Privacy and deletion

Your mailbox stays read-only

Coagor requests only Google’s Gmail read-only permission. It cannot send, delete, archive, mark read, star, label or move email. It supports Gmail and Google Workspace through the same consent flow. Connecting Gmail is optional and no custom label is required.

An authorized member must start each read of the mailbox and choose its period, or ask the assistant to read one message. Opening the assistant does not read the mailbox by itself. Reads cover Inbox and Sent within the selected dates, excluding spam, trash and drafts, with limits that may leave some messages unread — the assistant says so.

What is used and shared

Coagor reads bounded message metadata, the message text and the readable attachments (PDF, images, text files, within a per-message size limit) to propose records for the same syndicate workspace. Other attachments are named but not read. Email links and remote images are not opened.

When processing is enabled, the message text, the readable attachments and the workspace facts needed to resolve a record (unit numbers, supplier and person names, open records) are sent to the approved commercial AI provider (Anthropic or OpenAI, identified in Gmail settings) — never through the general assistant key. Credentials, internal database identifiers and unrelated workspace records are excluded. Email data is not sold, used for advertising, or intentionally provided for training general-purpose models.

The Gmail settings disclose the approved provider and retention arrangement before any read: either a verified zero-retention arrangement or the explicitly approved pilot’s standard retention of up to 30 days, subject to the provider’s contractual exceptions. Provider processing may occur outside Canada. OpenAI requests disable stored conversation state; this does not remove the provider’s applicable abuse-monitoring retention. Activation requires the syndicate’s privacy review of the actual account, model, retention and processing locations.

Optional live voice conversations

Where live voice is enabled, you must agree before starting microphone access. Microphone audio goes to OpenAI to hear your request and speak the response. Coagor does not save raw audio. Live captions are temporary; requests handled by the Assistant and their answers appear in the existing conversation. OpenAI’s applicable provider retention may be up to 30 days, subject to its contractual exceptions. Processing may occur outside Canada.

Voice uses the same workspace permissions and proposal cards as typed requests. Saying yes does not save a change: you must click Confirm on its card. End stops microphone capture. Browser dictation and read-aloud are separate features and use your browser’s speech service.

Optional bank feed (Plaid)

A syndicate administrator may connect the syndicate’s own bank account through Plaid. The bank sign-in happens inside Plaid; Coagor never sees the bank password. Statement import (CSV / OFX) remains available without any connection.

Coagor receives, for the accounts the administrator selects: the institution, account names, the last digits of the account numbers, account types, balances, and transactions (date, amount, description, merchant and category). Coagor uses them only to reconcile the syndicate’s books — matching bank transactions with owner invoices, supplier bills and statements of the same workspace. Bank data is not sold and not used for advertising. It reaches the assistant’s AI providers only when a member uses the assistant (typed or by voice) and it looks up transactions or payments to answer that member.

The Plaid authorization is encrypted on the server (AES-256-GCM) and never reaches the browser. Data travels over TLS 1.2 or better and is stored in an encrypted database, inside the syndicate’s workspace only; members see it according to their role.

Before Plaid opens, the administrator agrees to these terms in Coagor (version 2026-10-29.2); Coagor records who agreed and when. Plaid then asks for its own consent; its End User Privacy Policy explains how Plaid handles the data.

“Disconnect Plaid” asks Plaid to remove the connection, then deletes the stored authorization and the live-feed transactions nothing was applied to. Transactions already applied to the books, and imported statements, stay as the syndicate’s accounting records for seven years after the end of the fiscal year they belong to, as set in Coagor’s retention policy. Deleting a workspace deletes all of its bank data in Coagor; disconnect the bank feed first so Plaid stops sharing it. For access or deletion requests, contact the syndicate’s administrator or the privacy contact at the end of this page.

What Coagor retains from Gmail

• Google authorization is encrypted on the server until disconnect or revocation. Access tokens are used in memory.
• The text and readable attachments of a message that was read are kept as temporary evidence for 24 hours, for the conversation and its cards; then they are blanked and the conversation shows a fixed marker in their place.
• A card proposed from a message expires after 24 hours unless you confirm it; a copy of an attachment is kept in the document register only when you confirm its card.
• Minimal message and proposal-reference identifiers expire after 90 days or are removed on disconnect.
• Content-free audit metadata is retained for 365 days.

Expired evidence is inaccessible at once — to every member, in every copy — and removed by scheduled cleanup. Backup retention is governed by the service operator’s documented backup policy. A record you confirm follows the existing syndicate record-retention rules.

Delete a scan or disconnect

1. Open the syndicate mailbox from Settings → Gmail.
2. Select a scan and choose “Delete scan now” to remove the scan. The email evidence it read is temporary (24 hours) and is withdrawn at once when the mailbox is disconnected; deleting a conversation removes its copies. This does not delete confirmed records.
3. Choose “Disconnect” to delete the saved authorization and retained Gmail evidence. Coagor also attempts to revoke Google access. You can remove Coagor from your Google Account’s third-party connections directly.

If you do not have the required permission, contact your syndicate’s administrator or designated privacy contact. For the La Champêtre–Adagio pilot, email mintuseddy@gmail.com. They can handle access, deletion and questions about records the syndicate must retain.

You decide what changes

Cards are suggestions and may be incomplete or mistaken. A read never creates or changes a syndicate record. “Prepare proposal” produces a typed preview; a separate confirmation is required before any supported action executes. Conflicting or ambiguous records require human review.

Coagor’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.