Privacy policy
Last updated 30 September 2026.
Honest Intros ("the service", "we") is operated by Otman Ounana. This policy explains what data the service handles, why, and what you can do about it. Questions go to privacy@honestintros.com.
Data we receive from your Google account
When you sign in with Google and connect your mailbox, we request the following and nothing more:
| Data | Purpose |
|---|---|
| Name, email address, profile picture | Creating and identifying your account, and showing which mailbox emails are sent from. |
Permission to send email (gmail.send) | Sending the emails you have approved, from your own address. |
Read access to messages (gmail.readonly) | Detecting replies, bounces, out-of-office notices and opt-out requests in the threads the service started, so that we stop contacting people who asked us to and can show you who replied. |
We query your mailbox only for threads that belong to your campaigns, identified by the message IDs of emails the service sent and by the campaign subject. We do not download, index or store the rest of your mailbox.
How we use Google user data
Google user data is used only to provide the features described above, which are visible to you in the product. Specifically:
- We do not sell Google user data.
- We do not use Google user data for advertising.
- We do not use Google user data to train or improve generalised artificial intelligence or machine learning models.
- We do not transfer Google user data to third parties, except where needed to provide the service to you, to comply with the law, or as part of a merger or acquisition with notice to you.
- No person reads your messages unless you ask us to for support, it is needed for security or to investigate abuse, or the law requires it.
The service's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Other data we handle
Your account and campaign data: the website address you give us, your targeting and exclusion criteria, any customer list you upload so we avoid emailing existing customers, the drafts, your approvals and rejections, and sending records.
Prospect data: business contact details and text published on company websites, collected from public sources to build and personalise your campaigns. Anyone who receives an email sent through the service can opt out by replying or using the unsubscribe link, and can ask us to delete their data at the address above.
The website preview on our home page: when you type a website address there, we fetch a few public pages of that site to show a sample email. We do not ask for or store your name or email address for this. The public text of the site is kept in our shared cache of website snapshots for up to 30 days so it is not fetched again, and the number of previews is limited per network address to prevent abuse; the address itself is not stored.
API keys you provide: if you add your own key for a language model provider, it is stored encrypted and used only for your requests. Website text and draft content for your campaign are sent to that provider to write emails. Content from your Gmail mailbox is not.
Storage, security and retention
- Google refresh tokens are stored encrypted. Access tokens are held in memory only and are never written to logs.
- The text of replies found in campaign threads is kept for up to 30 days, after which we keep only its classification (for example "replied", "bounced", "opted out") and the metadata needed to honour it.
- Opt-outs, hard bounces and spam complaints are kept for as long as needed to make sure the address is not contacted again.
- Other account data is kept while your account is open. Deleting your account removes it from the live service at once; copies in backups are gone within 30 days.
Your choices
- Disconnect Google: from the product settings, or at any time at myaccount.google.com/permissions. Disconnecting in the product also revokes our access with Google and deletes the stored token.
- Delete your account: from the product settings or by writing to us. This removes your account and campaign data.
- Access, correction, deletion, objection: if you are in the EU, the UK or another place that grants these rights, write to the address above and we will answer within 30 days. You may also complain to your local data protection authority.
Service providers
We use a small number of providers to run the service. They process data on our instructions only. The current list, and what each one sees, is on the service providers page.
Changes
If this policy changes in a way that affects how Google user data is used, we will ask for your consent again before the change applies to you.