Privacy Policy
Convolios brings your conversations from email and messaging services into one inbox, organised by person, with optional AI features for search, summaries and drafting. This policy explains what data we handle, why, where it is stored, who helps us process it, and the choices you have.
1. Who we are
Convolios is operated by Plutio LTD, a company registered in England & Wales (company no. 09856706), trading as Convolios. We are the controller of the personal data described here. Contact us at hello@convolios.com.
2. Data we handle
- Your account: your email address (or the Google account you sign in with), sign-in records, and settings.
- Connected accounts: when you connect Gmail, another email provider (over IMAP), Telegram, X (Twitter) direct messages or another messaging service, we receive the messages in that account (content, subject, attachments, reactions), their metadata (senders, recipients, dates, labels, folders, read state), and the credentials needed to stay connected (for example OAuth tokens, an app password or a Telegram session).
- Google contacts and calendar: when you connect a Google account, the names, email addresses and photos of your Google contacts and “Other contacts”; and if you also connect Google Calendar, your list of calendars and their events.
- People you communicate with: names, addresses and message content from people who write to you or whom you write to, because they appear in your connected accounts.
- Choices you bring from another email app: if you use “Bring everything over” in the desktop app, it reads which senders you allowed, blocked or marked as priority in that app on your computer, and we store those addresses and choices so they apply in Convolios too. It never reads that app’s passwords or sign-ins.
- Data we create for you: how messages are grouped by person, labels such as “urgent” or “newsletter”, search indexes, summaries, drafts, and a profile of your writing style if you use drafting.
- Device and diagnostics: app version, device type, push-notification tokens, and error reports. Diagnostics never include message content.
- Billing (when paid plans launch): handled by our payment provider; we do not store card numbers.
3. How we use it
We use your data only to provide and improve the features you use:
- syncing your connected accounts so your inbox is up to date on all your devices, including while they are off;
- showing, searching, sending, replying to and organising your messages at your request;
- AI features you choose to use: sorting, search answers, summaries of a person or thread, and reply drafts;
- notifications about new messages and about accounts that need reconnecting;
- keeping the service secure, preventing abuse, and fixing problems.
We do not sell your data, use it for advertising, or let anyone use it to train general AI models. Your writing-style profile is used only for your own drafts, and you can view and delete it.
4. Data from Google and Microsoft accounts
If you connect a Google account, Convolios asks for these permissions, and uses each only as described:
- Gmail (
gmail.modify): to sync your mailbox (including changes you make in Gmail), send the emails and reactions you write, and make the changes you make in Convolios (read, unread, starred, moved to Trash) in Gmail too. Convolios never permanently deletes your email. - Your Google account (
openid,email,profile): your email address to identify the account and sign you in, and your profile photo for your own picture in the app. - Contacts (
contacts.readonly,contacts.other.readonly): only the names, email addresses and photos of your Google contacts and “Other contacts”, to show who people are, the way Gmail does. A contact’s name is used for someone who has no other name in Convolios, and then appears wherever that person does. Convolios never changes your contacts. These permissions are optional. - Google Calendar (
calendar.events,calendar.calendarlist.readonly), only if you connect it: to show your calendars and events in Convolios, keep the plans you make in Convolios on your Google calendar (when a plan has guests, Google emails them the invitation and any changes), and use the times you are busy to suggest other times when someone proposes a time that clashes.
Your Gmail messages and attachments are never sent to AI features. Two things from Google can be: the name you have for a person, when AI reads your chats with them, and the start and end times of busy events on your calendar (never their titles or details), when AI writes a suggested reply offering other times. If you connect a Microsoft account, we request equivalent permissions for Outlook mail.
Convolios’s use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. In particular:
- we use Google user data only to provide and improve the user-facing features described above;
- we transfer it only to the service providers listed in section 6, only to run those features, or when required by law;
- we never use it for advertising, never sell it, and never use it to train general AI or machine-learning models;
- no person at Convolios reads your messages unless you explicitly ask us to (for example for support, for specific messages you point to), or where it is needed for security or to comply with the law.
You can disconnect an account at any time in the app. You can also revoke access in your Google account or Microsoft account.
5. Where your data is stored and how it is protected
- Location: our database, servers, message storage and search index are in the European Union (Frankfurt, Germany). AI processing runs in Google Cloud’s EU region.
- Encryption: data is encrypted in transit (TLS) and at rest. Message content, attachments and account credentials are additionally encrypted by our application with a key unique to each connected account, protected by a hardware-backed key in Google Cloud Key Management (EU).
- What is not application-encrypted: message metadata (such as senders, recipients and dates) and the search index and AI embeddings derived from your messages. These are still encrypted at rest by our providers and are only accessible to your account.
- AI processing: content sent to our AI provider (Google Vertex AI, EU) is processed to answer your request and is not retained or used for training.
- Access: staff access to production systems is limited, logged and protected by hardware-key sign-in.
6. Service providers we use
These companies process data on our behalf under data-processing agreements:
- Supabase: database and sign-in (EU, Frankfurt)
- Fly.io: servers that run syncing and the app backend (EU, Frankfurt)
- Cloudflare: encrypted message and attachment storage (EU), and our website’s DNS
- turbopuffer: search index (EU, Frankfurt)
- Google Cloud: AI processing, key management and Gmail change notifications (EU)
- Expo: delivering push notifications to your phone (notifications contain no message content)
- Resend: our own emails to you, such as sign-in codes
- Better Stack and Sentry: monitoring and error reporting, without message content
- Vercel: hosting this website
- Paddle: payments and tax, when paid plans launch
Some of these providers are based in the United States. Where data is transferred outside the UK or EU, we rely on the EU–US Data Privacy Framework and its UK extension, or on standard contractual clauses.
The services you connect (such as Google, Telegram, X or your email provider) handle your messages under their own terms and privacy policies.
7. How long we keep data
- When you connect an email account we import the last 90 days of messages, and index up to one year for search. Older messages stay with your provider and are fetched only when you ask for them.
- We keep synced data while the account stays connected.
- When you disconnect an account or delete your Convolios account, its data is removed from our active systems promptly and from backups within 90 days. The encryption keys for that account are destroyed, so any remaining backup copies become unreadable.
- If your Convolios account is inactive for 6 months, we notify you and then delete it.
- Diagnostics and logs are kept for up to 30 days.
8. Your rights
Under UK and EU data-protection law you can ask to access, correct, delete or export your data, object to or restrict our processing, and withdraw consent at any time. Email hello@convolios.com; we respond within one month.
If someone uses Convolios and you have emailed or messaged them, your data may appear in their inbox. We process it on the basis of our legitimate interest in providing the service to our user. You can contact us to exercise your rights too.
You can complain to the UK Information Commissioner’s Office (ico.org.uk) or your local data-protection authority.
9. Legal bases
- Contract: to provide the service you signed up for, including syncing and features you use.
- Consent: for connecting each account, for optional AI features, and for notifications.
- Legitimate interests: security, abuse prevention, service improvement, and processing data about people who communicate with you.
- Legal obligation: where the law requires us to keep or disclose data.
10. Children
Convolios is not intended for anyone under 16, and we do not knowingly collect their data.
11. Changes
We will update this page when our practices change, and tell you in the app or by email about significant changes before they take effect.
12. Contact
Plutio LTD (trading as Convolios), 1 Lyric Square, London W6 0NB, United Kingdom. hello@convolios.com