Privacy Policy

1. Who we are

SonicMail is operated by Ojo AI, Inc., incorporated in Delaware, United States. This policy applies to sonicmail.si, the SonicMail dashboard and its connected services.

For privacy questions, access or correction requests, or account and data deletion, email ibrahim@ojoai.us. We verify your identity and authority before disclosing or deleting information.

2. Information we collect

Account and workspace information includes your name, email address, account identity, workspace memberships, business profile, instructions, settings and support communications. Customer-provided information can include imported company and contact records, research evidence, outreach content, conversations, uploaded attachments, signatures and links.

Service activity includes job and campaign status, sending attempts, provider responses needed to establish submission status, usage, security events and diagnostic information. We use these records to operate and protect the service, recover interrupted work and explain outcomes. The public sample workspace uses clearly labeled synthetic records in your browser and does not create an account or send email.

3. How we use information

We use information to authenticate users, manage workspace access, carry out authorized discovery and research, organize leads, prepare and submit authorized messages, track replies, operate customer-authorized advertising, provide results and support, and maintain security and reliability.

Connecting a provider does not start an outreach or advertising campaign. The work SonicMail may perform depends on the permissions you grant and the audience, content, objective, schedule and limits you authorize.

4. Connected Gmail and Outlook accounts

Mailbox access requires your affirmative consent through Google or Microsoft. We process the connected account identity, message headers and bounded message text, conversation references and synchronization state to provide mailbox conversations and reply tracking. Gmail draft and sending permissions support provider drafts, replies and eligible recipient-consented sending. Access remains subject to provider approval and the permissions actually granted.

OAuth credentials are encrypted on the server and are not returned to the browser. Personal connected-mailbox content has separate access controls: another workspace member, including an administrator, cannot open your private mailbox content through SonicMail. Shared lead and campaign records remain visible to members with the appropriate workspace access.

Authorized sending shares the intended recipient, message and selected attachments or links with your connected provider. A provider acceptance response does not establish delivery. Gmail commercial sending requires recorded recipient consent; unsolicited commercial sending through Gmail is blocked.

5. Business research and AI

Company discovery and research use public business sources, official websites, Overture Maps business records, configured contact and verification providers such as Icypeas, and Google Gemini through Google Cloud. We provide the configured provider with the inputs needed for the requested research, qualification or drafting task. Business contact information can still concern identifiable people.

Research distinguishes observed evidence, inferences and unknowns. Results may be incomplete, inaccurate or outdated. Synced Gmail data is excluded from prospect research and shared AI learning. We never sell synced email data or use synced Gmail or Outlook data for advertising or generalized AI model training.

6. Service providers and sharing

Google Cloud and Firebase provide hosting, authentication, database, storage and operational services. Google and Microsoft process authorized mailbox connections and submitted messages under their own terms. Configured discovery, research and verification providers receive only the business inputs needed for the requested task. Authorized workspace members can access workspace information according to their role.

We may disclose information when necessary to comply with law, investigate abuse or protect the security of the service and its users. SonicMail personnel do not routinely read synced mailbox content. Access to specific messages requires your documented permission, except when necessary for a security investigation or compliance with law. Provider-derived data remains subject to the applicable provider restrictions.

We do not sell synced email data or share it for advertising. Google user data transfers are limited to uses permitted by the Google Workspace user data policy. This policy does not authorize a provider or a workspace member to use connected-mailbox data for an unrelated purpose.

7. Retention and deletion

We retain synced email content, metadata and conversation history only as long as necessary for active mailbox synchronization, campaign management and reply tracking. Other workspace records are retained as needed to operate the workspace, carry out your instructions and maintain necessary service records.

Mailbox disconnection immediately stops synchronization, removes SonicMail’ stored OAuth credentials and notification routing, and queues deletion of associated synced email data from active systems within 30 days. Delete synced data also starts this cleanup. These controls do not delete original messages held by Google or Microsoft.

After a verified account-deletion request or confirmed workspace deletion, customer data is permanently deleted from active production systems within 30 days. Workspace deletion affects its members and shared records, preserves unrelated workspaces and does not delete original provider mail. The requesting owner’s sign-in identity is removed when no other workspace membership remains. Individual or multi-workspace account requests are handled through ibrahim@ojoai.us.

Backups are encrypted and access-controlled. Deleted customer email data is permanently removed through backup expiration within 60 days of the deletion request. Active-system cleanup and backup expiration are separate stages. Completing active cleanup does not mean every backup has already expired.

We retain only the minimum suppression information necessary to honor unsubscribes and prevent unwanted messages, without retaining email content. Minimum content-free deletion receipts and workspace deletion locks allow cleanup to be completed, audited and prevented from being undone. They do not retain deleted email messages, lead records, account contact details or OAuth credentials.

8. Your controls and rights

You can disconnect a mailbox, delete synced data, revoke provider access in your Google or Microsoft settings, pause automation and stop new message submissions. Open tracking is off by default. Messages already submitted cannot be recalled. Revoking a shared Google grant can affect other SonicMail connections that use that grant.

Workspace owners can request deletion of all workspace data in Settings. Contact ibrahim@ojoai.us for individual account requests, access, correction or deletion. Depending on the law that applies to you, you may also have rights to portability, restriction, objection, withdrawal of consent or a complaint to a supervisory authority. If a business supplied your information to its workspace, we may need to coordinate with that business to verify authority and carry out the request.

9. Security, location and essential storage

We use authentication, workspace and mailbox access controls, encrypted credentials, private storage and bounded operational records to protect information. Our primary production database and application backend are hosted in the United States. Connected providers may process information in other locations under their own terms. Contact us before providing information that requires additional contractual or international-transfer arrangements.

The dashboard uses essential session and local storage for authentication and interface state. These controls are necessary to operate the service. SonicMail does not use synced email data for advertising or cross-service profiling.

10. Business use

SonicMail is intended for business use and is not directed to children. Do not submit credentials, identity documents, health records or other unnecessarily sensitive information as lead data or research material. Contact us if you believe information was provided without appropriate authority.

11. Changes to this policy

The date above identifies this version. We will communicate material changes through the service or an appropriate account contact before they take effect where required. We will not repurpose previously collected connected-mailbox data in a way that conflicts with provider restrictions. Questions may be sent to ibrahim@ojoai.us.

12. Google user data and Limited Use

SonicMail’ use and transfer of information received from Google APIs adheres to the Google Workspace user data and developer policy, including its Limited Use requirements. Google-derived mailbox data is used only for the permitted user-facing features described in this policy.