies, offers no accounts and has no forms. Audience measurement runs on Cloudflare Web Analytics, which uses no cookies or persistent identifiers and only reports aggregate statistics.

An email sent to Velista is used only to reply to it. It is never sold or added to a mailing list.

Google data accessed

With the owner's explicit consent, a connector reads their Gmail mailbox in read-only mode (gmail.readonly scope): message content and metadata, attachments, labels. It also retrieves the account email address to identify the connection.

A connector cannot send, modify, label or delete any message.

How this data is used

Data read by a connector serves one purpose: answering a request the owner makes in their AI assistant (Claude, by Anthropic). Finding a message, reading it, summarising it.

• no advertising, targeted or otherwise
• no sale or transfer to third parties
• no AI model training
• no profiling

Limited Use (Google API)

Velista's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Storage and processors

The connectors store neither message content nor attachments. Both are read on request and passed straight to the owner's assistant. A PDF or office attachment is converted to text on the fly by Cloudflare (Workers AI) when requested, and is not kept by the connector. Only OAuth authorisation tokens are kept, in Cloudflare Workers KV, encrypted at rest by the host.

Processors involved: Cloudflare (hosting of the site and connectors, attachment conversion), Google (Gmail API), Anthropic (AI assistant presenting the content to the owner).

Retention and revocation

Tokens are kept while the authorisation remains active. The owner can withdraw it at any time from the permissions page of their Google account (myaccount.google.com/permissions), which cuts the connector off immediately. On request by email, any remaining tokens are deleted.

Your rights

Under the GDPR, anyone may access, correct, erase or object to the processing of data about them. A complaint can also be lodged with the French data protection authority (CNIL, cnil.fr).