What to check before giving an AI assistant your inbox

Check seven things, and expect a clear written answer to each. If a company cannot answer one, treat that as the answer.

1. What does it read, and what does it keep?
2. Where is the data stored and processed?
3. Is it used to train AI models?
4. Who at the company can read it?
5. Can you see and edit what it remembers?
6. What happens when you delete your account, and can you export your data?
7. Which permissions does it ask for, and can you take them back?

The sections below take these in order, with Gravel's answers as a worked example. They come from Gravel's privacy notice, so you can check them against the source.

Ask for a list of what it reads and how long it keeps it, in specific terms. “We take your privacy seriously” is not an answer. A short, fixed retention period is a good sign, and “as long as needed” is not.

Gravel reads the mailbox and calendar you connect: sender, recipients, subject, the text a person would see, attachments when needed, and calendar events with attendees and locations. It mainly keeps the facts it finds, such as a delivery date, plus at most one sentence of summary. Raw email content is cached for no more than 30 days, longer only when an open task needs that exact message. Chat history is kept for 90 days.

Ask for the country, the provider and a plain yes or no on training. Phrases like “anonymized” and “to improve our services” deserve a follow-up question.

Gravel is hosted and processed in the EU, mainly at Scaleway and OVHcloud in France, and the AI models run there. It does not train AI models on your data, and neither do its providers.

Two things sit outside any assistant's control, and both are your choice: the email provider you connect and the messaging app you talk to it on. Each handles data under its own rules. Gravel's privacy notice lists, channel by channel, who that is and where they process it.

If the assistant connects to Gmail, also ask about Google's API Services User Data Policy. It sets Limited Use requirements for apps that read Google user data, including limits on transfers, on human access, and on uses such as advertising and selling the data.

The right default is nobody. Ask whether staff can open your content, under what conditions, and whether you would find out.

At Gravel, the team has no access to your content by default. There are three exceptions: you ask support for help with specific content and agree, access is needed to investigate a security incident or abuse, or the law requires it. Each access is recorded with a name and a reason, written to your activity log before it happens, and shown to you. You can also ask Gravel “what did you look at today?” to see what it read and did.

Deletion should be real and export should be complete, and both should be as easy as asking. Ask what is actually destroyed, how fast, and what stays behind.

In Gravel, “export my data” produces a complete copy through a one-time link. Deleting your account destroys your account's encryption key right away, which makes every encrypted copy unreadable, backups included. Gravel then deletes your records and revokes its access at Google and Microsoft. Unencrypted technical metadata in backups is gone within 30 days, and accounting records that the law requires are the exception.

In the EU, the GDPR gives you the right of access (Article 15), erasure (Article 17) and data portability (Article 20), so you can ask any company for the same.

Grant the least access that lets the assistant do its job, and make sure you can take it back. Start with read-only, and add write access only when you want it to send or change something.

With Google and Microsoft, you sign in on their page and the assistant receives an access token, never your password. You can remove that access yourself in your account settings; see Google's guide to third-party access. With iCloud, you create an app-specific password that you can revoke at Apple whenever you like.

Gravel connects read-only and asks for more access the first time an action needs it, then ties your confirmation to the exact action you approve. For how much freedom to give an assistant after that, read how much an AI assistant should do without asking.