Privacy Policy

1. Introduction

Somra ("we," "our," or "us") is an AI-powered email management tool that helps you automatically label, route, and draft responses for your email inboxes. This Privacy Policy explains how we collect, use, store, and protect your information when you use our service at www.somra.app.

Somra's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2. Data Accessed

When you connect your Google account to Somra, we request access to the following specific types of Google user data:

Google Account Information

When you sign in with Google OAuth, we receive your name, email address, and profile picture. We do not receive or store your Google password.

Gmail Data

With your explicit authorization, Somra accesses the following Gmail data through the Gmail API:

• Email metadata: Sender, recipient, subject line, date, and existing labels
• Email body content: The text content of incoming emails, used for AI categorization and labeling
• Email labels: Reading and applying Gmail labels to organize your inbox
• Draft creation: Creating draft responses in your Gmail account when configured
• Sent emails: Reading the To and CC recipients of your last 200 sent emails to build your contact list (Contacts Awareness, which runs automatically when you connect an inbox), and reading your 20 most recent sent emails only when you opt in to Brand Voice, to learn your writing style
• Sending email: Sending replies or forwarding emails from your account, only through Agents you set up to do so. Somra's rules never send email.

Slack Data

If you optionally connect Slack, we access your workspace's channel list and user directory solely to route email notifications to your chosen destinations. We do not read your Slack messages.

User-Provided Content

This includes AI processing rules you write, context files you upload (such as PDFs or documents), and configuration preferences (timezone, AI model selection).

3. Data Usage

We use Google user data exclusively to provide and operate the Somra service as follows:

• Email Processing: Incoming email content is sent to your selected AI provider for real-time analysis against your custom rules. The AI categorizes and labels emails, and optionally creates draft responses.
• Slack Routing: When configured, email summaries and time-sensitive alerts are sent to your designated Slack channels or users.
• Brand Voice: When you opt in, your recent sent emails are analyzed once to extract writing patterns. The resulting voice profile, which can include short example phrases such as your usual greeting and sign-off, is stored as part of your configuration. The original sent emails are not stored.
• Contacts Awareness: The names and addresses of people you email are stored so the AI can recognize known contacts and avoid mislabeling their email as spam or cold outreach.
• Agents: If you set up an Agent, it can draft, send, or forward replies, apply labels, and post to Slack according to the instructions you give it.
• Activity Logging: We store a record of each action taken (for example the email's subject, the label applied, the AI's short reasoning, and any draft it wrote) so you can review your AI activity on the dashboard.

4. Data Sharing

We share Google user data only in the following limited circumstances, solely to provide the service you configured:

• AI Processing Providers: Email content is sent to the AI provider you selected in Settings (OpenAI, Anthropic, or DeepSeek) for real-time categorization and response drafting. This data is transmitted securely and is processed according to each provider's data usage policies. We do not send data to any AI provider you have not selected.
• Slack (User-Configured): If you configure Slack routing, email summaries and alerts are delivered to your designated channels. Alerts and summaries include the sender, the subject, and an AI-written summary of the email.
• Infrastructure Providers: Our hosting and database providers process data as part of operating the service but do not independently access or use your Google data.
• Service Providers: We use a product analytics provider to understand how the Somra website and dashboard are used (pages visited, clicks, and session replays, linked to your account email). Session replays can include what was on screen in your dashboard, such as email subjects. We also use a transactional email provider to send you account notifications and a payment processor if you buy credits. Neither of those receives your email content.

5. Data Storage & Protection

We take the security of your data seriously and implement the following measures:

• Email bodies are not stored: Email bodies are processed in memory and are not saved on our servers. We keep activity records (subject, actions taken, the AI's short reasoning, drafts it wrote, and short summaries made by Agents and inbox analysis) for 90 days.
• Protected credentials: AI provider API keys and Slack tokens are encrypted at rest with AES-256-GCM. Google OAuth tokens are kept in our access-controlled database and are never sent to your browser.
• Access controls: Our database enforces row-level security, ensuring users can only access their own data.
• No password storage: We use OAuth 2.0 exclusively — we never see or store your Google or Slack passwords.
• Encryption in transit: All connections between your browser, our servers, and third-party APIs use HTTPS/TLS encryption.
• Secure hosting: Our application and database are hosted on industry-standard platforms with enterprise-grade security certifications.

6. Data Retention & Deletion

What we retain

• Email bodies: Never stored. Processed in memory only.
• Activity records: Action logs, Agent actions, and per-email summaries are deleted automatically after 90 days.
• Configuration data: AI rules, Brand Voice profiles, contact lists, Slack routes, preferences, and context files are retained while your account is active.
• OAuth tokens: Retained while your account is connected. Deleted immediately when you disconnect.

How to delete your data

You have full control over your data:

• Pause processing: Toggle AI processing off for any inbox at any time from your dashboard.
• Disconnect accounts: Remove Gmail or Slack connections from the dashboard, which immediately deletes associated tokens.
• Revoke via Google: You can revoke Somra's access at any time from your Google Account security settings.
• Delete account: Request complete deletion of your account and all associated data by contacting us at the email below. All data will be permanently deleted within 30 days.
• Export data: You can request a copy of your stored data at any time.

7. Third-Party Services

We use the following third-party services to operate Somra. Each processes data only as necessary to provide the service:

• Google APIs — Sign-in, and Gmail access via OAuth 2.0 for reading, labeling, drafting, and (through Agents) sending email
• OpenAI, Anthropic, and DeepSeek APIs — AI-powered email analysis (user-selected)
• Slack API — Notification and summary routing (user-configured)
• Supabase and Vercel — Database, authentication, file storage, and hosting
• PostHog — Product analytics and session replay for the Somra website and dashboard
• Resend — Account and notification emails
• Lemon Squeezy — Payment processing for credit purchases

Each of these services has their own privacy policies. We encourage you to review them.

8. Children's Privacy

Somra is not intended for use by individuals under the age of 13. We do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes via email or an in-app notification. Continued use of Somra after changes constitutes acceptance of the updated policy.

10. Contact Us

If you have any questions about this Privacy Policy, your data, or wish to request data deletion or export, please contact us at:

Email: fernando.anselmi@gmail.com