Privacy Policy

• We only access your Gmail to send the messages you write. We do not read your inbox.
• We store your campaign content, recipient lists, tracking events, and an encrypted Gmail refresh token. Nothing else from your mailbox.
• We never sell your data, show ads, or use your data to train AI or machine-learning models.
• You can disconnect Gmail in one click, and ask us to delete everything at any time.

Dispatch (“Dispatch”, “we”, “us”) is an email outreach tool operated by Kairos AI Tech. For anything in this policy, write to support@kairosaitech.com.

Account information. Your name, email address, and a hashed password when you sign up with email; or your Google account name, email, and profile picture when you use “Continue with Google”.

Gmail connection. When you connect Gmail, Google gives us an OAuth refresh token for the mailbox you chose. We store it encrypted at rest, together with the Gmail address and the permission scopes you granted. We never see or store your Google password.

Campaign content. The subjects, message bodies, follow-ups, signatures, and schedules you create in Dispatch.

Recipient lists. The email addresses and optional first name, last name, and company you paste or import for each campaign.

Tracking events. When a recipient opens a message (via a tracking pixel), clicks a tracked link, replies, or unsubscribes, we record the event, a timestamp, and, for clicks, the destination URL. For opens we also keep a truncated copy of the mail client’s user-agent string, which helps tell real opens from automated scanners. We do not log recipients’ IP addresses.

Sending logs. Whether each message was sent, when, and any error Gmail returned.

Technical data. Standard server logs (request path, status, timestamp) needed to run and secure the service. We do not use third-party analytics or advertising trackers in the app.

Dispatch currently requests one Gmail permission and uses it for exactly one purpose:

• Send email on your behalf (gmail.send) — to deliver the campaigns and follow-ups you queue, from your address, with your signature.

If we later add reply detection or signature import, they would need the read-only permission (gmail.readonly). We would ask for it separately, you would have to approve it again, and this policy would be updated first. Until then Dispatch cannot read your mail, and replies and signatures are handled manually.

Optional: Gmail labels. If you turn on Gmail labels in Settings, Google asks for a broader Gmail permission (gmail.modify). Dispatch uses it for one purpose: creating labels named Dispatch/… and applying them to messages Dispatch itself sent, so you can filter your outreach by engagement in Gmail. It is off unless you enable it, you can switch it off by disconnecting Gmail, and the labels stay in your mailbox until you delete them.

We do not read, store, or analyze any mail in your account, and we do not use Gmail data for advertising, profiling, or model training.

Limited Use disclosure. Dispatch’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• To provide the service: schedule and send your campaigns, pace them under your daily cap, and show you opens, clicks, and replies.
• To keep the service working and secure: debugging, abuse prevention, and enforcing the sending limits described in our Terms.
• To communicate with you about your account — for example a failed send or a required reconnect. We do not send marketing email.

We do not sell personal data, we do not show advertising, and we do not use your content, recipient lists, or Gmail data to train artificial-intelligence or machine-learning models.

When you upload a recipient list, you are the controller of that data and we process it on your instructions. You are responsible for having a lawful basis to email those people. Every message Dispatch sends includes a one-click unsubscribe link; when a recipient uses it we mark them as unsubscribed and stop sending to them from that campaign. Recipients can contact us at support@kairosaitech.com to ask which sender uploaded their address.

We share data only with the infrastructure providers needed to run Dispatch — hosting, a managed Postgres database, Google’s Gmail API to deliver your mail, and Lemon Squeezy to take payment for paid plans (it receives your payment details directly; we only keep your subscription status, renewal date and card brand and last four digits) — each bound by contract to process it only for us. We do not share data with data brokers, advertisers, or any party for their own purposes. We will disclose information if required by law, and we will tell you when we are allowed to.

We keep your data while your account is active. Disconnecting Gmail deletes the stored refresh token immediately and asks Google to revoke it; campaigns and history stay so your reports still make sense. If you email us asking to delete your account, we remove your account, campaigns, recipient lists, tracking events, and tokens within 30 days, except where we must keep a minimal record for legal or security reasons.

You can also revoke Dispatch’s access to your Google account at any time from myaccount.google.com/permissions. Once revoked, Dispatch cannot send or read anything until you reconnect.

Traffic is encrypted in transit with TLS. Gmail refresh tokens are encrypted at rest with a key that is not stored alongside the database. Passwords are hashed, never stored in plain text. Access to production systems is limited to the people who operate the service. No system is perfectly secure; if we learn of a breach affecting your data we will notify you without undue delay.

Depending on where you live (including under the GDPR and UK GDPR, and California’s CCPA/CPRA) you may have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. You can see and edit most of it directly in the app. For anything else, including a copy of your data or deletion, email support@kairosaitech.com and we will respond within 30 days. You also have the right to lodge a complaint with your local data-protection authority.

Dispatch is a business tool and is not directed at children under 16. We do not knowingly collect data from them; if you believe we have, contact us and we will delete it.

If we make a material change we will update the effective date above and notify you in the app or by email before it takes effect. Continued use after that date means you accept the updated policy.

Questions, requests, or concerns: support@kairosaitech.com.