Your mail lives on your machine.

Your email stays on your computer

OleaDesk is a desktop application. When you connect an inbox, your messages are downloaded to a database on your own machine and stay there. We do not host your mailbox, we do not sync your mail to our servers, and we have no copy of it.Uninstalling the app leaves that database on your machine, so reinstalling picks up where you left off. Delete the folder yourself if you want it gone, and it is gone.

Your mailbox password or app password is stored in the Windows Credential Manager, the same place your other applications keep theirs. It never travels to us.

What the AI features do send

When OleaDesk drafts a reply, summarises a thread or writes outreach, the specific text needed for that task is sent to our relay, which forwards it to the AI provider that produces the result. This is the only thing that takes your content off your machine. Your archive as a whole is never uploaded, and neither are your contacts.

Some of that work happens in the background, so it is ready before you ask for it. Two of those are on when you install:

• the assistant re-reads your recent sent mail a few times a day to keep learning how you write
• it drafts replies to the messages waiting for you, so one is ready when you open them
• it indexes your mail so that searching it by meaning is instant

The first two are switches in the assistant’s settings and turning them off stops them. The index follows the assistant: it runs while the assistant is connected and stops when it is not. We are telling you this rather than describing a product that only ever acts when it is clicked, because that would be the nicer sentence and not the true one.

What we record about that request:

• which account made it, and when
• how many tokens it used and what it cost us
• which feature it was: drafting, summarising, outreach, and so on

We do not store the content of the request or the response. The metering above is how we bill fairly and spot runaway costs; it is deliberately the minimum that achieves that, and it cannot reconstruct your email.

The processing itself is done by the AI providers named on our sub-processors page, under contract to us. Your text passes through our relay to the model handling that feature and comes straight back to you. We keep none of it, and it is not used to train anything.

Your account and paying us

To run an account we hold your name, email address, company name, your plan and whether it is active, and the usage records above. We also keep what you told the builder when you described your business, including anything you pasted or attached there, the phone number or WhatsApp you gave us if you gave one, and one word for the kind of computer you built your agent on, so we know whether the app can run on it. That is the whole of it.

Payments are handled by Stripe, and we never see your card. The payment page is Stripe’s own, so your card number does not touch oleadesk.com or our servers at any point, so there is nothing for us to lose. We keep the identifiers Stripe gives us for your customer and subscription, so we know what you are on.

If you connect a Google account

OleaDesk reaches your Gmail or Google Workspace mailbox over Google’s IMAP and SMTP interfaces, to do the things you can see it doing: syncing your mail, reading it, drafting replies, sending them, and learning how you write.

If you connect Google Calendar, OleaDesk reads your calendars and can create events and invitations for you. Your upcoming entries are shown in the app, and they are included when you ask the assistant about your day or your commitments so that it can answer with what is actually in your diary. Nothing else is done with them.

OleaDesk’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the features of OleaDesk that you see and use.
• We do not use Google user data for advertising of any kind.
• We do not sell Google user data.
• We do not transfer Google user data to anyone else, except as needed to run the features you are using (the AI processing described above), or to comply with the law, or in a merger or acquisition, in which case we would tell you first.
• No human reads your mail. The exceptions are the ordinary ones: if you send us something yourself in a support request, if security genuinely requires it, or if the law compels it.
• We do not use Google user data, or anything derived from it, to train or improve general artificial intelligence models. The writing-voice profile is built from your own sent mail, which goes through our relay to the model in the same way as everything else here. The profile that comes back is kept on your computer and used only for you. It is never pooled with anyone else’s, and nothing is trained on it.

Your Google sign-in token lives in the Windows Credential Manager. You can revoke OleaDesk’s access whenever you like at myaccount.google.com/permissions, and it takes effect immediately.

If you connect a Microsoft account

Everything above applies in the same way to a Microsoft 365 or Outlook.com mailbox: the access is used only to run the mail features you use, the token stays in the Windows Credential Manager, and you can revoke it in your Microsoft account settings.

What we refuse to collect

• No tracking pixels. OleaDesk does not put an invisible image in your outgoing mail, so we cannot tell you who “opened” a message, and we don’t report a number we can’t measure. Your recipients are not surveilled on your behalf.
• No personal scraping. Buyer research uses what a company publishes about itself: its own website, its own contact page. We do not build profiles of individuals and we do not take data from social networks.
• No selling of anything. We do not sell, rent or share your data. We do buy advertising: if you agree on this website’s cookie banner, Google Analytics and Google Ads conversion measurement run on the website only; nothing of the kind exists inside the app. See Cookies.

People your agents find

When an agent researches a market, it records business contact details for companies that may be buyers, and for the people at those companies who handle buying: the kind of details a business publishes or shares so that trade enquiries reach the right person.

We check company information against public company registers, we look up business contact details, and we check that an address is deliverable, so your agent does not write to a mailbox that no longer exists. These checks and lookups are the only reason any of it leaves our systems, and no message is sent as part of them.

If you are a business who has been contacted through OleaDesk and want your details removed, write to hello@oleadesk.com and we will remove them and add you to a suppression list so you are not contacted again.

Diagnostics

If something goes wrong, you can save a diagnostic report from inside the app. It is written to your Desktop and nothing is sent automatically. You read it and decide whether to share it. Every email address in it is replaced with a placeholder before the file is written, so sending us a report never hands us your contacts’ addresses.

There is also a send button, for when you would rather not handle the file yourself. It transmits the same redacted report, the app version, your operating system, and the note and address you type. Nothing else, and only when you press it.

One thing the app does send on its own, and this is all of it. When you open OleaDesk it asks your account for the key its AI features use, and that request is how we know the app has been opened, and it is what starts the buyer research your plan includes. It carries your account and nothing else: no mail, no addresses, no subjects, no record of anything you did.

And when something goes wrong, the app tells us. It sends what broke and how often: the failure message with the details stripped out of it, so a fault can be fixed without you having to write in. It carries no message text, no subjects and no addresses: every address is replaced before the report is even assembled, the same way it is for a support report. It never includes what you were doing, reading or writing at the time. You can switch it off in Settings, under Fault reports, and the app will then send nothing at all.

Beyond those two things there is no analytics inside the app. Nothing counts what you click, nothing watches which features you use, and nothing builds a picture of how you work.

How it is protected

Nothing travels in the open. Your mail moves over an encrypted connection every time, on port 993 for reading and 465 for sending, or 587 with encryption negotiated before anything is transmitted. Everything between the app and our servers goes over HTTPS. There is no path in the product that sends your mail, or anything about your account, unencrypted.

Your passwords are not in our database, and they are not in a file. Mail passwords, app passwords and sign-in tokens are handed to the Windows Credential Manager, the same place Windows keeps its own. They are never written to the mail archive, never sent to us, and never visible to the part of the app that draws the screen.

On our servers, your account and usage records sit in a database that encrypts what it stores, and every table carries rules that tie a row to the account that owns it, so one customer’s data cannot be read by another even if a request asks for it. Administrative access is limited to named people at OleaDesk, and there are no shared logins.

Keeping it, and deleting it

On your machine, it is yours. Your mail archive, your credentials and everything the assistant has learned about your voice sit in your own user folder. We cannot reach them and we cannot delete them.

On our side, we keep your account and billing records while your account is open. When your plan ends, your account, your agents and their buyer records wait for you for 90 days in case you come back; after that we delete them, keeping only what tax and accounting law requires. To have your account and everything we hold erased, write to hello@oleadesk.com from the address on the account. We will confirm within 30 days.

One record survives that erasure, and only one. When you accepted these terms we recorded your email address, the date, and which version of the terms and this policy you agreed to. We keep that after an account is closed, because it is the only proof of what was agreed, and it is the record we would need if there were ever a disagreement about it. It holds nothing else: no messages, no contacts, no content of any kind.

Who else touches it

A small number of suppliers process things on our behalf, each under contract and only for the purpose given: hosting, our database and sign-in, payments, AI processing, and sending you account email. They are not permitted to use your data for anything of their own.

If you need the current list by name, for your own compliance records perhaps, it is published in full on our sub-processors page. Write to hello@oleadesk.com if you need anything it does not cover.

Your rights

If you are in the UK or the EU, the UK GDPR and GDPR give you the right to see the data we hold about you, correct it, have it deleted, restrict or object to what we do with it, and receive a copy in a portable form. Because your mail never reaches us, in practice that is your account details and the usage records described above.

If you are in California, the CCPA gives you equivalent rights. We do not sell or share personal information as that law defines it, and we do not sell it under any definition.

Write to hello@oleadesk.com and we will respond within 30 days. You also have the right to complain to your local data protection authority.

Changes

If we change what the product does with your data, we change this page and date it. We will not quietly widen what we collect.