Control
Control: data and privacy
What is read
The Inbox of the one mailbox you chose: subject, sender, recipients, date, body, attachments up to 3 MB. Nothing in other folders; nothing in mailboxes the connecting account cannot open. The permissions are read-only.
What leaves Control, and to where
| Recipient | Receives | Never receives |
|---|---|---|
| The generative model, hosted in the EU | the prepared text (identifiers replaced, quoted history removed), the subject, the sender's domain, attachment text | the sender's address, identifiers, any other mail |
| Gate | the proposed action and summary, the sender's domain, the subject, a redacted excerpt of up to 1,500 characters, the draft reply | the sender's address, identifiers |
| The daily report (your address) | subjects, sender domains, proposals, Gate's answers | addresses, drafts, anything about the systems behind Control |
Gate's decision model is operated by a processor in the United States under a data processing agreement with standard contractual clauses; the generative model runs in the European Union. The processors are named in the privacy notice. Your own privacy notice should say that mail to the connected mailbox is processed by Työäly and its processors; we provide the wording.
What is stored, and for how long
| Where | What | For |
|---|---|---|
| Control's records (EU) | per message: subject with identifiers replaced, sender's domain, time, status, the proposal, the draft reply, Gate's answer, counts; never the sender's address or the body | 90 days |
| Control's sync state | where reading left off | while connected |
| Gate's record | the decision as answered, its context under the environment's retention mode | 13 months (record), retention mode (context) |
| Logs and metrics | ids, counts, timings, outcomes | 30 days |
The sign-in token that keeps the connection alive is stored encrypted in the EU and is readable by Control alone. You hand over no passwords and no secrets.
What Control never does in Observe mode
It never sends, moves, labels, deletes or marks a message. The permissions are read-only and no code path writes to the mailbox.
Your controls
- The connection is yours: changing the account's password or removing the application stops Control at the next run.
- Records are deleted on request before their 90 days.
- The daily report goes to the address you name and nowhere else.
Something missing or unclear on this page? Write to hei@tyoaly.fi.