Last updated: April 20, 2026
These principles govern every decision we make about your data. They are not aspirational — they are operational. Our systems are built to enforce them.
This is our foundational commitment. We hold and process your data with the same care and discretion we would expect for ourselves. If we wouldn't be comfortable with how a piece of information is handled, we don't handle it that way.
The minimum knowledge principle. AgentEnvoy accesses only the data necessary to facilitate the specific coordination at hand — nothing more. We don't build profiles, mine patterns across coordinations, or retain information beyond its purpose.
AgentEnvoy is a neutral coordinator. Information shared by one party is used solely to find mutual ground — never to give the other party a negotiating edge. Each party sees only the gist of what was shared, not the other's explicit details.
When you sign in with Google, we receive your name, email address, and profile picture (openid, email, profile). We also store a Google-issued refresh token so we can maintain your connection without asking you to sign in again.
When you grant calendar access, AgentEnvoy requests two Google API scopes:
https://www.googleapis.com/auth/calendar.readonly — to read your calendars, events, working-location and out-of-office entries, and your timezone setting. Envoy uses this to know when you're free.https://www.googleapis.com/auth/calendar.events — to create a calendar event when both parties agree on a time, to place short tentative holds during an active coordination, and to delete or adjust those events when you cancel or reschedule through AgentEnvoy.Which scopes we ask for depends on how you sign in. If you sign up through our front door — the header, homepage, or /login page — we request read and write together, since you're signing up to host meetings. If you connect a calendar from within a meeting link someone shared with you, we request read-only; you'll only be asked for write later if you become a host yourself. The goal is to ask for the narrowest access that fits what you're actually doing.
By default Envoy reasons only about when you are busy — not why. We see “busy 9–10am,” not “Doctor appointment with Dr. Smith.” You may choose to let Envoy also consider event titles and locations so it can reason about your flexibility (for example, noticing that a nearby lunch makes an in-person meeting convenient). When you do, Envoy uses those details internally and never shares them with the other party.
If you're a guest invited to a meeting, you can optionally connect your calendar so AgentEnvoy can find a mutual time. This uses https://www.googleapis.com/auth/calendar.readonly — read-only. We can never create, modify, or delete anything on a guest's calendar. We read only the free/busy windows needed for the coordination you're in.
Messages you send to Envoy during a coordination, preferences you set (meeting duration, phone number, video provider, scheduling rules), and any knowledge you explicitly teach Envoy about how you prefer to work.
As you use AgentEnvoy, Envoy derives a set of scheduling preferences from how your calendar actually looks — the hours you tend to be working, buffers around focus time, and which people you make time for most easily. These derived patterns are stored against your account so Envoy can make smarter proposals on your behalf. They're available for you to review and edit on your dashboard, and they're deleted when you delete your account.
We record a small set of product-usage events (for example, “you finished onboarding,” “you confirmed a meeting”) on our own database so we can see which parts of the product work and which don't. Event names are enumerated in our source code under an allowlist, and event properties are limited to short primitive values (strings, numbers, booleans). Calendar content, message text, and free-text input are never captured through this channel. We do not currently send these events to any third-party analytics vendor; if that ever changes, we'll update this policy and list the vendor here before any data leaves our infrastructure.
There's a “Send feedback” link in the product. When you use it, you can optionally include recent activity (your latest messages, active sessions, and any route errors from the last day) so we can see what you were seeing. Calendar event contents are redacted before anything is stored — we keep times, titles, status, and participant counts; we strip descriptions, attachments, non-participant emails, and URL-shaped locations. If you opt to share, we gather only what you chose to share. Feedback is a gift — thank you for taking the time. 💜
Your data is used for one purpose: facilitating the meeting coordination in front of you.
We do not:
AgentEnvoy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
We rely on a small number of infrastructure providers to operate. Each is a data processor acting under our instructions, bound by their own published terms:
We do not share your data with any third party for advertising, analytics, profiling, or any purpose unrelated to operating AgentEnvoy. We do not use advertising trackers, analytics pixels, or data brokers.
Every internal admin read of user-specific data — feedback reports, user drawers, event streams — writes a row to an internal audit log (AdminAccessLog). The log records which admin, which route, and when. This is a structural control: the audit exists by construction, not by policy. If you'd like a copy of your own log entries, email privacy@agentenvoy.ai.
When our team needs to read your specific thread or calendar to help you with a bug, we ask for your explicit opt-in via the Privacy section of your Account page. The consent is revocable at any time, and every access is still logged.
We keep data only as long as it serves a purpose.
You can permanently delete your AgentEnvoy account at any time from the Account page under Delete account. When you do:
You can also revoke AgentEnvoy's access to your Google data at any time from Google Account Permissions. Once revoked, we stop accessing any Google data immediately and delete any cached calendar data within 30 days.
Questions, or need help with deletion or a data export? Email privacy@agentenvoy.ai.
Questions about this policy or your data: privacy@agentenvoy.ai