Privacy Policy

Effective date: 2026-10-27

PinGO is operated by SOMATÓRIO CELESTIAL UNIPESSOAL LDA, a Portuguese single-member private limited company (Sociedade unipessoal por quotas), Portuguese tax number 517398990, with its registered office at Rua da Carvalha, 570, Parceiros, 2400-441 Leiria, Portugal ("PinGO", "we", "us"). This Privacy Policy explains how PinGO handles account data from Telegram and data used by optional Gmail, Google Calendar, iCloud Mail and Mail.ru connectors.

What PinGO Does

PinGO helps approved users work with workspace email and calendar context through a Telegram bot. It can show email previews, show selected original email text, prepare and send user-approved replies, move messages to spam or trash, mark messages as read, show upcoming calendar events, create calendar events, update RSVP status, and provide workspace summaries based on accessible email and calendar information.

PinGO Account and Telegram Data

Registration does not require a Google connection. When you register through the Telegram bot, PinGO receives your Telegram user ID and display name from the signed Telegram update, records your interface language, creates a PinGO profile and creates your first personal workspace. PinGO uses this data to identify your bot account, apply your language and settings, enforce workspace permissions and deliver requested bot features. PinGO does not ask you to enter your Telegram ID manually.

We retain this profile data while your PinGO account is active. To delete the profile, its owned workspaces and PinGO-controlled active data, contact rule@inbox.ru and include your Telegram ID. PinGO may ask you to confirm the request through the associated Telegram account. We complete deletion of active profile data within 72 hours after a verified request; backups rotate within 30 days. We may retain a minimal security and audit record without message content or OAuth tokens where necessary for accountability, security or legal compliance.

Legal Bases

For users in the European Economic Area, we process account, connector, workspace and requested feature data because it is necessary to provide the service requested by the user and perform our agreement with that user (GDPR Article 6(1)(b)). We process limited security, abuse-prevention, diagnostic, delivery and audit data for our legitimate interests in protecting PinGO, its users and connected systems and in maintaining a reliable service (Article 6(1)(f)); users may object as described below. We process records where necessary to comply with legal obligations (Article 6(1)(c)).

Where consent is legally required for an optional activity, we rely on consent (Article 6(1)(a)); it can be withdrawn at any time without affecting processing already lawfully completed. Granting Google OAuth permissions authorizes technical access to the selected Google services but is not used as the sole legal basis for every processing activity.

Google Data We Access

Depending on the Google account and connector authorized by the user, PinGO may access:

• Gmail message metadata, labels, sender and recipient fields, subject lines, snippets, message body content, attachment filenames, thread identifiers, and message identifiers. The backend retrieves full message payloads for inbox and historical samples, even when the interface displays only a preview.
• Gmail account actions needed to send replies, mark messages as read, move messages to spam, restore messages, move messages to trash, and restore trashed messages.
• Google Calendar event information, including event title, time, status, organizer, creator, attendees, recurrence metadata, RSVP status, reminders, and event identifiers.
• OAuth tokens needed to keep the connected Google connector working until access is revoked.

PinGO does not request Google Drive access in the current MVP.

iCloud Mail and Mail.ru Data

The optional iCloud Mail and Mail.ru pilot is email-only. When a user connects one of these providers, PinGO processes the mailbox address, an app-specific password, message metadata and identifiers, sender and recipient fields, subjects, snippets, selected message bodies, attachment filenames and the mailbox actions needed for the same email features described above. Calendar data is not requested from these providers. The app-specific password is submitted through a five-minute, single-use HTTPS form, encrypted in the external secret store and never requested through Telegram.

Connecting Google Services

The Google connector requests openid and https://www.googleapis.com/auth/userinfo.email to identify the authorized Google account and verify that it matches the email entered in Telegram. It also requests https://www.googleapis.com/auth/gmail.modify, which covers reading, sending approved replies and supported message-state changes, and https://www.googleapis.com/auth/calendar.events, which covers the calendar features described above. No separate Gmail send, Gmail read-only, or Calendar read-only scope is requested.

Open Connectors -> Gmail, select a workspace you own, enter the expected email address and review the disclosure. The one-time authorization link is valid for two minutes. After Google Web OAuth, PinGO checks the actual Google account email and every granted service scope before accepting the connection. Gmail and Calendar permissions are evaluated independently; when only one service permission is granted and available, PinGO connects only that service and tells the user which service was not connected.

How We Use Google Data

We use Google user data only to provide or improve user-facing PinGO features that are visible in the product:

• showing email and calendar context to authorized users;
• delivering email, calendar, and connector-health notifications;
• generating user-requested summaries and drafts;
• translating selected emails, proposing tasks or calendar events, and preparing historical email context for workspace analytics;
• sending a reply only after the user approves it;
• creating or updating a calendar event only through a permissioned user action;
• maintaining connector health, permissions, deduplication, audit logs, and operational reliability.

PinGO does not use Google user data for advertising, retargeting, sale, credit decisions, or data brokerage.

PinGO automatically sends decoded email text and HTML content to OpenAI to prepare readable plain-text previews and full views whenever a fetched message has no current prepared copy. This applies to notification polling, inbox and full-message requests, and sampled historical messages. Prepared snippets and full substantive bodies are cached encrypted for repeat use. After an email connector is accepted, PinGO also automatically retrieves a limited sample of recent and historical messages and sends selected content to OpenAI to prepare saved historical context for later workspace analytics. Drafts, translations, event proposals and interactive analytics start when the user invokes the corresponding feature. When a user sends a voice message for an AI action, the audio is sent to OpenAI for transcription before the requested action is processed.

PinGO does not use or permit the use of Google Workspace user data to create, train, or improve general-purpose or shared AI/ML models. OpenAI states that API inputs and outputs are not used to train its models by default unless the customer explicitly opts in. PinGO does not opt in to model-improvement data sharing and sends text requests with application-state storage disabled. Standard OpenAI abuse-monitoring retention of up to 30 days may still apply unless enhanced retention controls are separately approved and enabled.

Storage

PinGO may store operational records needed to provide the service, including:

• connector secret references, locally stored OAuth tokens and encrypted app-specific passwords;
• connector account identifiers and workspace access grants;
• email preview state, message identifiers, snippets, subject lines, sender/recipient fields, user draft state, and sent-reply state;
• cached AI-prepared message snippets and full plain-text bodies, deleted with their connector, workspace or owner profile;
• limited historical email summaries and supporting evidence metadata;
• calendar event snapshots and notification delivery records;
• connector health status and audit records.

PinGO is not intended to store complete copies of all mailbox or calendar data as the primary source of truth. Original messages and calendar events remain with the connected provider.

Sharing and Transfers

We do not sell Google user data or transfer it to advertising platforms, data brokers, or information resellers.

We may process Google user data through service providers only when needed to provide PinGO features, such as hosting, databases, queueing, AI processing for the disclosed automatic historical context and user-invoked features, logging, and Telegram message delivery. These providers may process data only for the service purposes described in this policy.

Where personal data is transferred outside the EEA and no adequacy decision applies, PinGO relies on an applicable transfer mechanism such as the European Commission's Standard Contractual Clauses and the provider's Data Processing Addendum, together with supplementary safeguards where required. Users may request information about the applicable safeguard through rule@inbox.ru.

The current production recipients are:

• Kamatera, as infrastructure processor, hosts PinGO in its EU-FR data-center region in Frankfurt, Germany. The application, PostgreSQL, Redis, local OAuth token storage and encrypted backups run on this infrastructure. Kamatera's Data Processing Agreement incorporates the EU Standard Contractual Clauses where relevant.
• OpenAI Ireland Ltd. and its authorized subprocessors, as AI processor, process the limited automatic historical sample disclosed above and context submitted for user-invoked AI features, including voice transcription. Processing location depends on OpenAI's service infrastructure and configured account controls. OpenAI's Data Processing Addendum and applicable transfer safeguards govern this processing. Standard API abuse-monitoring data may be retained for up to 30 days; endpoint-specific application-state rules also apply.
• Telegram, as the independent messaging platform through which users interact with PinGO, processes account data, messages, media, buttons and bot responses under Telegram's own terms and privacy policy. Copies delivered into Telegram are controlled by Telegram and the user, not solely by PinGO.

Google remains the user-selected source system and authorization platform for Gmail and Google Calendar rather than a PinGO-appointed subprocessor. PinGO does not currently use a separate production monitoring or error-tracking provider. PostgreSQL and Redis are self-hosted within the Kamatera VPS and are not separate recipients.

Email content and derived outputs may be shown to workspace users with access to the connected mailbox. Content delivered through Telegram is processed by Telegram. These transfers are disclosed before Google authorization. Recipient roles and safeguards are specified in the production-recipient field above.

Human Access

PinGO personnel may not read Google user data except when:

• the user asks for support and explicitly authorizes review of specific content;
• access is necessary for security purposes, such as investigating abuse or a security-related bug;
• access is required by law; or
• the data, including derived data, is both aggregated and anonymized and used for internal operations in accordance with applicable law.

Security

PinGO's public web endpoints use HTTPS. The host firewall denies unsolicited inbound traffic except for the ports needed for SSH and HTTPS delivery; the application API, PostgreSQL and Redis are not directly exposed to the public internet. Administrative server access uses key-based SSH, and production access is limited to the operator and explicitly authorized maintainers.

Connector-secret and backup directories on the application host are restricted to the service administrator (0700), and secret, backup and production environment files are restricted to their owner (0600). Deployment automation reapplies these permissions before services start. OAuth tokens and non-Google app-specific passwords are stored outside the source repository, encrypted at application level with a production key kept outside source control, and deleted when the connector is disconnected.

Sensitive email sender and recipient fields, subjects, message snippets, draft bodies, calendar titles, participant/recurrence payloads and saved AI questions, summaries and supporting evidence in PostgreSQL are encrypted at application level with a key kept outside source control. Operational identifiers and metadata required for authorization, indexing, deduplication and delivery are not represented as content encryption. Production database and secret backups are encrypted with a separately held backup key, verified after creation, created daily and removed by an independent retention job after 30 days. Container logs are compressed and limited to 30 days. Security updates are installed automatically. PinGO maintains an incident-response procedure covering containment, credential rotation, recovery and legally required notifications. The current host volume is not protected by PinGO-managed full-volume encryption; the application-level controls above protect the identified sensitive fields at rest.

Retention and Deletion

While connected, PinGO retains operational Google data needed for the disclosed service features.

Use Disconnect for the Gmail connection in PinGO to stop PinGO access and delete its stored connector data. PinGO disables the connector locally, removes its local OAuth token and connector-derived active data, including saved analytical outputs, and attempts to revoke the Google grant. If Google revocation cannot be confirmed, PinGO tells you to remove PinGO manually from your Google Account connections. Our public commitment is to complete deletion of active connector data within 72 hours of disconnect or a deletion request. Backup copies are removed through backup rotation within 30 days.

For iCloud Mail and Mail.ru, Disconnect immediately removes PinGO's encrypted app-specific password and connector-derived active data, including saved analytical outputs. PinGO cannot revoke that password remotely. The bot therefore instructs the owner to revoke it separately in Apple Account or Mail.ru security settings. Disconnect does not delete original messages at the provider.

We retain a minimal audit record for accountability and security for 365 days. It contains actor, workspace or connector identifiers, action and result metadata, target identifiers and timestamps, but no email content or OAuth tokens. Automatic maintenance deletes records after the retention period. Audit records are accessible only to the operator or an explicitly authorized production maintainer.

You can also revoke access from your Google Account connections. Revoking there stops authorized Google access but does not itself request deletion of previously stored PinGO data. Use Disconnect or contact rule@inbox.ru to request deletion. Copies already delivered to Telegram or other recipients are subject to their applicable controls; these deadlines describe PinGO-controlled active data and backups. Disconnect does not delete original messages in Gmail.

Your Data Protection Rights

Subject to the GDPR and applicable exceptions, you may request access to and a copy of your personal data, correction of inaccurate data, deletion, restriction of processing and data portability. You may object to processing based on legitimate interests and withdraw consent where processing relies on consent. PinGO does not make decisions based solely on automated processing that produce legal or similarly significant effects for users.

Send a request to rule@inbox.ru. We may verify the request through the associated Telegram account or request proportionate additional information. We normally respond within one month; where the GDPR permits an extension, we will explain the reason and timing. These rights do not require deletion of records that PinGO must retain by law or needs to establish, exercise or defend legal claims.

You may lodge a complaint with Portugal's supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), or with the competent supervisory authority in your country of residence, work or the alleged infringement.

Changes

We may update this Privacy Policy when PinGO changes how it handles data. If a change materially affects Google user data use, we will update this policy and request any required user consent before using Google user data in the new way.

Contact

Privacy and support contact: rule@inbox.ru

Postal address: SOMATÓRIO CELESTIAL UNIPESSOAL LDA, Rua da Carvalha, 570, Parceiros, 2400-441 Leiria, Portugal

Google API Limited Use Disclosure

PinGO's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.