webfaCe In short. webfaCe Inbox reads the one email you have open in Gmail so it can show who sent it from your business's webfaCe records. It creates a draft only when you tap a button, and it never sends email. We don't sell Google user data, don't use it for advertising, and don't use it to train models.
1. Who we are
webfaCe Inbox is a Google Workspace add-on for Gmail made by 1001613716 Ontario Inc., operating as webfaCeMEdia ("webfaCeMEdia", "we", "us"), 57 Finch Ave West, Toronto, Ontario M2N 0K9, Canada. Questions about privacy go to privacy@webfacemedia.com.
2. What this policy covers
This policy covers the webfaCe Inbox add-on in Gmail on the web and in the Gmail apps for iPhone and Android, and these web pages. It explains what Google user data the add-on accesses, why, and what happens to it.
webfaCe Inbox is used by businesses that are webfaCeMEdia clients. The customer and CRM records it shows belong to that business and are held in the webfaCe systems the business uses (for example its CRM and webfaCe Bookings). Those records are covered by the business's agreement with webfaCeMEdia; this policy covers what the add-on itself does.
3. Google user data we access
When you install webfaCe Inbox, Google asks you to allow the permissions below. Each one is used only as described.
| Permission | What we do with it |
|---|---|
Run as a Gmail add-ongmail.addons.execute | Lets the webfaCe Inbox panel appear beside an email in Gmail. |
See the headers of the email you have opengmail.addons.current.message.metadata | Reads the sender's name and address, the subject, the date and the reply headers of the open email. The sender's address is used to find them in your business's webfaCe records. |
Read the email you have opengmail.addons.current.message.readonly | Reads the text of the open email, only when you tap Write a reply, so we can write a draft answer to it. |
Create drafts from the open emailgmail.addons.current.action.compose | Creates a reply draft in the same thread, only when you tap Write a reply or Send booking link. The draft stays in your Gmail for you to edit, send or delete. |
See your email addressuserinfo.email | Confirms which Google account is using the add-on, so we show it only to people enabled for a webfaCe business. |
Associate you with your Google accountopenid | Lets Google confirm to us that each request comes from you. |
webfaCe Inbox cannot list, search or open other emails in your mailbox, cannot read your contacts or calendar through Google, and cannot send email. The "current message" permissions work only for the email you have open, only while the add-on is in use.
4. How we use Google user data
We use Google user data only to provide the features you see in the webfaCe Inbox panel:
- Showing who the sender is. The sender's email address and domain are looked up in your business's webfaCe records to show their CRM record, bookings, client website status and website chat history.
- Adding or logging a contact. When you tap Add to CRM, the name, email address and any details you enter are saved to your business's CRM. When you tap Log this email, the email's subject and date are added to that contact's notes, along with the last-contact date and any next step you choose.
- Writing a reply. When you tap Write a reply, the sender's name and address, subject, date and the text of the latest message (up to about 6,000 characters), together with the CRM notes we hold for them, are used to write a draft reply. See section 6 for the service that processes this text.
- Sending a booking link. When you tap Send booking link, the sender's name and the reply headers are used to create a short reply draft containing your booking page link.
- Running the service securely. We log whether requests succeed or fail, how long they take, and error messages, so we can fix problems and block misuse.
We do not use Google user data for advertising, to build marketing or interest profiles, to determine credit-worthiness or for lending, or for any purpose unrelated to the features above. We do not sell it.
5. What we store and for how long
| Data | Where | How long |
|---|---|---|
| The emails in your mailbox | Not stored by us. They stay in your Gmail. | — |
| Sender address and headers used for a lookup | Used for the request, not saved by the add-on. | For the request only |
| Reply job: the message text, sender, subject, date and CRM notes used to write a reply, and the reply we wrote | Our webfaCe Inbox service (Cloudflare) | Up to 7 days, so you can reopen the draft; then deleted |
| Drafts we create | Your Gmail | Until you send or delete them |
| Contacts you add and emails you log | Your business's webfaCe CRM | As set by your business's agreement with webfaCeMEdia |
| Operational logs (timings, success or failure, error messages, and your Google account email when access is refused). No email text. | Cloudflare | Up to 7 days |
We do not store Google passwords or long-lived Google tokens. Each time you use the add-on, Google gives it a short-lived token that only works for the email you have open.
6. Who we share it with
We do not sell, rent or trade Google user data, and we do not share it with advertising networks, data brokers or analytics companies. Google user data is shared only with the service providers that run webfaCe Inbox for us, only as needed to provide its features, and under contracts that restrict their use of it:
- Cloudflare, Inc. hosts the webfaCe Inbox service, including short-lived reply jobs and operational logs.
- Anthropic, PBC processes the text described in section 4 when you tap Write a reply, to write the draft. Under Anthropic's commercial terms it may not use this content to train its models.
- The webfaCe systems your business uses (such as its CRM and webfaCe Bookings), which webfaCeMEdia operates, receive the sender's email address to look them up, and the contact details and email subjects you choose to save.
We may also disclose data if the law requires it, to protect the safety or security of our users or services, or as part of a merger or acquisition, in which case this policy continues to apply to the data.
7. Limited Use disclosure
webfaCe Inbox's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.
In particular:
- We use Google user data only to provide and improve the user-facing features described in this policy, which are visible in the webfaCe Inbox panel.
- We transfer Google user data to others only as needed to provide or improve those features, to comply with applicable law, for security purposes, or as part of a merger, acquisition or sale of assets with notice to you.
- We do not use or transfer Google user data to serve advertisements, including retargeting, personalized or interest-based advertising.
- We do not allow humans to read Google user data, unless we have your affirmative agreement for specific messages (for example, when you ask support to look at a problem), it is needed for security purposes such as investigating abuse, it is needed to comply with applicable law, or the data is aggregated and anonymized for internal operations.
- We do not use Google Workspace API user data to develop, improve or train generalized AI or machine-learning models, and we do not allow our service providers to do so.
8. How we protect it
- All traffic between Gmail, our service, Google's APIs and our providers is encrypted in transit with TLS.
- Every request to our service is checked for a valid, signed token from Google before anything is read, and the add-on works only for Google accounts enabled for a webfaCe business.
- Service credentials are held as encrypted secrets in our hosting provider, never in code.
- Access to our systems is limited to the webfaCeMEdia staff who run them.
No system is perfectly secure. If a breach affects your personal information, we will notify you and the authorities as the law requires.
9. Removing access and deleting data
- Uninstall the add-on from Gmail on the web: open the settings gear, choose Manage add-ons, select webfaCe Inbox and choose Uninstall. Step-by-step instructions are on the support page.
- Remove its access to your Google account at any time at myaccount.google.com/connections. Once removed, the add-on can no longer read any email or create drafts.
- Delete data. Reply jobs are deleted automatically within 7 days. To have them deleted sooner, or to ask about contact records your business holds in its webfaCe CRM, email privacy@webfacemedia.com. We act on deletion requests within 30 days.
- Drafts created in your Gmail are yours; delete them in Gmail like any other draft.
10. Your rights
We handle personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). You can ask to see the personal information we hold about you, have it corrected, or withdraw your consent, by writing to privacy@webfacemedia.com. If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada. If you are in another country, you may have similar rights under local law, and we will honour them.
If your email is shown in the panel because you wrote to a business that uses webfaCe Inbox, that business decides what it holds about you in its records. Contact the business, or us, and we will help.
11. Where data is processed
webfaCeMEdia is based in Canada. Cloudflare and Anthropic may process data in the United States and other countries where they operate. When data is processed outside Canada it may be subject to the laws of that country. We choose providers that protect data to a standard comparable to this policy.
12. Children
webfaCe Inbox is a business tool and is not intended for anyone under 18. We do not knowingly collect personal information from children.
13. Changes to this policy
If we change this policy, we will post the new version here and update the date at the top. If a change affects how Google user data is used, we will tell affected users before it takes effect and ask for consent where required.
14. Contact
1001613716 Ontario Inc. o/a webfaCeMEdia
57 Finch Ave West, Toronto, ON M2N 0K9, Canada
Privacy: privacy@webfacemedia.com
Support: support@webfacemedia.com · 647.286.5045