Privacy policy
Draft dated 15 October 2026.
Who we are
Filtyr is a shared inbox for logistics teams. Filtyr is a product of Valoroo (legal entity: [LEGAL COMPANY NAME]), [POSTAL ADDRESS]. In this policy, "we" and "us" mean Valoroo.
A business that buys Filtyr is the "customer". Each customer has its own Workspace. The people the customer adds to its Workspace are "Members". Members can be the customer's own staff or staff of a team the customer has outsourced work to.
Summary
- Filtyr connects to a mailbox the customer chooses, in Gmail or Microsoft 365. It reads that mailbox's mail so Members can work it together, and sends the replies Members write.
- Members of the customer's Workspace see the mail. We do not sell data. We do not use it for advertising.
- When a Member asks @Val, the question and load details from the customer's TMS go to Google's Gemini model on Vertex AI. They are not used to train AI models. @Val never sends email. A person decides what is sent.
- Data is stored in Google Cloud, in the
us-central1region. It is encrypted at rest and in transit. - The customer can ask us to disconnect a mailbox and can ask us to delete its data.
What Filtyr accesses: Google (Gmail)
Filtyr staff connect a Gmail mailbox together with the customer's administrator. Filtyr does not offer self-serve connection. The customer's mailbox owner or administrator gives consent on Google's own consent screen. Filtyr asks Google for these scopes and no others:
| Scope | What Filtyr accesses | What Filtyr uses it for |
|---|---|---|
https://www.googleapis.com/auth/gmail.modify |
Messages, threads and headers of the connected mailbox. The scope also permits access to attachments. | Show the mail to the Members of the customer's Workspace. Send the replies Members write, through the customer's own Gmail. This scope cannot permanently delete mail, and Filtyr does not try to. |
openid |
The Google account identifier. | Confirm which Google account granted access. |
https://www.googleapis.com/auth/userinfo.email |
The Google account's email address. | Before Filtyr stores the access token, it checks that the token belongs to the mailbox the customer named. If the addresses do not match, Filtyr does not store the token. |
What Filtyr accesses: Microsoft 365
For Microsoft 365, the customer creates a service account in its own Microsoft 365 tenant and gives that account access to a shared mailbox. Filtyr staff connect the account together with the customer. The customer's service account signs in and grants consent on Microsoft's own consent screen. Where the tenant's policy requires it, the customer's Microsoft 365 administrator also approves. Filtyr uses delegated permissions on that service account. It asks Microsoft for these permissions and no others:
| Permission | What Filtyr accesses | What Filtyr uses it for |
|---|---|---|
Mail.ReadWrite.Shared |
Mail in the shared mailbox the service account was given access to. | Show the mail to the Members of the customer's Workspace. Create a draft of each reply in the shared mailbox before sending it. |
Mail.Send.Shared |
Sending as that shared mailbox. | Send the replies Members write. They land in the shared mailbox's Sent Items. |
User.Read |
The service account's own profile. | Confirm the account is the one the customer named, and that the shared mailbox is not the account's own mailbox. |
offline_access |
A refresh token. | Keep syncing mail without a person signing in again. |
Microsoft adds openid, profile and email to every grant of this kind. Filtyr does not ask for them and reads nothing extra from them.
Sign-in data
Members sign in to Filtyr with Google sign-in. Filtyr receives the Member's email address, Google account ID and Google Workspace domain. It uses them to identify the Member, to show who wrote a comment, and to deliver @mentions. Display names are set by the Workspace's administrator. Filtyr does not receive the Member's Google password.
A Member can ask for their own sign-in data to be deleted by writing to [CONTACT EMAIL].
Usage data
- Filtyr records when a Member was last active. It uses this to hand work to someone who is online.
- Filtyr counts each Member's activity. Workspace administrators see these counts in Filtyr's analytics.
How we use data
We use the data described above only to run Filtyr for the customer:
- to show the connected mailbox's mail to the Members of the customer's Workspace;
- to send the replies Members write, from the customer's own mailbox;
- to store Members' comments and @mentions on each conversation;
- to answer questions Members ask @Val;
- to keep the service secure and working, and to fix problems the customer reports.
We do not use the data for advertising. We do not sell it.
AI features
@Val is an assistant inside Filtyr. A Member asks @Val a question about a conversation, for example where a load is. @Val looks the load up in the customer's TMS and suggests a reply.
- When a Member asks @Val about a load, Filtyr sends the load reference to the customer's own TMS to look it up.
- To answer, Filtyr sends the question text and the TMS lookup results to Google's Gemini model on Vertex AI, part of Google Cloud. The question may quote text from the email.
- @Val's answer is a private draft that only the Member who asked can see. It becomes a comment visible to the Workspace only when a person publishes it.
- @Val never sends email. A person always decides whether to send anything.
- Filtyr does not use Google user data, or mail from Microsoft 365, to create, train or improve any machine learning or artificial intelligence model.
Where data is stored
- Mail, comments and Workspace data are stored in a Google Cloud SQL database in the
us-central1region (Iowa, United States). The database has no public internet address. - OAuth tokens for connected mailboxes are stored in Google Secret Manager, not in the database.
- Google Cloud encrypts all of this data at rest. Data travels between your browser, Filtyr, Google and Microsoft over encrypted connections (TLS).
Who can see data
- Members of the customer's Workspace. They see the mail in the mailboxes connected to that Workspace, and the comments on it. Members of one customer's Workspace cannot see another customer's data.
- Google Cloud. Google hosts Filtyr and provides the Gemini model behind @Val. Google processes the data on our behalf.
- The customer's mail provider. Google or Microsoft already holds the customer's mail. Filtyr reads it from them and sends replies through them.
We do not sell data. We do not share it with advertisers or data brokers.
The people the customer adds as Members read and act on mail at the customer's direction. That is the service. Members can include staff of an outsourced team working for the customer, including our own staff. Our support staff may also administer a Workspace at the customer's request.
Apart from that, no person at Valoroo reads a customer's mail except:
- with the customer's consent, for a specific item;
- when needed for security, for example to investigate abuse; or
- where the law requires it.
Retention and deletion
A customer can ask us to disconnect a connected mailbox. A Filtyr operator does the disconnection. After it, Filtyr no longer reads or sends mail for that mailbox.
Disconnecting a Gmail mailbox
Filtyr asks Google to revoke its token and destroys its stored copy of the token.
Disconnecting a Microsoft 365 mailbox
Microsoft does not offer a way for an app like Filtyr to revoke its own refresh token. So Filtyr destroys its stored copy of the refresh token, and tells the customer to:
- remove the Filtyr enterprise application from its Microsoft 365 tenant;
- remove the service account's permissions on the shared mailbox; and
- disable the service account.
A Microsoft refresh token that is not used expires after 90 days.
Mail already synced
After disconnection, mail Filtyr has already synced stays in that Workspace as a read-only archive. It stays there until the customer asks us to delete it.
We delete a customer's data within 30 days of a written request from the customer, or within 30 days of the end of the customer's contract.
Revoking access yourself
- Google: the mailbox owner can remove Filtyr's access at myaccount.google.com/permissions. A Google Workspace administrator can also remove it in the Admin console.
- Microsoft 365: an administrator can remove the Filtyr enterprise application from the tenant in the Microsoft Entra admin center.
Revoking access stops new mail from syncing. It does not delete mail already synced. To delete that, write to us at [CONTACT EMAIL].
Limited Use
Filtyr's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.
You can read the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy on Google's site.
Filtyr does not use Google user data, or mail from Microsoft 365, to create, train or improve any machine learning or artificial intelligence model.
Security
- Data is encrypted at rest by Google Cloud and in transit with TLS.
- OAuth tokens are kept in Google Secret Manager, separate from the mail.
- The database has no public internet address.
- Each customer's data is kept separate from every other customer's.
- Before Filtyr stores a mailbox token, it checks that the token belongs to the mailbox the customer named.
Changes to this policy
We will update this policy before Filtyr accesses new data or shares data with a new third party. When we change it, we will update the date at the top of this page.
Contact
Questions about this policy, or requests to access or delete data, go to [CONTACT EMAIL].
Valoroo (legal entity: [LEGAL COMPANY NAME])
[POSTAL ADDRESS]
This policy is governed by the law of [GOVERNING LAW].