Privacy Policy
Who we are
Kiotey is operated by AppraisalFlo, 4062 Peachtree Rd, STE A-448, Brookhaven, GA 30319, United States (“Kiotey”, “we”, “us”). This policy explains how we collect, use, store, and share personal information when you visit kiotey.com, request access, or use the Kiotey service.
Questions: privacy@kiotey.com.
Our role
For information about visitors to our website and the people who hold Kiotey accounts, we act as a controller.
For the content a company brings into Kiotey — connected mailboxes, calendars, support requests, account records, files, board cards, and meeting recordings (“Customer Data”) — we act as a processor on behalf of that company. The company decides how that data is used. If you have questions about Customer Data, contact the company that gave you access.
What we collect
Account information: name, work email, phone numbers, address, time zone, role, and company.
Customer Data: email messages and attachments, calendar events and RSVPs, contacts, support requests, account dossiers, notes, files, board content, and meeting recordings imported from connected services.
Connection credentials: OAuth tokens, or mailbox credentials for non-Google mail, needed to keep a mailbox and calendars in sync. These are stored encrypted. Kiotey does not ask for or store a Gmail password.
Usage and device data: log data, IP address, browser type, pages viewed, and actions taken, used to operate and secure the service.
Website and sales data: information you submit through forms, such as your email, company, and team size.
How we use it
To provide, maintain, and secure the service, including listing and opening mail, marking messages read or unread, sending mail the operator composes, sending invitations and password resets, and running the features a company turns on.
To provide AI features a company enables, as described below.
To respond to requests, provide support, and communicate about an account.
To detect, prevent, and investigate abuse, fraud, and security incidents.
To comply with legal obligations.
We do not sell personal information, and we do not use Customer Data or Google user data for advertising.
Google account authorization and Gmail
A Gmail mailbox is connected only when a person who can sign in to that Google account completes Google’s OAuth consent screen. Kiotey requests one Gmail permission, https://www.googleapis.com/auth/gmail.modify. Google describes that permission as permission to read, compose, and send email from the account. Kiotey does not request a separate send-only permission, and it does not request permission to permanently delete mail while bypassing Trash.
By completing that consent screen, the Google account owner authorizes Kiotey to access that mailbox on behalf of the Kiotey company that started the connection. Every signed-in member of that company may then act as an operator of the mailbox. Those operators may read messages, mark messages read or unread, and send, reply, and forward mail as that Gmail account. A person signed in to a different Kiotey company cannot open the mailbox.
Kiotey uses the granted access to show the mailbox in Client mail, to keep unread state in agreement with Gmail, and to send messages the operator chooses to send. Kiotey does not archive mail, change other Gmail labels, or move messages to Trash inside Gmail.
Kiotey stores the Google refresh token and access token encrypted, separately for each mailbox, and uses them only to call Gmail for that mailbox. Message headers are stored in that company’s workspace so the desk can list mail. When a person opens a letter, a size-capped copy of the sanitized letter text may be kept for that person for up to 7 days.
The account owner can revoke Kiotey at any time from their Google Account settings, under third-party access. An operator in the connecting company can also choose Disconnect in Client mail. Disconnect asks Google to revoke the grant and deletes the token Kiotey stored. After revocation, Kiotey cannot read or send for that mailbox. Messages already stored in the company’s workspace remain until that company removes the mailbox or asks us to delete the company’s data.
Kiotey’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Humans read Gmail data only with the account owner’s explicit agreement on Google’s consent screen, as described above, or when reading is necessary for security, to comply with law, or the data is aggregated and used for internal operations in line with that policy. We do not sell Google user data, do not use it for advertising, and do not transfer it to advertising platforms.
AI processing of Gmail data
AI features run only when the company has connected OpenAI and turned the feature on. When a feature runs, the message content needed for that feature is sent to OpenAI at api.openai.com to produce the result. Those features include classifying unread mail, summarizing a thread, and drafting or proofreading a reply.
Kiotey does not use Customer Data to train its own models. A person reviews an AI draft before it is sent. OpenAI acts as the company’s configured provider for that request. No other AI provider receives Gmail content.
How we share it
With the signed-in members of the Kiotey company that connected the mailbox, as the account owner authorized.
With service providers that help us run Kiotey, under contracts that protect the data. The company’s own Google account is the source of Gmail data. OpenAI receives Gmail content only for an AI feature the company has enabled. Zoom and Fathom receive meeting data only when the company connects them.
One Kiotey company cannot see another company’s data.
When required by law, or to protect the rights, property, or safety of Kiotey, our users, or others.
In connection with a merger, acquisition, or sale of assets, subject to this policy.
Retention and deletion
We keep account information while the account is active, and afterward as needed for legal, accounting, and security purposes.
A Google token is deleted when the mailbox is disconnected or when Google tells us the grant is no longer valid. Message headers stored for that mailbox remain in the company’s workspace until the company removes the mailbox or asks us to delete the company’s data. The short-lived copy of a letter someone opened expires after 7 days or when that person’s cache is full, whichever comes first.
Security
We use administrative, technical, and physical safeguards appropriate to the data we handle, including encryption in transit, encrypted storage of connection credentials, and access limited to the signed-in company. No system is perfectly secure. If we become aware of a breach affecting your information, we will notify you as the law requires.
International transfers
We and our service providers may process information in the United States and other countries. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and the UK Addendum.
Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent.
California residents have the right to know, delete, and correct personal information, and to opt out of sale or sharing. We do not sell or share personal information for cross-context behavioral advertising. We will not discriminate against you for exercising these rights.
To exercise a right, email privacy@kiotey.com. If your request concerns Customer Data, we will refer it to the company that controls it. You may also complain to your local data protection authority. Withdrawing a Gmail connection is done from the Google Account or from Disconnect in Kiotey, as described above.
Cookies
We use cookies as described in our Cookie Policy. You can change your choices at any time through Cookie settings in the site footer.
Children
Kiotey is a business service and is not directed to children under 16. We do not knowingly collect their personal information.
Changes
We may update this policy. If changes are material, we will notify account holders before they take effect. The date above shows when this policy last changed.
Contact
AppraisalFlo, 4062 Peachtree Rd, STE A-448, Brookhaven, GA 30319, United States. privacy@kiotey.com.