Privacy Policy
1. Who we are
bagels.io is run by Keith Mander (“we”, “us”). We build and operate private software tools and integrations that connect to third-party services, such as email, cloud storage, e-commerce, advertising and accounting platforms, and to AI assistants such as Anthropic’s Claude. These tools are used by the operator and the businesses he runs. They are not sold or offered as a public service.
This policy covers the bagels.io website and every tool and integration we operate under it (together, the “services”). We are the data controller for personal data processed by the services.
2. Data we collect
Data from connected accounts
When an account on a third-party platform is connected to one of our services, we access only the data that the service needs and that the account holder has authorised. Depending on the service, this may include:
- account identifiers, such as an email address or account ID;
- messages, documents, files and their metadata;
- business data, such as orders, products, listings, reports, invoices and advertising data;
- OAuth access and refresh tokens, or API keys, used to connect to the platform.
Data you send us
If you contact us, for example through the contact form on this website or by email, we receive your email address and your message.
Technical data
Our servers record standard technical information, such as IP addresses, request times and errors, in order to run, secure and troubleshoot the services.
3. How we use data
We use data only to provide the services and to carry out the actions a user asks for, for example reading, searching, drafting, sending or organising data on a connected account; to keep the services secure and working; and to respond to enquiries.
We do not sell personal data. We do not use it for advertising or profiling, and we do not use data from connected accounts to train AI models. Our legal bases for processing are the performance of the service the account holder has requested and our legitimate interest in running and securing it.
4. Sharing
We share data only as needed to provide the services:
- AI assistants. When a user asks an AI assistant to act on their data, the relevant data is sent to that assistant’s provider to fulfil the request. For Claude, see Anthropic’s privacy policy.
- Infrastructure providers. We use hosting, networking and backup providers, currently Hetzner (servers and backup storage in the EU) and Cloudflare (network security and access control). They process data on our behalf and do not use it for their own purposes.
- Spam protection. The contact form on this website uses Google reCAPTCHA.
- Legal requirements. We may disclose data where required by law.
We do not share data with anyone else.
5. Security
- Encryption in transit. All connections to our services, and from our services to third-party platforms and AI providers, use HTTPS/TLS.
- Encrypted backups. Backups are encrypted before they leave our servers.
- Access control. Services that handle account data are behind authenticated access, and only the operator can log in to them. Server access requires SSH keys.
- Credentials. OAuth tokens and API keys are stored on our servers in files or databases readable only by the service that needs them, and are never committed to source code.
- Least privilege. We request only the permissions a service needs.
- Maintenance. We keep server software and dependencies up to date and monitor the services for failures.
6. Storage location
Our servers and backups are hosted by Hetzner in the European Union. Some providers listed above, such as AI assistant providers, may process data in other countries, under their own safeguards.
7. Logs
Our servers keep operational logs of requests and actions, such as which account and which function was used, so that we can troubleshoot and secure the services. Logs may include identifiers and search terms but are not used to store the content of messages or documents. Logs are accessible only to the operator.
8. Retention and deletion
- Data from connected accounts is processed to fulfil each request and is not kept longer than needed for it. Temporary files, such as downloaded attachments, are deleted automatically, typically within an hour.
- Access tokens and API keys are kept until the account is disconnected or access is revoked, and are then deleted.
- Backups are kept for up to 12 months and then deleted.
- Contact messages are kept only as long as needed to respond.
You can revoke a service’s access at any time from the connected platform’s settings. For a Google account, go to your Google Account → Security → Third-party apps (or myaccount.google.com/connections), choose the app and select Remove access. You can also ask us to delete your data by email.
9. Your rights
Depending on where you live, including under the EU and UK GDPR, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, and to receive a copy of it. To make a request, email us. You also have the right to complain to a data protection authority.
10. Platform-specific terms
Where a platform sets its own data-use rules, we follow them in addition to this policy.
Gmail in Claude’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
The same applies to every other bagels.io service that uses Google APIs.
11. Children
The services are not directed at children, and we do not knowingly collect data from them.
12. Changes
We will post any updates to this policy on this page with a new effective date.
13. Contact
Keith Mander – [email protected]