Privacy that follows the consequence boundary.

Yuvin Lab operates yuvinlab.com, Yuvin Consequence, and the Yuvin Gmail Connector. Yuvin is a governed execution layer between AI systems and external services. This policy covers the public website and any Yuvin preview or pilot that links to it.

Questions, access requests, and deletion requests may be sent to ml@yuvinlab.com.

Depending on the features you use, Yuvin may process:

• contact information and messages you send to Yuvin Lab;
• basic website request, security, device, and diagnostic information;
• organization, tenant, operator, role, approval, and task information;
• Google account identity, granted OAuth scopes, connection health, and encrypted OAuth access and refresh tokens;
• Gmail message bodies, headers, recipients, subjects, labels, thread identifiers, draft identifiers, and message identifiers when a task needs them;
• proposed drafts, approval records, action parameters, timestamps, provider responses, source-readback observations, cryptographic hashes, and execution receipts.

Yuvin requests Gmail data only after a user connects an account and grants the capability shown in Google's consent screen.

Yuvin uses Gmail data only to provide user-requested and governed features:

• read an identified message or thread for an authorized task;
• prepare a draft that the user or organization requested;
• send an approved draft when separate action authority exists;
• read Gmail again to verify the exact draft or sent message;
• prevent duplicate sends, investigate ambiguous responses, and produce receipts;
• maintain, refresh, reconnect, or revoke the Gmail connection.

A connected account is not blanket approval to send mail. Yuvin treats OAuth permission, organizational approval, action authorization, connector execution, and verified completion as separate states.

Yuvin Lab's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell Google user data, use it for advertising, build advertising profiles from it, or permit people to read it except when required to provide support, investigate abuse or security incidents, comply with law, or perform an action explicitly requested and permitted by the user.

A task may require a model to classify, summarize, reason over, or draft from Gmail content. In that case, Yuvin sends only the task-relevant data to the model provider configured for that deployment. Yuvin does not give the model an OAuth token or direct Gmail authority.

The selected provider and its data terms must be approved by the organization operating the deployment. Yuvin does not authorize Google user data to be used for advertising or for training a general-purpose model. A deployment must disable a provider or feature if its terms do not meet that requirement.

Information may be processed by hosting, encrypted-secret, observability, security, and model providers that are necessary to operate the selected deployment. It may also be disclosed when required by law, to protect users or systems, or as part of a business transaction subject to appropriate safeguards.

Yuvin does not sell personal information or Google user data. Deployment-specific subprocessors and data locations must be documented before a production customer is onboarded.

OAuth tokens are kept in a server-owned encrypted secret store while the connection is active. They are not returned to the browser, task model, or public receipt. Disconnecting Gmail removes local connector authority before attempting provider revocation and deletes the locally stored token material.

Task records and receipts may retain limited Gmail content, identifiers, hashes, and approval or readback evidence when needed to execute, verify, recover, investigate, or audit the requested work. Retention is bounded by the deployment's written retention schedule. Users may request deletion at ml@yuvinlab.com, subject to security, legal, fraud-prevention, and immutable-audit obligations.

Yuvin separates model reasoning from connector credentials and action authority. Tokens remain server-side; action attempts use exact account and resource bindings; send actions require separate approval; and successful completion requires Gmail source readback.

No security measure is perfect. Please report suspected vulnerabilities to ml@yuvinlab.com with the subject "Security disclosure". Do not include Gmail content, OAuth tokens, or other sensitive data unless requested through a secure channel.

• choose the Google account and review every requested scope;
• enable only the Gmail capability needed for the task;
• require human approval before sending;
• disconnect Gmail from Yuvin;
• revoke Yuvin from your Google Account security settings;
• request access, correction, export, or deletion by email.

If an organization controls the Yuvin deployment, some requests must be handled by that organization as the controller of its business records.

We will update the date at the top of this page when this policy changes. Material changes to Gmail data use, requested scopes, retention, or model-provider processing will be disclosed before they apply to newly connected users.