emAIl Sentinel™ — Privacy Policy

Effective date: 2026-08-09 Operator: JJJJJ Enterprises, LLC ("JJJJJ", "we", "us", "our") Service: emAIl Sentinel, a Google Workspace Add-on for Gmail (the "Service")

This Privacy Policy explains what data the Service accesses, how it is used, and with whom it is shared. By installing or using the Service you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, do not install or use the Service.

For most information processed through the Service, you decide which messages to evaluate, what rules to write, what alert channels to enable, what recipients or endpoints to use, and what third-party services to connect. JJJJJ provides the software tool that operates under your Google account credentials. You retain control over the Gmail content, rules, recipients, destinations, integrations, and other processing instructions that you configure through the Service. You remain responsible for determining whether you have the legal right and authority to process the content you select and to send information to the recipients, endpoints, and third-party services you configure.

The parties' legal roles may vary depending on the type of information involved, the feature being used, the applicable law, and the specific relationship between you, JJJJJ, Google, and any user-selected third-party service. Nothing in this Privacy Policy is intended to assign a legal role that does not apply under the facts or applicable law. Section 9 describes the roles in more detail.

The Service is designed for individuals, professionals, consultants, and small teams who want to evaluate their own Gmail messages and receive alerts based on rules they configure. The Service is not intended for enterprise-wide monitoring, centralized employee surveillance, resale, managed-service deployment, or regulated workflows without a separate written agreement (see Section 10). This Privacy Policy applies to the Service, its Google Workspace Marketplace listing, related support communications, and the legal and product pages JJJJJ operates for the Service; it does not apply to other JJJJJ products unless they expressly link to it.

1. Architecture Summary

emAIl Sentinel runs entirely inside your own Google Apps Script environment, under your own Google account credentials. We do not operate any server, database, or backend that receives or stores your data. All persistent data resides in PropertiesService.getUserProperties(), which is private to your Google account and script project.

2. Data We Access

The Service accesses Gmail data only when you explicitly request an evaluation: you open a message in Gmail, open the add-on panel, and click "Evaluate this email". The Service uses the gmail.addons.current.message.readonly permission, which grants access solely to the message you currently have open, and only while you are interacting with the add-on. The Service has no ability to search, list, or read any other message in your mailbox, and it performs no background access of any kind.

For the one message you evaluate, the following data is accessed:

The Service does not read or transmit: - attachment file contents (only filenames); - email body text beyond the first 2,000 characters; - email addresses from your contacts list; or - any message other than the one you have open and explicitly choose to evaluate.

3. Data You Provide

4. Google API Services User Data Policy

The Service's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• The Service only accesses, uses, stores, and shares Google user data for the purposes described in this Privacy Policy and that are necessary to provide or improve user-facing functionality of the Service.
• The Service does not use Google user data for advertising, including retargeting, personalized advertising, or interest-based advertising.
• The Service does not sell Google user data.
• The Service does not use Google user data for generalized AI model training.
• The Service does not allow humans to read Google user data, except (a) with your affirmative agreement, (b) as necessary for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) for internal operations where the data has been aggregated and de-identified.
• The Service does not transfer Google user data to third parties except as necessary to provide the Service (Gemini rule evaluation, outgoing alerts), as directed by the user, or as required by law.
• You can view and audit all data stored by the Service by inspecting UserProperties in the Apps Script editor.

4.1 OAuth Scope Classification and Verification

The Service does not use any Google-classified restricted OAuth scope. Gmail access is limited to the gmail.addons.current.message.readonly scope — a sensitive (non-restricted) scope that grants access only to the message the user currently has open, and only during user interaction with the add-on. Because no restricted scope is requested, Google does not require the Cloud Application Security Assessment (CASA) for the Service. JJJJJ Enterprises, LLC:

• completes Google's standard OAuth verification for sensitive scopes, including scope justifications and review of this Privacy Policy;
• submits to Google's OAuth verification re-review whenever Google requests; and
• accepts that Google may, at its sole discretion, suspend, restrict, or revoke the Service's OAuth access or Marketplace listing at any time. A Google-initiated suspension will interrupt the Service; we are not liable for interruptions attributable to Google actions.

JJJJJ will use commercially reasonable efforts to maintain the Service in compliance with the Google API Services User Data Policy, applicable Limited Use requirements, and security or verification conditions communicated by Google. JJJJJ may modify, limit, suspend, or discontinue particular features, scopes, or integrations if reasonably necessary to satisfy Google's requirements, address a security concern, or preserve the Service's authorization or Marketplace availability.

4.2 Gemini API — Content Handling and Retention

When a rule evaluates, the Service sends email metadata and the first 2,000 characters of the plain-text body to the Google Gemini API. Handling of that content by Google is governed by Google's Gemini API Additional Terms of Service and the Generative AI Prohibited Use Policy, not by this Privacy Policy. As of the effective date above and based on Google's then-current public representations:

• the Gemini paid API does not use your prompts or responses to train Google's generative models;
• the Gemini free tier may cache prompts and responses for a limited period to improve service quality and Google may use free-tier content to improve Google services, including its AI models, consistent with the Gemini API Additional Terms;
• Google may log API requests for abuse prevention, debugging, and to comply with law.

If your emails contain sensitive content and you are on a free Gemini API key, you should enable billing on your Gemini API key to opt into the paid-tier protections, or not use the Service for those emails. Google's terms control; verify current policy at ai.google.dev/gemini-api/terms before relying on the above.

You are responsible for reviewing and complying with the Gemini API terms applicable to your account and for deciding whether particular email content is appropriate to send to Gemini. If your emails may contain sensitive, regulated, confidential, privileged, or high-risk information, do not evaluate those messages with the Service unless you have confirmed that your Gemini configuration and legal basis are appropriate (see Section 10). AI-generated evaluations, summaries, and alerts may be incomplete, inaccurate, delayed, or misleading. The Service is an alerting and productivity tool; it does not provide legal, medical, financial, security, employment, or other professional advice, and it does not replace human review of important communications.

5. Third-Party Data Sharing

The Service shares data with third-party services only when you explicitly enable the integration:

The Google-native channels (Chat, Calendar, Sheets, Tasks, Docs) do not send data to any third party — they write to services within your own Google account using your own OAuth credentials.

SMS — controller vs. processor roles. You, not JJJJJ Enterprises, LLC, decide whether SMS alerts are sent, which phone numbers receive them, and which provider delivers them. For purposes of applicable U.S. state privacy laws, you are the controller (or "business," under the CCPA) of any recipient phone numbers you supply. We transmit your data (recipient numbers and alert text) to the SMS provider you select, acting as a data conduit; the SMS provider processes that data as an independent processor or sub-processor on your behalf, under its own contract with you. See § 5.2 for our subprocessor list. JJJJJ does not independently collect recipient consent, maintain do-not-call or do-not-text lists, register messaging campaigns on your behalf, or audit your compliance with SMS laws; you are responsible for ensuring that each recipient has provided all legally required consent, that opt-out requests are honored, and that carrier and provider rules are followed.

SMS messaging consent and mobile information — no sharing. Phone numbers and any SMS opt-in or consent information collected to deliver text-message alerts are used solely to send the alerts you configure, through the SMS provider you select. We do not sell, rent, or share mobile phone numbers or SMS opt-in/consent information with any third party or affiliate for marketing or promotional purposes. No mobile information is shared with any third party for that party's own marketing, and it is disclosed only to the SMS provider you choose, solely to deliver your own messages. SMS alerts are one-way notifications sent only to numbers you explicitly configure in Settings; message frequency varies with how many of your rules match incoming email. Message and data rates may apply. Reply STOP to a message to opt out, or HELP for help; you can also disable SMS at any time by removing the SMS channel from your rules or deleting your SMS provider credentials in Settings. Additional sender obligations are described in our Terms of Service § 4.1.

We do not share any data with analytics services, advertising networks, data brokers, or any party not listed above.

5.1 Links to JJJJJ Enterprises Related Products

Our website may display links to other products operated by JJJJJ Enterprises, LLC. The other emAIl Sentinel editions — emAIl Sentinel Pro (self-hosted) and emAIl Sentinel for Microsoft 365 (Outlook add-in) — are separate services with their own architectures and their own privacy policies. Other JJJJJ products, including Natty the Nocrastinator, PilotTrainerHQ (pilottrainerhq.com), and PlaneFacts (planefacts.online), are likewise independent services with their own privacy policies. Visiting or using those products is governed solely by their respective policies. This edition of emAIl Sentinel does not share your personal data with those other JJJJJ products.

5.2 Subprocessors

A "subprocessor" is a third party that processes personal data on behalf of another processor. The Service uses the following subprocessors:

We will notify registered users at least 30 days in advance before we add or replace a Google-level subprocessor that processes email content (for example, if we introduce a non-Google model provider as an optional rule evaluator in a future release). Notice will be posted at the URL where this Privacy Policy is hosted. You may stop using the Service if you object to a proposed subprocessor change before it takes effect.

5.3 Payment Data

The emAIl Sentinel add-in is free and collects no payment data. We do not process, receive, or store any payment card, bank, or other billing details through the add-in.

The separate, optional emAIl Sentinel Pro product (self-hosted) handles its own billing through its own payment processor under its own Privacy Policy; that billing is independent of this free add-in.

6. Data Retention

When you uninstall the add-on, the UserProperties store associated with the script is no longer accessible from any application.

To explicitly delete all stored data before uninstalling, run the following one-liner in the Apps Script editor:

PropertiesService.getUserProperties().deleteAllProperties();

7. Data Security

• Encryption at rest. All UserProperties values are encrypted at rest using AES-256 on Google's infrastructure. This is a default property of Google Apps Script's PropertiesService; the Service does not implement its own encryption layer, and we do not offer customer-managed or bring-your-own encryption keys. For workloads that require FIPS 140-2 validated cryptography, customer-managed keys, or HSM-backed key storage, the Service is not suitable.
• Encryption in transit. All outbound network calls from the Service use HTTPS (TLS 1.2 or higher, negotiated by Google's UrlFetchApp runtime).
• Credential handling. Your Gemini API key is masked in the Settings UI after you save it — only the last four characters are shown; the input field is left blank so the full key is never redisplayed. SMS provider credentials are visible within the Settings UI so you can review and update them; all credentials are stored encrypted at rest as described above.
• Attack surface. The Service has no external backend, no database, and no staff access to your UserProperties store. The only attack surface is your own Google account and the third-party APIs you configure.
• Operational telemetry. The add-on's appsscript.json manifest sets "exceptionLogging": "STACKDRIVER", which routes uncaught script exceptions (stack traces, timestamps, and line numbers) to Google Cloud Logging (formerly Stackdriver) within our Google Cloud project so we can diagnose crashes. These logs may include function names, Apps Script error messages, and — in rare cases — a short error-context string automatically attached by Apps Script. They do not include your email content, your rules, your Gemini API key, or SMS credentials. Logs are retained per Google Cloud Logging's default retention policy and are accessed only to investigate errors or abuse.
• Cookies and tracking — none. The Service does not set cookies. Our public marketing website (and the HTML legal pages served from it) does not set cookies, does not use third-party analytics, does not embed tracking pixels, and does not load fonts or scripts from third-party CDNs. We make this an explicit, ongoing commitment: if we ever add analytics, it will be a cookieless, privacy-preserving provider (for example, a service that counts visits via referrer headers without storing identifiers in the browser), and we will update this Policy before doing so. Because no cookies are set and no tracking identifiers are used, no cookie-consent banner is required under U.S. state privacy laws — and none is displayed.
• No restricted scopes. The Service requests no Google-classified restricted OAuth scope; Gmail access is limited to the current-message sensitive scope described in § 4.1, so no CASA security assessment is required by Google.
• Certifications. JJJJJ Enterprises, LLC does not currently hold SOC 2 Type II, ISO 27001, HIPAA, or PCI DSS certifications. The Terms of Service (§ 16) describe the security documentation we make available on request.

7.1 Incident Notification

If we become aware of a security incident affecting data the Service processes on your behalf, we will notify affected users without undue delay — and in any event within 72 hours of becoming aware of the incident where required by applicable U.S. state breach-notification law — via the email address associated with your Google account, and will describe the nature of the incident, the data potentially affected, and the steps you can take.

8. Children and Young Users

The Service is not directed to, and we do not knowingly collect personal data from, individuals under the age of 18, or under 13 in the United States as defined by the Children's Online Privacy Protection Act (COPPA). The Service provides no age-gating mechanism; parents and guardians who allow a minor access to a Google account on which the Service is installed remain responsible for supervising that use.

If we learn that we have collected personal data from a child in violation of applicable law, we will take steps to delete it promptly. Contact legal@jjjjjenterprises.com if you believe a child's data has been collected.

9. Geographic Scope and Your Privacy Rights

The Service is currently offered exclusively to users located in the United States (see Terms of Service § 2). The Google Workspace Marketplace listing is region-restricted to the United States. We do not target the European Economic Area, the United Kingdom, Switzerland, or any other jurisdiction outside the United States, and we do not currently maintain an EU/UK representative or Standard Contractual Clauses framework for transfers from those jurisdictions. If we expand availability in the future, this Policy will be updated and existing users will be notified before any cross-border transfers begin.

Your data is processed by Google (Apps Script, Gemini) and, if you enable SMS, by your chosen SMS provider, in the United States and other regions where those subprocessors operate data centers. See § 5.2.

Controller / processor roles. For personal data contained in the emails you process through the Service (the sender address of an inbound email, its subject, body excerpt, attachment filenames, any phone numbers you supply as SMS recipients, etc.):

• You are the controller. You determine the purposes and means of processing by choosing which emails to evaluate, writing the rules, and choosing the alert channels.
• JJJJJ Enterprises, LLC acts as a service provider / processor on your behalf, performing the rule evaluation and alert dispatch you directed. We do not independently decide what email content to process or where to send it.
• Google (Apps Script, Gmail, Gemini, and Google-native alert channels) and your chosen SMS provider act as subprocessors (or, for SMS providers selected by you, as independent processors under a direct contract between you and them). See § 5.2.

For account-level data (support correspondence with us) JJJJJ Enterprises, LLC acts as a controller.

To the extent GDPR, UK GDPR, or similar international laws apply despite the U.S.-only scope, JJJJJ's legal bases for processing may include performance of a contract, consent for optional integrations, legitimate interests for security and abuse prevention, compliance with law, and processing at your direction. International expansion may require updated terms, a data processing agreement, representative obligations, transfer safeguards, and additional disclosures; JJJJJ may restrict or discontinue access from particular jurisdictions unless and until those requirements have been addressed.

Because all data is stored in UserProperties within your own Google account, you can exercise most data-rights requests directly by viewing, editing, or deleting your data through the Apps Script editor. To delete all stored data in one step, run this in the Apps Script editor:

PropertiesService.getUserProperties().deleteAllProperties();

9.1 Your Rights Under CCPA / CPRA (California Residents)

Notice at Collection (Cal. Civ. Code § 1798.100(b)). At or before the point at which the Service first collects personal information from you — which occurs when you install the add-on and open its Settings card — this Privacy Policy is linked from the add-on Help card and from the Google Workspace Marketplace listing. The categories of personal information we collect, the purposes for which they will be used, the categories of third parties with whom they may be shared, and your CCPA rights are described below and in Section 2 (Data We Access), Section 3 (Data You Provide), and Section 5 (Third-Party Data Sharing).

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the rights described below.

Categories of personal information we process. In the 12 months preceding the date you read this policy, the Service processes:

Sources. All personal information comes from your own Gmail account, from the rules, credentials, and settings you enter directly into the Service.

Business purposes. Rule evaluation, alert generation, alert delivery via the channels you configure, basic operation of the Service. We do not use personal information for advertising, profiling, or any purpose beyond the Service functions you enable.

Third parties with whom we share. Only those listed in Section 5 of this Policy, and only at your direction (i.e., only when you enable the relevant alert channel or integration).

Sale or sharing of personal information. We do not sell or share personal information as those terms are defined under CCPA/CPRA, and we have not done so in the 12 months preceding the effective date of this Policy. The Service has no advertising integrations and no cross-context behavioral advertising.

Sensitive personal information (SPI). Email body excerpts sent to Gemini for evaluation may incidentally contain sensitive personal information (for example, health information in a message from your doctor, or account numbers in a statement from your bank). The Service uses SPI only for the single, narrow, disclosed purpose of: (i) evaluating whether the email matches a rule you configured, and (ii) composing the alert message your configured channels receive. We do not use SPI to infer characteristics, build profiles, train or fine-tune any model, cross-reference against other users' data, or for any secondary purpose. SPI is not stored by the Service beyond the transient in-memory processing of each evaluation — once Gemini has returned a match decision and the alert has dispatched, the in-memory copy is discarded. This use is within the narrow set of permissible purposes enumerated at Cal. Civ. Code § 1798.121(a); accordingly, the right to limit use and disclosure of sensitive personal information does not restrict this processing further.

Your rights. - Right to know — request disclosure of the categories and specific pieces of personal information we process about you - Right to delete — request deletion of your personal information - Right to correct — request correction of inaccurate information - Right to opt out of sale/sharing — not applicable; we do not sell or share - Right to limit use of sensitive personal information — not applicable; we use SPI solely for the permissible business purposes described above (performing the Service at your direction) - Right to non-discrimination — we will not discriminate against you for exercising any CCPA right

How to exercise your rights. Email legal@jjjjjenterprises.com with the subject "CCPA Request" and your Gmail address (see Section 13). We will respond within 45 days. Because all data is stored in your own Google account, you can also exercise deletion directly using the Apps Script one-liner above.

Authorized agents. You may designate an authorized agent to submit a request on your behalf. To verify the agent's authority, we require:

1. a copy of a written permission signed by you (or, in lieu of written permission, a valid power of attorney issued pursuant to California Probate Code §§ 4000–4465);
2. a signed declaration under penalty of perjury from the agent confirming their authorization to act on your behalf; and
3. confirmation directly from you (by a method we specify) that you authorized the agent to submit the request.

We may deny an agent's request if the above verification is not satisfied. These requirements do not apply to agents who are attorneys licensed in California acting within the scope of their representation.

Shine the Light (Cal. Civ. Code § 1798.83). California residents may request information about whether we disclose personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes; accordingly, a Shine the Light request will return a "no disclosures" response.

9.2 Residents of Other U.S. States with Comprehensive Privacy Laws

A growing number of U.S. states have enacted comprehensive privacy laws that grant residents rights similar (but not identical) to those granted under California's CCPA/CPRA. These include, as of the effective date of this Policy: Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA — our home-state law), Oregon (OCPA), Montana (MTCDPA), Tennessee (TIPA), Delaware (DPDPA), New Jersey (NJDPA), Iowa (IPDPA), Indiana (INPDPA), New Hampshire (NHPA), Kentucky (KCDPA), Maryland (MODPA), Minnesota (MCDPA), Nebraska (NDPA), Rhode Island (RI-DTPPA), and any additional state laws that enter into force after the effective date.

Rights typically available to residents of these states include the right to:

• access / confirm whether we are processing your personal data;
• correct inaccurate personal data;
• delete personal data we hold about you;
• port your personal data in a portable, machine-readable format;
• opt out of sale, sharing for cross-context behavioral advertising, targeted advertising, or profiling in furtherance of decisions producing legal or similarly significant effects about you (we do none of these, so the opt-out is automatically satisfied);
• appeal our response to a rights request under laws that provide an appeal mechanism (Virginia, Colorado, Connecticut, Texas, Oregon, and others).

To exercise any of these rights, email legal@jjjjjenterprises.com with your Gmail address and the state under whose law you are making the request. We will respond within 45 days (some states allow an additional 45-day extension for complex requests; we will notify you in writing if an extension is needed). If we decline your request, you may appeal that decision by replying to the response email or by emailing legal@jjjjjenterprises.com with the subject line "Privacy Appeal"; we will review appeals within 60 days and, where a state law requires, inform you of your right to contact the state attorney general.

As with CCPA, we do not sell or share personal information, engage in targeted advertising, or conduct automated profiling producing legal or significant effects. We do not process sensitive personal data except as described in § 9.1 (SPI) above.

9.3 Do Not Track and Global Privacy Control

The Service does not track users across websites or services and does not respond to Do Not Track signals because it has no occasion to do so. The Service honors Global Privacy Control signals in the sense that it does not sell or share personal information regardless.

10. Not for Regulated or High-Risk Data

The Service is not designed for, and JJJJJ does not hold the Service out as compliant with, HIPAA, PCI DSS, SOX, GLBA, FERPA, or similar regulated-data regimes. Unless JJJJJ expressly approves a particular regulated-data use case in a separate written agreement, the Service should not be used to process protected health information, cardholder data, student education records, regulated financial records, children's data, classified information, export-controlled information, or other highly regulated information.

A separate written agreement may permit a specifically approved regulated-data workflow only if the parties have identified the applicable legal and technical requirements and confirmed that the relevant Google configuration, Gemini tier, alert channels, integrations, security measures, service providers, and contractual protections are appropriate. The availability of such an agreement is not guaranteed and must be determined case by case before regulated information is processed through the Service.

For HIPAA specifically: JJJJJ is not acting as a Business Associate, does not offer a Business Associate Agreement for the Service, and does not intend the Service to be used for PHI. If you are a healthcare provider, health plan, healthcare clearinghouse, business associate, subcontractor, or other party subject to HIPAA, you must not use the Service to evaluate messages containing PHI unless JJJJJ has first entered into a separate written agreement that expressly authorizes the specific HIPAA-related workflow and includes any required Business Associate Agreement or other safeguards.

You are responsible for choosing which messages to evaluate, disabling inappropriate alert channels, and ensuring that you do not send sensitive or regulated content to Gemini, SMS providers, webhooks, MCP endpoints, or other third parties without a lawful basis and appropriate safeguards. The Service also is not intended to process attorney-client privileged communications, trade secrets, employment records, personal financial data, government identifiers, biometric data, genetic data, precise geolocation, or other sensitive personal information unless you have independently determined that the use is lawful and appropriate. Treat email-derived alerts as potentially containing confidential information.

11. Business Transactions, Legal Requests, and Protection of Rights

If JJJJJ is involved in a merger, acquisition, financing, reorganization, asset sale, bankruptcy, or similar transaction involving the Service, limited information related to the Service may be transferred as part of that transaction, subject to this Privacy Policy and applicable law. Because JJJJJ does not operate a backend storing your Gmail content, the information available for transfer is limited.

We may disclose information we hold if we reasonably believe disclosure is necessary to comply with law, respond to valid legal process, cooperate with regulatory requests, enforce our agreements, investigate misuse, prevent fraud or security threats, protect the rights or safety of users or the public, or establish, exercise, or defend legal claims. Any disclosure will be limited to what we reasonably believe is necessary for the applicable purpose.

12. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes that reduce your rights or expand the categories of data processed, we will notify you by email to the Google account associated with your use of the Service at least 30 days before the change takes effect. We will obtain affirmative consent where required by applicable law before implementing new uses of your data not described in this Policy. The "Effective date" at the top will reflect the latest revision.

13. Contact

For technical support you may also open an issue on GitHub — issues are tracked, searchable, and get the fastest response.

We will respond to data-rights requests within the timeframes specified in Section 9.1 (CCPA: 45 days) and Section 9.2 (other U.S. states: 45 days).