Privacy Policy

1. Who we are & what StayInSync does

StayInSync is an AI-powered email digest service. We recommend connecting your inbox: Gmail connects directly with read-only access (Google CASA security assessment completed), and Outlook, Hotmail, Yahoo and others are coming soon. If you can't connect, you can forward (or auto-forward) emails to your own private StayInSync address instead. We read only what is needed, filter the ones that match your chosen categories (school, family, finance, travel, etc.), summarise them, and deliver a concise digest to you on WhatsApp. Nothing is posted, sent, replied to, or shared on your behalf.

2. Consent — the basis on which we process your data

We rely on your explicit, informed, specific consent under the Digital Personal Data Protection Act, 2023 (DPDP Act) as the primary legal basis for processing your personal data. You give consent in three distinct places, each optional and independently revocable:

• At signup — you agree to this Privacy Policy and our Terms.
• When you connect Gmail — you grant read-only access through Google sign-in. We read the sender, subject and date of emails to find school updates, and open the full text only of forwards that come from you or a trusted forwarder. Disconnect on the Inboxes page ends access immediately.
• When you forward an email — by forwarding (or auto-forwarding) an email to your private StayInSync address, you authorise us to process that specific email for the sole purpose of generating your digest. With forwarding we have no access to your mailbox and cannot read anything you do not forward.
• At WhatsApp verification — you authorise us to deliver your digest to that WhatsApp number.

You can withdraw any of these consents at any time from your dashboard. Withdrawal does not affect the lawfulness of processing done before the withdrawal.

3. Data we collect

• Account data: your name, email address, WhatsApp number, password hash (never the plaintext password), and preferences.
• Family & category configuration: optional details you add — child names, school/grade, categories you want tracked, keywords, sender domains.
• If you connect Gmail: a read-only Google access token, encrypted at rest and deleted when you Disconnect, plus the sender, subject and date of emails used for your digest. We never see or store your email password.
• Your private forwarding address: the StayInSync email address we generate for you, and the sending addresses you register as allowed to forward to it. Forwarding needs no mailbox credentials or access tokens.
• Emails you forward to us: the sender, subject, timestamp and message text of the emails you (or your mailbox's auto-forward rule) send to your StayInSync address. We only ever receive what you forward. See Section 4 for exactly what we retain.
• Optional profile details: if you choose to add them — city, state, pincode, relationship to the child (mother/father/guardian), how you heard about us, and for each child their school, class, board and nicknames. We use these to match school emails to the right child, and in aggregate to understand who uses StayInSync. All except your name and WhatsApp number are optional.
• Digest history: the summaries we generate and deliver.
• Delivery & operational logs: WhatsApp message delivery status, error logs, digest schedule status, IP address, browser/device fingerprint (for security and abuse prevention).
• Payment metadata: if you subscribe, our payment partner (Razorpay) collects and processes your payment details. We only receive metadata (plan, status, subscription id, invoice) — we never see or store your card, UPI, or bank details.

Apart from the optional city, state and pincode you choose to give, we do not collect location data, biometric data, health data, or data of children under 18. If you configure a child's name and grade for digest grouping, that information is treated as your personal preference — we do not create a profile of the child.

4. What we do — and do not — retain from your emails

What we receive with connected Gmail: the sender, subject and date of emails, read-only; the full text only of forwards from you or a trusted forwarder.

What we receive with forwarding: only the emails you forward — manually or through an auto-forward rule you set up yourself — to your private StayInSync address. With forwarding we do not connect to your mailbox, so we can never see any email you have not forwarded.

What we read from a forwarded email: the sender, subject, timestamp and message text. We do not process or store attachments.

What we do with this data: the sender, subject and message text are used exclusively to identify relevant communications and generate your daily WhatsApp digest summary. This information is processed by our AI engine (Anthropic Claude API) to classify emails into urgency tiers — Urgent, Events and General — and generate a one-line parent-friendly summary for each relevant email. We never sell your data and never use it to train AI models.

What we retain: the generated digest summaries, and the text of the school-related emails used to build them, stored encrypted while your account is active. Attachments are never stored. See Section 10 for retention.

What we never do:

• Never ask for or store your email password.
• Never send, delete, label or modify any email.
• Never store attachments; email text kept for your digest is encrypted and deleted with your account.
• Never share your email data with third parties for any purpose other than providing the service (see Sections 6 and 8).
• Never use your email data for advertising or profiling.
• Never train AI models on your email data.

What we ignore: personal correspondence, chat threads, private messages, one-to-one conversations, and any category you have not enabled are ignored during classification.

5. How we use your data

Your data is used only to operate the Service:

• Authenticating you and securing your account.
• Fetching, filtering, classifying, and summarising your emails per the categories you have enabled.
• Delivering your digest on WhatsApp at the schedule you configure.
• Sending you critical service notifications (delivery failures, security alerts, billing).
• Debugging and improving reliability of the Service.
• Complying with legal obligations.

We do not use your subject line and sender information, digest content, or personal data for advertising, marketing profiling, or resale to third parties.

6. AI processing — what you should know

We use these AI services, each only for the purpose shown:

• Anthropic Claude — sorting school emails and writing your digest. It receives the sender, subject and text of school-related emails from connected Gmail or that you forward.
• Lovable AI — AI Advisor answers and reading the school documents you upload.
• Sarvam AI (India) — voice: turning your spoken question into text and reading answers aloud. Voice audio is processed in memory and never stored.
• Languages — digests and voice support English + 8 Indian languages: Kannada, Hindi, Tamil, Telugu, Malayalam, Marathi, Gujarati and Bengali.

We take the following safeguards:

• We send only what is needed for the task — never attachments, and never your whole mailbox.
• Files you upload are read once in memory and not kept; only the extracted entries you approve are saved.
• We use enterprise / API-mode endpoints under a data processing agreement where the provider contractually agrees not to train their models on our data.
• We do not permit the AI provider to log or retain the prompt beyond the transient window required to return a response.
• We never send payment credentials, passwords, or one-time codes to the AI provider.

7. How you connect — you stay in control

If you connect Gmail, StayInSync uses Google OAuth with read-only access. The use of raw or derived user data received from Google Workspace APIs, including Gmail, will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Gmail access is read-only and can be revoked at any time from your dashboard or your Google Account.

Whether it reaches us from connected Gmail or by forwarding, email data is:

• Never used to train AI or ML models.
• Never transferred to third parties for advertising, data brokerage, or any purpose other than delivering the digest to you.
• Processed only long enough to classify and summarise, then discarded (see Section 4).
• Never shared with or sold to any third party.

Our AI providers process data under API terms that prohibit training their models on our customers' data.

StayInSync has completed Google's CASA (Cloud Application Security Assessment) security assessment ✅.

We do not allow humans to read your email data unless we have your explicit consent, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or the data has been aggregated and anonymised.

You can stop the flow of data at any moment — delete your forwarding rule, or delete your StayInSync forwarding address from your dashboard. For connected Gmail, tap Disconnect on the Inboxes page or remove StayInSync from your Google Account.

8. Third-party service providers (Data Fiduciaries & Processors)

We rely on the following processors, each bound by their own privacy commitments and data-processing terms:

• Google LLC — Gmail API (read-only), only if you connect Gmail.
• Postmark (or comparable) — receiving the emails you forward to your StayInSync address.
• Meta Platforms, Inc. — WhatsApp Business Cloud API (digest delivery).
• Lovable Cloud (built on Supabase, Inc. and Cloudflare, Inc.) — hosting, database, sign-in and storage.
• Razorpay Software Pvt Ltd — payment processing for paid plans.
• Anthropic PBC (Claude) — email sorting and digest writing (see Section 6).
• Lovable AI — AI Advisor and document reading (see Section 6).
• Sarvam AI (India) — voice speech-to-text and read-aloud (see Section 6).
• Resend / SES or comparable — transactional email delivery (verification, password reset).

Each processor accesses your data strictly to fulfil the sub-processing task described above.

9. Data security

• All traffic between your device, StayInSync, and our processors is encrypted in transit (TLS 1.2+).
• Personal data is encrypted at rest. If you connect Gmail, the read-only access token is encrypted; we never store mailbox passwords.
• Access to production systems is restricted to authorised personnel, protected by strong authentication and audit logging.
• Row-level security policies enforce that one user's data can never be read by another user through the application.
• We regularly review dependencies for known vulnerabilities and patch promptly.

No system is perfectly secure. If we ever become aware of a personal-data breach affecting you, we will notify you and the Data Protection Board of India as required under Section 8(6) of the DPDP Act.

10. Data retention & deletion

• Account & preferences: retained while your account is active.
• Forwarding address & allowed senders: retained until you delete the forwarding address or your account.
• Gmail access token: deleted as soon as you Disconnect or delete your account.
• Digest history & message references: retained for up to 90 days from generation, then automatically purged. You may delete individual digests earlier from your dashboard.
• School email text: stored encrypted while your account is active so we can build your digests; deleted with your account.
• Voice audio and uploaded files: never stored.
• Operational logs: retained for up to 30 days for troubleshooting and security.
• Payment records: retained for the period required by applicable tax/accounting law (typically 7 years in India).

On account deletion, all personal data other than what we are legally required to retain (e.g. tax invoices) is deleted within 30 days.

11. Your rights under the DPDP Act

As a Data Principal, you have the right to:

• Access a summary of the personal data we hold about you.
• Correct, update, or complete your personal data.
• Erase your personal data (subject to legal retention requirements).
• Withdraw a previously given consent at any time.
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
• Register a grievance with us and, if unsatisfied, escalate to the Data Protection Board of India.

Most of these actions can be performed directly from your dashboard. For anything you cannot self-serve, email us at support@solutionist.co.in and we will respond within 30 days.

12. Children

StayInSync is intended for use by adults (18+). We do not knowingly create accounts for children. Child names and grades entered by a parent are used solely as labels to group the parent's own digest and are not treated as an independent child profile.

13. International transfers

Our processors (Google, Meta, Lovable Cloud and its providers, Anthropic, Lovable AI, Razorpay) may process your data on servers located outside India. Where this happens, we rely on their contractual and technical safeguards to ensure your data is protected to a standard comparable to the DPDP Act.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will bump the version number, update the effective date at the top of this page, and prompt you to review and re-accept the policy the next time you sign in. Continued use of the Service after acceptance constitutes agreement to the updated policy.

15. Grievance officer & contact

For any question, concern, or grievance regarding this policy or your personal data, please contact:

Email: support@solutionist.co.in

If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India under the DPDP Act, 2023.

16. Governing law

This Privacy Policy is governed by the laws of India. Any dispute arising out of or in connection with it is subject to the exclusive jurisdiction of the competent courts at Bengaluru, Karnataka.