GOOGLE ACCOUNT DATA
Privacy policy
GRB Core Assistant
Effective date: 13 October 2026
1. Scope and operator
This policy covers the private GRB Core Assistant operated by Roman Gorbach for his own authorized business correspondence, including Terminal13 OÜ. It describes the Gmail integration and delivery of assistant responses through Telegram. It is not a general privacy policy for every service on terminal13.eu.
Contact: terminal13ou@gmail.com.
2. Information accessed and permissions
After Google OAuth authorization, the application can access the connected account’s email address and basic sign-in identity, Gmail message and thread identifiers, sender and recipient details, subjects, dates, labels and message content needed for requested searches and analysis. Attachments may be accessed when needed for an explicitly requested task.
Read-only mode uses gmail.readonly and cannot send email. Optional read-and-send mode adds gmail.send after a new authorization by the account owner. This allows sending an email reply or other message using the connected account. It does not grant permission to modify or delete existing messages, change read status, or manage Gmail drafts.
3. Purposes and processing
Data is used to search correspondence, summarize messages, identify matters requiring attention, compare conversations with replies, and prepare proposed response text requested by the operator. The operator reviews the output before taking business action. With send permission enabled, sending is intended to occur only after the operator confirms the recipient and final message; OAuth consent alone is not approval to send a particular email.
Relevant email content and the operator’s request are processed on the operator-managed server and sent to OpenAI’s API to generate the requested output. Summaries and reply text are sent through Telegram to the authorized operator account. Approved outgoing message bodies, recipient addresses and explicitly selected attachments are submitted to Google for delivery and then to the selected email recipients. Gmail data is not used by this application for advertising, sold to data brokers, or used to train generalized AI models.
4. Service providers and disclosure
The integration uses Google for Gmail access and OAuth, Servarica for server hosting, OpenAI for AI processing, and Telegram for messaging. Processing may occur in the countries where these providers operate. Provider handling is subject to their applicable service terms, privacy policies and configured retention settings.
Only data needed for the requested feature is passed to the relevant service. Application access is limited to the authorized operator; this information website provides no public mailbox connection. Additional disclosures are limited to those needed for security or applicable legal obligations.
5. Storage and retention
OAuth credentials and refresh tokens are stored on the operator-managed server using gog’s encrypted file keyring. The keyring password is kept in a local file with restricted permissions. OpenClaw conversation history, summaries, working files and diagnostic logs may retain email content or related metadata.
No automatic expiry period has been configured for that local history. It remains until the operator deletes it or changes retention settings. Telegram chat history and OpenAI API processing records follow those providers’ retention rules. Revoking Google access stops future authorized retrieval but does not by itself erase previously stored history.
6. Security and user control
The current installation restricts Telegram direct-message access to the operator’s account and keeps the Gateway on the server’s loopback interface. Credentials must not be shared publicly.
The account owner can revoke the application under Google Account connections. To remove stored tokens, local assistant history or working files, contact the operator at terminal13ou@gmail.com. Copies held by service providers must also be managed under their respective account and deletion controls.
7. Google API Limited Use and changes
GRB Core Assistant’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
Changes to permissions, purposes or data sharing will be described here before introducing the changed use. Additional Google permissions require new authorization by the account owner. This installation is not offered as a public application for connecting other users’ mailboxes.