1. Who we are
Singlebrief is operated by Anand Arora (“we,” “us,” “our”), an individual based at:
97/3, Belleza, Emaar Marbella, Sector 66, Gurugram, Haryana, India
For the purposes of India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), Anand Arora is the Data Fiduciary. For the purposes of the EU/UK General Data Protection Regulation (“GDPR”), Anand Arora is the Data Controller.
Grievance Officer / Data Protection Contact: Anand Arora , singlebriefhq@gmail.com
2. What data we collect?
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, phone number, password (hashed) | You, at signup |
| Payment data | Payment method verification status (we never store full card numbers — handled by Razorpay/Stripe directly) | You, via Razorpay/Stripe |
| Connected mailbox data | Gmail messages, headers, attachments, labels, contacts you email | Google, via OAuth you explicitly grant |
| Calendar data | Event titles, times, attendees, descriptions | Google Calendar, via OAuth |
| Native mailbox data | Mail sent/received at your @sbrief.me address |
Our managed mail provider |
| Usage data | Feature interactions, sync status, error logs | Automatically, while you use the product |
| Vault data | Content you explicitly move into the encrypted Vault | You, explicit action only |
We request the minimum Gmail/Calendar OAuth scopes needed for the features you use, and you can review and revoke this access at any time via your Google Account settings and via Singlebrief’s own Sources settings.
3. Why we process your data (purpose and lawful basis)
| Purpose | DPDP basis | GDPR lawful basis |
|---|---|---|
| Provide the core mailbox/calendar/Open Loop service | Consent given at signup, necessary for the service you requested | Performance of a contract (Art. 6(1)(b)) |
| Detect fraud, abuse, and secure accounts (phone/card verification) | Legitimate use necessary for providing service | Legitimate interests (Art. 6(1)(f)) |
| Generate AI drafts and summaries only when you explicitly request them | Consent | Consent (Art. 6(1)(a)) |
| Send you service notices (security alerts, billing) | Necessary for service | Legitimate interests / contract |
| Comply with law enforcement or legal obligations | Legal obligation | Legal obligation (Art. 6(1)(c)) |
We never use your mailbox content to serve you advertising, and we never sell your personal data to third parties.
4. AI processing — what actually happens
- Deterministic features (category routing, search, spam/label rules, Gatekeeper sender rules) run entirely on our own infrastructure and involve no third-party AI processor.
- AI-generated features (draft replies, summaries) that you explicitly request are processed by a third-party AI inference provider (currently OpenRouter, which itself routes to model providers such as Anthropic/DeepSeek depending on your settings). Only the specific thread content needed for that one request is sent; it is not used to train third-party models under our processing agreement with them. [PLACEHOLDER — confirm and cite the specific no-training clause from your OpenRouter/model-provider agreement before publishing.]
- Retention of AI model input is capped at 30 days, after which it is deleted from processing logs on our side. Durable content you create yourself (task text you type or edit, saved decisions) is retained until you delete it.
- No AI feature ever sends a message, changes a calendar event, or takes any externally-visible action without your explicit, one-by-one approval.
- We do not use AI to browse the open web on your behalf.
5. The Vault
Content you explicitly move into the Vault is encrypted (PIN/passphrase-derived key, Argon2id) and is never sent to any AI processor, ours or third-party, under any circumstance.
6. Who we share data with
| Recipient | Purpose |
|---|---|
| Google (Gmail/Calendar API) | To sync mail/calendar you’ve connected — governed by Google’s own terms as well as ours |
| Our managed mail provider | To operate inbound/outbound mail for your @sbrief.me address |
| OpenRouter and underlying AI model providers | Only for AI features you explicitly trigger |
| Razorpay (India) / Stripe (global) | Payment processing — they receive your payment details directly; we do not store full card numbers |
| Have I Been Pwned | Periodic, address-only breach monitoring (your email address, hashed/k-anonymized where the API supports it) |
| Law enforcement / regulators | Only where legally compelled |
We do not sell personal data. We do not share your data with data brokers or advertisers.
7. International data transfers
Your data may be processed in India, the United States, or other countries where our infrastructure or processors operate.
8. Your rights
If you are in India (DPDP Act 2023)
- Right to access a summary of your personal data and processing activities.
- Right to correction and erasure of inaccurate or no-longer-necessary personal data.
- Right to grievance redressal — contact our Grievance Officer (Section 1); we will respond within [PLACEHOLDER — confirm your committed SLA, DPDP does not fix a statutory number but expects timely resolution].
- Right to nominate another individual to exercise your rights in the event of death or incapacity.
- Right to withdraw consent at any time, without affecting processing already carried out.
If you are in the EU/UK/EEA (GDPR)
- Right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), and to withdraw consent at any time (Art. 7(3)).
- Right to lodge a complaint with your local supervisory authority.
- We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects — every AI-prepared action requires your explicit human approval before anything happens.
To exercise any of these rights, contact singlebriefhq@gmail.com.
9. Data retention
- Account and mailbox data: retained for as long as your account is active, plus 15 days after cancellation, unless you request earlier deletion.
- Logging out does not delete your synced mail, sources, or Open Loops — only your login session ends. Deleting your account deletes the underlying data per our deletion process.
- AI processing logs: 30 days (Section 4).
- Payment records: retained as required by applicable tax/financial law (typically several years) even after account deletion, where legally mandated.
10. Security measures
Argon2id password/PIN hashing, encrypted refresh token storage, TLS in transit, attachment scanning, tracking-pixel blocking by default, and phone + verified-payment-instrument account verification to deter abuse. No security measure is perfect; we will notify affected users and, where required, the relevant regulator (India’s Data Protection Board; EU supervisory authorities within 72 hours per GDPR Art. 33) in the event of a data breach.
11. Children’s data
Singlebrief is not directed at, and is not intended for use by, individuals under 18. We do not knowingly collect personal data from children. If we learn a child’s data has been provided to us, we will delete it.
12. Changes to this policy
We will post any material changes here and, where required by law, notify you directly before the change takes effect.
13. Contact
Anand Arora 97/3, Belleza, Emaar Marbella, Sector 66, Gurugram, Haryana, India , Email : singlebriefhq@gmail.com