Privacy Policy

What we process

Depending on how you use SAPUN Loop, this may include account and workspace information, technical information needed to operate and secure the service, and information from a mailbox that you explicitly connect.

SAPUN Loop is designed to use the minimum Gmail access currently required for its workflow: gmail.readonly to read and process messages, gmail.send to send an approved reply, and gmail.modify to mark a message as read or unread and to move it to Gmail Trash or restore it, only when you press that button for that message. SAPUN Loop never deletes messages permanently, does not empty the Trash and does not change messages on its own, in bulk or through the AI assistant. SAPUN receives Gmail access only after you give explicit consent through Google's OAuth consent flow.

How Gmail data is used

Gmail data is used only to provide the connected SAPUN Loop workflow, including:

• ingesting and displaying relevant mailbox messages inside the authorised workspace;
• organising threads and supporting reply workflows;
• analysing message content to extract useful context and prepare AI-assisted drafts;
• helping a user review, edit and confirm a draft before sending it through Gmail;
• marking a message as read or unread and moving it to Gmail Trash or back, only when the user presses that button.

SAPUN does not sell Google user data and does not use it for advertising. Gmail remains the external mail provider. A person must explicitly confirm an outbound message before SAPUN sends it; SAPUN does not send an AI-prepared draft automatically.

Storage and security

The long-lived Gmail refresh token is stored server-side in encrypted form and is scoped to the authorised workspace and mail account. Short-lived access tokens are used for the provider interaction when needed; they are not used as a permanent credential store. Secrets and tokens are kept out of browser-facing pages and application logs.

Workspace isolation is enforced on the server: mailbox data and actions are resolved through the authenticated session, workspace membership and enabled SAPUN Loop module. Changing a browser-supplied workspace identifier does not grant access to another workspace.

Sharing and service providers

SAPUN does not sell or rent personal data. Google user data is not shared with third parties for advertising or unrelated purposes. Google user data may be processed only by infrastructure or service providers that are necessary to deliver the user-facing SAPUN feature, and only for that purpose. Any AI processing provider used for SAPUN Loop must also comply with the Google API Services User Data Policy, its Limited Use requirements and SAPUN's commitment not to use Gmail data to create, train or improve general-purpose or generalized machine-learning or AI models.

AI assistant in SAPUN Loop

By default, SAPUN Loop analyses a message on SAPUN's server without an external AI provider. When the user turns on the AI assistant — a one-time confirmation in SAPUN Loop that can be switched off in its settings at any time — SAPUN Loop sends the message the user is working with to OpenAI to prepare an analysis (a summary, the sender's questions, dates and commitments, a suggested next step), a translation or a reply draft. In this manual mode, only that message is sent, and only when the user presses an assistant button: the sender's name, the date, the subject and the text, with e-mail addresses and phone numbers masked and earlier quoted messages removed; for a translation, only the text. Sender addresses, recipients, attachments, other messages, contacts and Gmail credentials stay on SAPUN's server. A separate optional mode for automatic analysis of incoming mail is described below. SAPUN does not keep the content of these requests in its technical logs.

OpenAI processes these requests under its API terms and may process them in the United States. OpenAI states that data sent to its API is not used to train or improve its models unless the customer opts in, and that API data may be retained for up to 30 days for abuse monitoring; SAPUN has not opted in. SAPUN sends Gmail data to an AI provider only under such terms, as required by the Google API Services User Data Policy, and does not send Gmail data to DeepSeek. AI output can be wrong or incomplete; SAPUN Loop never sends a message or confirms a commitment on its own.

When AI is switched on in SAPUN Loop, questions the owner asks in the “Ask AI” helper are sent to OpenAI together with the name of the current Loop section and the Loop guide text to prepare an answer. E-mail addresses and phone numbers in a question are masked; message content is not sent to the helper. With AI switched off, the answer is looked up in the guide on the SAPUN server and nothing is shared with third parties.

AI secretary. If you enable the secretary dialogue, SAPUN Loop sends your question, the recent turns of that conversation, selected excerpts of the messages needed to answer, and — for voice input — the audio recording to our AI provider, OpenAI, for processing. E-mail addresses and phone numbers are masked in excerpts; attachments, other messages, contacts and Gmail tokens are not sent. Audio is used only for transcription and is not stored by SAPUN Loop. The conversation is stored in your workspace. OpenAI's API terms state that API data is not used to train models and may be retained for up to 30 days for abuse monitoring. You can withdraw this permission in Settings; the secretary will then answer only from stored analyses and facts. Sending mail always requires your separate confirmation.

When AI is switched on, the owner can also ask SAPUN Loop to prepare personal invitation drafts for businesses selected in the Outreach section (Sapun Growth, see below). Only after the owner confirms the list, SAPUN Loop sends OpenAI, for each business, its name, city, type and short facts from its public web page, with e-mail addresses and phone numbers masked. The contact person's name, e-mail addresses, phone numbers and Gmail data stay on SAPUN's server, where the name is added to the draft. The number of AI drafts per day is limited. Each draft waits for the owner's review and approval and is never sent automatically.

Automatic analysis of incoming mail

Automatic analysis of incoming mail is a separate optional mode. It requires your own explicit consent: consent to the manual AI assistant does not cover automatic processing. Publication of these legal documents does not enable the mode by itself; it requires the separate consent described here. Until you give that consent, no automatic request is made. You can withdraw this consent in SAPUN Loop settings. After a recorded withdrawal, new requests do not start; a request that has already started cannot be cancelled retroactively.

When this mode is enabled, up to 5 INBOX messages per run, received within the last 7 days, are sent to OpenAI using the current model gpt-6-luna. SAPUN sends the sender's name, date, subject and body. E-mail addresses and phone numbers are masked, and quoted history is cut. Attachments, recipients, contacts and Gmail tokens are not sent. The purpose is to prepare automatic summaries, questions, dates, commitments and recommended next steps. Results are stored in SAPUN Loop. AI does not send, delete or move messages.

By default, no more than 50 provider calls are made per day. The USD 0.50 daily budget is an estimated cost-control limit, not a guarantee of the final invoice amount. Under OpenAI's API terms, data is not used to train or improve its models without a separate opt-in. OpenAI's standard retention period for abuse-monitoring logs is up to 30 days; longer retention is possible under the conditions stated in its terms. SAPUN has not opted in to training.

Human access to Gmail data

SAPUN does not permit people to read Google or Gmail user data as a routine practice. Human access is limited to circumstances allowed by the Google API Services User Data Policy, such as when you explicitly request or authorise support involving specific data, when access is necessary to investigate security or abuse, or when access is required by law.

Your control, disconnect and revocation

You choose whether to connect Gmail and can revoke SAPUN's access from your Google Account security settings. When a connection is disconnected or access is revoked, SAPUN treats the mail account as unavailable and stops using it for provider operations; existing workspace records are not silently reassigned to another workspace. Contact hello@sapun.net if you need help with a connection or a data request.

Retention and deletion

At the current private pre-release stage, SAPUN retains the records needed to operate the configured SAPUN Loop workspace workflow. There is not yet a universal automatic deletion schedule that we can promise. We do not claim that disconnecting a provider automatically deletes every historical workspace record. For a deletion or access request, contact us so we can review the specific workspace and records involved.

Google API Services and Limited Use

SAPUN's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. We request only the Gmail scopes needed for the SAPUN Loop workflow, use Google data only as necessary to provide the visible SAPUN Loop features chosen by the user, and do not use Gmail or Google Workspace user data to create, train or improve general-purpose or generalized machine-learning or AI models. We also do not use it for advertising or sell it to data brokers.

Account

In-app feedback is optional and does not affect your trial. No email or phone is required. The owner receives the text you enter, message type, language, app build and network state; the message is linked to internal account and workspace identifiers. Photos, audio, property information, contacts, full User-Agent, URLs and error logs are not attached automatically. Do not include personal data in your message. Messages are accessible only to the authorized operator and are excluded from requests to AI providers. Deleting an account deletes related messages from the primary database; backups follow a separate retention period. There is no fixed retention period for voluntary feedback. We retain messages to review requests, fix bugs and improve the product. SAPUN deletes or anonymises messages on its own initiative or in response to a justified user request, in accordance with applicable law.

When guest access is enabled, you can start without an email address and a password: Supabase creates a separate guest account and workspace for a preview based on Free 10. The trial does not run during this preview. Up to 10 non-archived properties, photos, clients, deals, history and optional feedback are available; two complete voice AI demos include transcription, text review, AI filling, review and saving. Automatic matching is an introductory exception using no external AI. AI photo enhancement and other paid AI outside these demos are excluded. Each demo allows up to three provider attempts per stage; technical errors do not automatically complete the demo, and retries remain limited. The server stores guest origin, demo progress and limited provider retries and the one-time trial start and end dates. Confirming email and setting a password starts the first 30-day trial in the same account and workspace with all created data. Signing in again and changing passwords do not restart it. AI photo enhancement is included in Trial and Pro. Later, you can link an email, confirm it using the emailed code and set a password, keeping the same account and workspace. Until these steps are complete, recovery after losing the guest session is not guaranteed. Our authentication provider handles passwords; SAPUN does not store them in readable form. We store your interface language, workspace and access status. To protect guest access against abuse, we use Cloudflare Turnstile, single-use admission records, account creation times, a derived IP-address value and counters of use and reserved AI budget. Our guest-admission log does not store the original IP address. During Turnstile verification, Cloudflare receives technical signals including IP address, User-Agent, TLS fingerprint and sitekey/origin to protect the service and improve bot detection. Property fields and contacts are not included in our Turnstile verification request. Guest workspaces are not automatically deleted when the trial ends; losing a session does not itself delete server data. For limited AI operations in a workspace started as a guest, the device prepares transcription audio as a WAV without the source container metadata; the server checks the format and a two-minute limit using the audio sample count. The original recording stays on the device. Speech may contain personal information and is sent to the transcription provider; changing the format does not remove this information from speech. The local working copy in a web browser is not protected against another person with access to the same browser profile: use your own device or a separate profile and do not hand an unsecured session to another person.

Information you enter

Sapun Kit stores the work information you choose to enter, including:

• clients: name, phone, email, preferred contact channel and notes;
• client needs: type of deal and property, locations, budget, rooms, area and notes;
• properties: address, price, characteristics, description, listing links and the contact details of the owner or other source of the listing;
• deals: which property was offered to which client, stages, viewings, reactions, reminders and history;
• property photos and the materials you prepare for clients or listings.

This information can include personal data about other people, such as your clients and property owners. You decide what to enter. Please do not store identity documents, bank details or other sensitive documents in Sapun Kit.

Photos and voice notes

Property photos you save are uploaded to private storage that is accessible only through your account's workspace. The original photo is kept unchanged. If you request photo enhancement, an enhanced copy is stored separately next to the original.

A voice note is recorded and kept on your device. It is sent to our servers only when you ask Sapun Kit to transcribe it; the audio is then passed to OpenAI for transcription and is not stored on SAPUN's servers. The resulting text is stored with your workspace.

AI features and what is sent

AI features run only when you start them. Requests go through SAPUN's servers to external AI providers and include only the data needed for the action you chose. DeepSeek processes text requests, and OpenAI processes voice and photos:

• text — DeepSeek: filling in a property from a note or voice note (the text of your note, the transcript and the property facts already entered), preparing a property description for a client or a listing (property facts such as type of offer, price, address, characteristics, description and the number of photos) and suggesting a client's need from the text you type or dictate;
• voice — OpenAI: transcribing a voice note (the audio recording);
• photos — OpenAI: enhancing a photo (that photo).

Before text is sent to DeepSeek, SAPUN's server automatically removes recognisable contact details (such as phone numbers, email addresses and links) and the owner contact saved in the card; this check may not find everything, so please do not put sensitive personal data into text you send to AI. Each provider processes requests under its own terms. The result is stored in your workspace so that you can review it. AI output can be wrong or incomplete, and you are asked to check the facts before you save or send anything. SAPUN does not use your Sapun Kit content to train AI models.

Data stored on your device

So that Sapun Kit keeps working with a weak or missing connection, the web app keeps a working copy of your workspace in your browser's storage on the device, including client and property data, unsent changes, drafts, photos and voice notes that are not yet uploaded, and your sign-in session. This local copy is not additionally encrypted by Sapun Kit, so use Sapun Kit only on devices and browser profiles that you control.

Deleting your account from the app erases this local copy from the device you use for the deletion. You can also remove it by clearing the browser's site data for kit.sapun.net; changes that have not yet synchronized are then lost.

Synchronization

Changes you save are first recorded on the device and sent to SAPUN's servers when a connection is available. After synchronization the same data is available on other devices signed in to the same account.

Sending materials to clients

Sapun Kit prepares property materials, but it does not send messages to your clients or publish listings on your behalf. You send materials yourself, for example by copying text, using your device's share function or downloading the photos as a ZIP file, through the apps you choose.

Support messages on WhatsApp

If you write to us on WhatsApp, including with the “Report a problem” button in the app, the message, attached files and your number are processed by WhatsApp (Meta Platforms) under its own terms. We use them only to reply and fix problems and do not move them into Sapun Kit.

Service providers

Sapun Kit relies on the following providers, each only to operate the feature it supports:

• Supabase: account authentication, database, private file storage and server functions;
• Resend: delivery of transactional account emails, such as email confirmation and password recovery;
• Cloudflare: hosting and delivery of the kit.sapun.net web app;
• DeepSeek: the text AI features described above, only when you start them;
• OpenAI: voice transcription and photo enhancement, only when you start them.

SAPUN does not sell or rent personal data and does not use Sapun Kit data for advertising. The Sapun Kit web app does not include advertising or analytics trackers. Sapun Kit does not currently take payments.

Where data is hosted

Sapun Kit's primary database, authentication and file storage are hosted by Supabase in the European Union, in the Frankfurt region (eu-central-1). Not all processing takes place in that region: backups, logs, server functions and the other providers listed above may process data in other locations, including outside the European Union.

Security

Data is transferred over encrypted connections. Access to workspace data and files is checked on the server for every request against your authenticated session and workspace membership, and photos are kept in private storage that is not publicly listed.

Retention, archive and deletion

We keep your Sapun Kit data while your account exists. Data is not deleted because a trial period ends.

• Archive removes a record from current work without destroying it; you can return it to work.
• Delete permanently, available from the archive, removes the property, client or deal together with the data that belongs to it, including the property's photos and enhanced copies. A minimal technical record that a deletion took place, without its content, is kept.
• Delete account and data, available in the app, permanently erases your workspace, including all clients, properties, deals, photos, enhanced copies and AI results, and then deletes your account.

Results of AI note processing and transcription are kept until you delete your account. Deleted data may remain for a limited time in backups and logs kept by our providers, until it is removed in the normal course of their backup and log lifecycle.

Access and corrections

You can view, correct, archive and delete your data directly in the app. Sapun Kit does not yet offer a full export of an account; you can share or download the photos of a property. For other access or deletion requests, contact hello@sapun.net.