Privacy & data custody

What Dustav reads, what it keeps, who processes it — and how to take it all back.

This page is the plain-words version of how your data is handled; the formal privacy policy is the binding one, and the two are kept in lockstep — with the deployed product as the source of truth for both.

What Dustav reads, it keeps — and we say so

To work your inbox over time, Dustav stores the email it reads: message text, thread history, attachments and the text extracted from them, and the replies it drafts. Stored encrypted at rest, and stored for a reason — a reply that remembers the last exchange, a payment reconciled against its order, a filed receipt findable in March. We'd rather tell you this plainly than sell you a comforting "read in the moment, nothing retained" story that couldn't run this product.

Alongside it lives what Dustav builds: your contacts, workflow tables, facts, documents and files, calendar copies, and your chats with it. Almost all of it is visible in the app — that's the point.

What we never do with it

We don't sell your data, show you ads, or train AI models on it — and neither does our AI provider. Anthropic (the makers of Claude) runs the model on our behalf under commercial no-training terms; requests carry an opaque account identifier, never your name or email. Payment cards are Stripe's business, not ours — we never see the number.

Humans at Dustav access your account only for the onboarding and support you've consented to by working with us, to keep the service secure, or when the law requires it. That's disclosed, not smuggled. Our use of Google user data adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Disconnect is not delete — on purpose

Disconnecting Google revokes Dustav's access and drops the stored credential; all reading stops. What it already read stays with your account, so a reconnect resumes instead of starting from zero. Deleting your account is the real purge: everything Dustav read and built, gone. Two different acts for two different intents — a pause and an exit — and we keep them separate so a cautious click never destroys months of work, and a real goodbye actually is one. You can also just email us and we'll delete.

Your side of it

See it — inbox, tables, files, facts, traces, costs: in the app, any time.
Change it — tell Dustav what's wrong and watch the record change.
Take it — your mail never left Gmail; tables export as CSV; documents as PDF.
End it — disconnect any time; delete for real when you mean it.