Privacy & control

Privacy Policy

Effective September 10, 2026

This policy covers this Counterpart deployment and its Gmail companion extension. Tomas Norkus operates the service. For questions or requests about your information, contact tomasnorkuss@gmail.com.

Information we access and store

• Google account and Gmail: when you connect Gmail, we receive your account email address and OAuth tokens. Read-only Gmail permission permits access to message headers, sender and recipient addresses, subjects, message text, labels, timestamps and identifiers. Counterpart uses inbox and sent-message checks to identify correspondence and stores review items and imported conversation records.
• Optional drafts: the default connection requests read-only Gmail access. If you enable Gmail draft access, Counterpart additionally requests Gmail compose permission to create an unsent draft from an approved reply. You can also prepare replies in Counterpart and insert them using the extension or copy and paste them. Google’s compose permission also permits sending, but this integration uses it to create unsent drafts; you send them in Gmail.
• Workspace records: creator names, contact details, social profiles and profile photos, messages, notes, deal terms, reports, uploaded documents, shipping information and workflow records that authorized users provide or import.
• Extension: the extension can read the open Gmail conversation for matching and user-directed capture, and communicate with this Counterpart deployment. Gmail sender avatars displayed in the extension remain local; social profile photos may be saved in Counterpart.
• Operational information: session cookies, request/error logs and AI usage records support authentication, reliability and cost tracking.

Why we use this information

We use data to match correspondence to creators and deals, preserve conversation history, track follow-ups and fulfillment, and provide user-requested analysis and reply drafting. The Gmail connection is not a complete mailbox archive: matching, review rules and sync limits determine which messages are retained.

AI and service providers

When an authorized user requests AI analysis or drafting, relevant message text and deal information may be sent to OpenRouter and the model provider it routes to, or to Anthropic, depending on the configured feature and model. Uploaded documents may also be processed by Anthropic for requested document features. Hosting infrastructure is provided through Hostinger. Google processes Gmail authorization and API requests.

These providers process information necessary to deliver the requested service under their applicable terms. Only connect data you are authorized to process with these services. Counterpart does not sell Google user data or use it for advertising, credit decisions, or training a generalized AI model.

Counterpart’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used for the user-facing features described here. Human access is limited to authorized workspace use, consented support, security investigation, legal obligations, or other uses permitted by that policy.

Access and security

Workspace access is restricted to authorized users. Gmail OAuth credentials are encrypted at rest, and the hosted application uses HTTPS. Imported correspondence is stored in the application database and operational backups; it is not end-to-end encrypted. Members with workspace access can view the records available within that workspace. No storage or transmission method can guarantee absolute security.

Retention, disconnection and deletion

Workspace records are retained for ongoing partnership management until an authorized operator removes them or handles a deletion request. There is no automatic age-based deletion of imported correspondence. Operational backup copies can remain after deletion from the live workspace; ask the operator about deletion from backups and any retention necessary for legal or security purposes.

Disconnect Gmail in Counterpart Settings to remove the saved connection credentials and stop future sync. Counterpart attempts to revoke the Google token; you can also revoke access through your Google account connections. Disconnection does not delete previously imported messages. To request access, correction, export or deletion of retained personal data, email the contact above and identify the relevant account or records. We may need to verify your identity and authority before acting.

Your choices and changes

You may choose not to connect Gmail, and stop using the extension. Your organization’s Google Workspace policies continue to apply. We will update this page when data practices change and update the effective date. Material changes to Google data use require an appropriate updated disclosure and consent.