Architect Marketing Institute

Mailbox data privacy notice

Last updated: 21 September 2026

This supplementary notice explains how SIX Email Contact Discovery handles Google Workspace/Gmail and Microsoft Outlook mailbox data, including personal Outlook.com and Microsoft 365 work or school accounts. It should be read with the AMI Privacy Policy.

Data accessed

When an authorised SIX client connects a mailbox, the service may access email headers, sender and recipient names and addresses, dates, subjects, message text, conversation references, and safe attachment filenames. The service does not download attachment contents. Composio's managed Google consent screen may display broader Gmail, profile and contact permissions, but Email Contact Discovery only calls the approved Gmail profile, search and message-retrieval operations. It has no feature or route that sends, drafts, deletes, moves, labels or modifies email.

How mailbox data is used

Mailbox data is used only to provide the contact-discovery feature requested by the client: search historic correspondence, understand relationship context, and propose structured professional contacts for the client's review. It is not used for advertising, sold, or used to build unrelated user profiles.

Service providers and storage

• Composio manages Google authorisation, stores and refreshes Google OAuth credentials, and executes the Gmail read and search requests made by this service.
• Netlify hosts the secure application. It stores a private Composio account reference for Google connections and encrypted OAuth credentials for Microsoft connections.
• Relevance AI processes selected email text and participant details to understand context and propose contacts.
• Airtable stores structured candidate details and review decisions, but not OAuth credentials, full email bodies, raw HTML, or attachment contents.

Full message text is fetched when needed and passed through Composio and Netlify to the requested analysis. This application does not intentionally retain full message bodies after the request. The private Google connection reference or encrypted Microsoft connection credentials remain until the mailbox is disconnected or access is otherwise removed. Temporary search and evidence references expire after 30 days. Structured candidate records follow AMI's member operational retention periods unless deletion is requested or a legal exception applies.

Human access and Google Limited Use

AMI does not permit people to read Google user data unless the client has given affirmative permission for a specific support or review purpose, access is needed for security or abuse investigation, or access is required by law. AMI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Control and deletion

Clients can disconnect the shared firm mailbox at any time from the protected SIX member page. For Google, disconnecting asks Composio to revoke the Google grant, deletes the Composio connected account and removes the local reference. For Microsoft, it removes the encrypted local credentials. Active temporary searches are also removed. See the data deletion instructions for retained contact results and privacy requests.

Contact

Email support@archmarketing.org with questions or requests.