Privacy Policy

Effective August 20, 2026

What Attaché is

Attaché (attache.com.ai) is an AI-native email client operated as a hosted service. When you connect a mailbox, we process your email on your behalf to provide the product's features: triage, search, drafting, commitment tracking, and the activity log. This policy explains exactly what we do with that data.

Our five promises

1.We never train shared AI models on your email. What Attaché learns from your mail - your voice, rules, and priorities - stays in your account and is deleted with it.

2.No ads, no data sale, no anonymized insights products. Subscriptions are the entire business model; you are the customer.

3.The AI cannot send, forward, or delete anything without your explicit action or a standing rule you individually enabled - and everything it does is recorded in your activity log.

4.Disconnect an account and its data is deleted immediately; delete your account and everything goes with it.

5.Every third party that can touch your data is named below, with the retention terms we hold them to.

Data we process

Email messages and attachments from mailboxes you connect, calendar events from the calendars attached to those accounts, the contact information contained in your mail, your account profile (name, email, preferences), and the settings you configure. We process this data solely to operate the features you use. We do not collect data from any other source and we do not enrich your contacts with third-party data.

Google user data

If you connect a Gmail or Google Workspace account, Attaché accesses Gmail data (reading, modifying labels, and sending on your behalf) strictly to provide user-facing features you request: displaying and organizing your mail, triaging it, searching it, and sending messages you explicitly approve. Attaché also accesses your Google Calendar events (reading them, and creating or editing events) solely to display your schedule inside the product, prepare meeting dossiers, and create or update the meetings you ask for — calendar events are never created, changed, or deleted without your action. Attaché's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we do not transfer Google user data to third parties except as necessary to provide these features (see subprocessors below), we do not use it for advertising, we do not use it to train generalized AI or machine-learning models, and no human reads it except with your explicit consent for support, for security purposes, or where required by law. These commitments cover Gmail and Calendar data alike.

Microsoft user data

If you connect a Microsoft 365 or Outlook.com account, the same commitments apply to mail and calendar data accessed through Microsoft Graph: feature delivery only, no advertising, no training of shared models, no human access without your consent.

AI processing and subprocessors

Some features send excerpts of relevant messages to a large-language-model provider, solely to generate the output you asked for (a draft, a summary, an answer with citations). These requests are inference-only: providers are barred from retaining your content or using it for training. The AI subprocessor currently in service is Fireworks AI, Inc. (model inference; zero retention — content is processed to produce the response and not stored). The service operator may substitute another inference provider under the same no-retention, no-training terms — including models run on our own servers, which involve no third party at all — and this page is updated when that list changes. Infrastructure: the service runs on dedicated servers we operate ourselves; your email and calendar data live in our database on those servers and are never sold, shared, or mined. No other third party receives your data.

Retention and deletion

Your data is retained only while your account is active. Disconnecting a mailbox deletes its messages, calendar events, drafts, rules, and derived data (summaries, search indexes) immediately. Deleting your account removes everything. Backups age out on a fixed schedule.

Security

All traffic is encrypted in transit (TLS). Access to production systems is restricted and credentialed; API secrets you store (such as OAuth credentials) are write-only in the interface and never displayed back. Automatic emails Attaché sends contain no tracking pixels - and Attaché never adds tracking to your outgoing mail.

Your rights

You can export, correct, or delete your data at any time from the product, and you may contact us for anything the interface does not cover. If you are in a jurisdiction with statutory data rights (such as the GDPR), we honor access, portability, rectification, and erasure requests.

Contact

Questions about this policy: [email protected]. We will announce material changes on this page with a new effective date.