Send with your approval
Candao uses Gmail send access only after you choose Approve and send for a prepared Delivery message.
Gmail keeps Delivery conversations moving.
This page explains exactly what Candao accesses, why it is needed, where it goes, how long it is kept, and how you can remove it.
Bring back relevant replies
When read-only sync is enabled, Candao imports only replies matched to active Delivery conversations. It does not import attachments.
Prepare the next draft
Matched reply text and conversation context are processed by Candao's contracted AI provider to prepare a follow-up draft for your review. Google data is not used to train generalized AI models.
You stay in control
Nothing is sent automatically. You can edit, regenerate, reject, or approve every prepared message, disconnect Google, and delete synchronized Gmail data.
User-approved sendMatched reply syncDraft preparationUser reviewUser-approved send
Data we access and store
- Your connected Google account email address, granted scopes, and OAuth credentials.
- For matched Delivery replies: reply text, sender, subject, received time, and Gmail message and thread identifiers.
- Candao does not import Gmail attachments through Delivery reply synchronization.
How access is limited
Reply sync is limited to active Delivery threads with a known recipient and a verifiable relationship to Candao's latest sent Gmail message. Archived, blocked, reported, and deleted threads are excluded. Email content is handled as untrusted conversation data and cannot change Candao's system controls or bypass user approval.
Storage, sharing, and security
OAuth credentials are encrypted at rest with a dedicated server-side encryption key. Google user data is used only to provide Delivery, is never sold or used for advertising, and is shared only with contracted infrastructure, security, and AI-processing providers needed to operate the feature under confidentiality and data-protection obligations, or when legally required.
Retention and deletion
Credentials are retained while your Google connection is active. Disconnecting requests token revocation and removes stored Delivery credentials. In Settings, you can separately delete synchronized Gmail replies and drafts derived from them. Deleting a Delivery conversation removes its synchronized Gmail content, and deleting your Candao account removes the credentials and imported reply content, subject only to legally required retention.
Candao's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.