Privacy

Who we are

Agentic Box is operated by The Apps Company Pty Ltd. It helps businesses organise email, prepare replies and use their business information. For privacy questions, access requests or deletion requests, contact munsif@theappscompany.ai.

Information we use

We process account and business details, team permissions, connected mailbox identities, email messages and attachments, labels, drafts, signatures, email context, calendar information, documents you upload, chat conversations and records of actions taken in the service. What we access depends on the features you use and the permissions your business grants.

Connected Google accounts

You can connect Google Calendar separately using a personal Google account or a Google Workspace account. We use your verified Google identity, calendar list and event details to display the calendars you select. Availability checks support scheduling, and event access lets you create, edit or cancel meetings when you enable editing. Calendar connections belong to the business member who connects them. AI availability access and editing start off for additional accounts and can be controlled separately. A Calendar-only connection does not grant access to Gmail messages or Google Drive files.

When Google Workspace is available and you connect it, we use your Google identity to identify the account and business. Gmail access lets Agentic Box read and organise authorised mail, manage labels and read status, move messages between Spam and Inbox, and send replies when an authorised person selects Send. Calendar access supports availability checks and the calendar actions you request. The connection does not grant access to Google Drive documents.

An administrator can separately authorise access for selected business mailboxes using Google Workspace domain-wide delegation. Agentic Box only watches mailboxes selected within the business. Google permissions are displayed during connection and in your integration settings.

Agentic Box's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data or use it for advertising. We do not use Google user data, including summaries, aggregated data and other information derived from it, to create, train or improve foundational or general-purpose AI models. The same restriction applies to transfers to AI service providers under the Google Workspace API User Data and Developer Policy.

AI assistance and service providers

Amazon Bedrock is our managed AI service for email drafting and the default for Chat and Agent Space. It runs Anthropic Claude models; Amazon Titan embeddings support search and document retrieval. Automatic email drafting uses the conversation and My Email Context, with account, signature, permission and calendar information as operational inputs. Chat uses the source selected by the user. Generated text is a draft; an authorised person reviews and sends email.

A business administrator can optionally enable OpenAI or the direct Anthropic API using a business API key. When you select an enabled provider, relevant conversation content, uploaded source text and authorised tool results are sent to that provider. OpenAI Agent Space tasks use hosted agent sessions. These are API integrations, not consumer ChatGPT or Claude subscriptions.

Voice and live web search use the xAI API. While voice is active, your browser sends audio directly to xAI. Answers returned by the assistant are also sent to xAI so it can speak them; those answers may contain information derived from your authorised business data. Live search sends a search query to xAI and uses its web and X search tools. Search queries can reflect the information you ask about.

Calendar availability and meeting details have separate controls. Meeting details are included in Chat and Pulse only for calendars you enable for that purpose while AI calendar access is on. Enabling an AI feature does not authorise model training. Administrators must not enable provider data-sharing or training programmes for accounts or projects that process Google user data through Agentic Box.

Provider processing and retention are different from model training. API providers may retain data for security, abuse prevention or service operation under their applicable terms. We do not promise zero data retention across these services. For their data-handling terms, see Amazon Bedrock, OpenAI, Anthropic and xAI.

We use service providers for hosting, storage, authentication, AI processing and platform email delivery. Business access is controlled through team permissions. Support access is controlled and audited. We may disclose information where required by law.

Storage and protection

Agentic Box's application infrastructure is hosted in Australia. Google operates its own services globally; connecting Google does not provide an Australia-only processing guarantee for Google's systems. Our managed Bedrock inference route processes in Australia. Optional direct OpenAI and Anthropic processing, and xAI voice and search, use global services and are not covered by an Australia-only processing guarantee. We use HTTPS in transit, a private application database, access controls, audit records and encrypted credential storage.

Your choices and deletion

You can disconnect an integration in Agentic Box and revoke Google account access through your Google account. Workspace administrators can also revoke domain-wide delegation. Disconnecting stops future access; it does not automatically erase email history already stored in Agentic Box.

Your business administrator can request an export or deletion of business data. Deletion follows the service's deletion process and applicable retention obligations. Limited billing and audit records may remain to meet those obligations and record that deletion occurred. Contact us to discuss a specific account or retention requirement.

Changes to this notice

We update this page when our data practices change. The date above identifies the current notice. Contact us if you need clarification before connecting a business account.