Privacy policy

1. Scope and data controller

This policy explains how the devonnops service (devonnops.com) collects, uses, stores and deletes personal data.

For the account and usage data of platform users, the data controller is Onur Uçar. For personal data in the mailboxes a customer company connects and the documents it uploads, the data controller is that customer company; devonnops processes this data on the customer’s instructions as a data processor.

For questions and requests: iletisim@devonnops.com

2. Data we collect

• Account data: name, email address, a one-way hash of the password, two-factor authentication details, language and theme preference.
• Security and usage records: sign-in events, IP address, browser details and an audit log of actions taken.
• Email and attachments in the Gmail mailboxes a customer company connects (section 3 below).
• Content the team creates in the platform: jobs, notes, reply drafts, uploaded knowledge documents and automation definitions.
• If Slack is connected: the name and ID of the selected channels and the notifications the platform posts there.

3. Google user data

When a company administrator connects a Gmail mailbox, devonnops asks for two permissions: reading email (gmail.readonly) and sending email (gmail.send).

With the read permission, email in the connected mailbox (including recent history on first connection) is brought into the platform and shown only to that company’s authorised users, turned into work and made searchable. The send permission is used only when a user writes or edits a reply in the platform and sends it; AI and automations never send email on their own. devonnops does not change labels in Gmail and does not delete or move email.

devonnops’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy

We do not sell Google user data, use it for advertising, or use it to develop, improve or train generalised AI or machine learning models. No one on our team reads this data; the only exceptions are support access that the customer company grants explicitly and for a limited time (recorded in the audit log), investigating security issues and abuse, and legal obligations.

You can withdraw access at any time by disconnecting in the platform or on your Google account permissions page: https://myaccount.google.com/permissions

4. How we use data

• Providing the service: showing email, managing jobs and notifications, sending the replies the team approves.
• Protecting accounts and data: authentication, rate limits, audit logs and error tracking.
• Required service email: invitations, email verification and password resets.
• We do not use data for marketing or advertising and we do not sell it.

5. AI processing

AI features run only if the customer company’s administrator turns them on; while they are off, no data is sent to any AI provider. While they are on, the text of the relevant email and the context needed (such as knowledge entries the company has approved) are sent to OpenAI for classification, reply drafts and search, and to Anthropic as a fallback when OpenAI cannot be reached.

These providers do not use data sent through their APIs to train their models. We turn off response storage at OpenAI; providers may keep data for a limited period under their own policies to monitor abuse. AI output is only a suggestion; every reply is sent by a person.

6. Service providers and where data is kept

• Hetzner Online (Germany): servers, database, files and backups.
• OpenAI and Anthropic (United States): only when AI is on, for the processing described in section 5.
• Resend (EU, Ireland): sending system email such as invitations and password resets.
• Google and Slack: only when the customer company connects them, for the connection itself.
• Transfers abroad rely on our contracts with these providers and the safeguards required by applicable law.

7. Security

• All traffic is encrypted with HTTPS.
• Gmail and Slack access tokens are stored encrypted in the database.
• Each company’s data is kept separate from other companies; users see only what their role allows.
• Two-factor authentication is supported and required for platform administrators. Platform administrators do not see customer content, only technical information.
• Security-relevant actions are written to an append-only audit log.

8. Retention and deletion

• Data is kept to provide the service for as long as the customer company’s account is open.
• When a Gmail connection is removed, its access tokens are deleted at once and the permission is revoked at Google; email brought in earlier stays in the platform until the company’s data is deleted.
• When the contract ends, or on the customer company’s written request, the company’s data is deleted within 30 days. Backups rotate every 30 days; deleted data leaves the backups no later than 30 days after that.
• Security records are kept for as long as needed to keep the service secure and meet legal obligations.

9. Your rights

Under Article 11 of the Turkish Personal Data Protection Law (KVKK) and, where it applies, the GDPR, you have the right to access your data, ask for it to be corrected or deleted, object to processing and be informed. Send requests to iletisim@devonnops.com; we reply within 30 days. If your data is in a customer company’s email, you may need to send your request to that company; we help the company answer it.

10. Cookies

We use only the cookies and browser storage the service needs to work: session, language, theme, menu layout and the last workspace opened. We do not use advertising or tracking cookies.

11. Changes

When we update this policy we change the date on this page and tell customer companies about significant changes separately.