Privacy Policy
Last updated: 2026-06-26
Bioby AI Technology (HK) Limited ("we," "us") operates Bioby Creator (the website, mobile apps, and APIs, the "Service"). This Policy explains how we collect, use, store, share, and protect personal information, especially when you sign in with Google or connect Gmail.
This Policy applies to users in the United States, the European Economic Area (EEA), the United Kingdom, and other regions. Where GDPR/UK GDPR applies, we act as the data controller.
1. Who we are
•
Data controller: Bioby AI Technology (HK) Limited
•
Registered address: Unit C, 9/F Winning House, No.72-76 Wing Lok Street, Sheung Wan, Hong Kong
2. Information we collect
When you sign in with Google, we may receive your Google account identifier (openid), name and profile photo (profile), and primary email address (email).
2.2 Gmail connection
When you choose "Connect Gmail" in the app, we request the following permissions after your explicit consent:
•
gmail.readonly — Read Gmail (read-only): sync INBOX and Sent; read subject, parties, timestamps, Message-ID, Thread-ID, body/snippet, and attachment metadata for business classification, brief extraction, and deal workflow. We do not modify or delete labels via this scope (except compose/send below).
•
gmail.compose — Compose and send: create Gmail drafts in the app and send replies you approve on your behalf. We never send email without your confirmation.
•
OAuth access/refresh tokens (encrypted at rest on our servers).
•
Synced mail copies and derived data (classification, briefs, opportunities, drafts).
2.3 Other data
•
Creator profile and templates you provide.
•
Device/app metadata and diagnostic logs (no mail bodies in logs).
•
IP address for security and abuse prevention.
2.4 What we do not collect
•
Your Google account password.
•
The broad mail.google.com scope.
•
Mail datasets sold to data brokers.
3. How we use information
•
Provide the Service: sync, classification, briefs, drafts, and sending (contract).
•
Gmail sync: only after you connect and consent (consent; withdraw anytime).
•
Security and abuse prevention (legitimate interests).
3.1 Google Limited Use
We comply with the Google API Services User Data Policy, including Limited Use:
•
Use Gmail data only to provide Bioby Creator mail workflow features to you.
•
No ads (including retargeting) using Gmail data.
•
No selling Gmail data to third parties or data brokers.
•
No training unrelated commercial AI/data products on Gmail data.
•
Human access only with your consent, for security/compliance, or to fix errors you report—minimized access.
4. AI and automation
We may use automation (including AI) to classify business mail, extract briefs, and suggest reply drafts. Outputs are assistive; you decide before sending or confirming deals.
You may object to solely automated decisions with significant effects; contact us for human review.
5. Sharing
•
Google LLC: OAuth and Gmail API.
•
Cloud and AI subprocessors: limited to providing the Service under contractual restrictions.
•
We do not sell mail content to data brokers.
6. International transfers
If you are in the EEA/UK and data is processed in the US or other countries, we rely on Standard Contractual Clauses (SCCs) or other lawful mechanisms. Contact us for details.
7. Retention
•
Account data: while your account is active.
•
Gmail tokens: while connected; deleted within 30 days after disconnect.
•
Synced mail and derivatives: while connected; deleted within 30 days after mailbox disconnect unless law requires longer.
•
Deleted accounts: deleted or anonymized within 30 days after closure.
•
Security logs: typically 90 days.
8. Security
•
Application-layer encryption for OAuth tokens and sensitive credentials at rest.
•
Access controls and least privilege.
9. Your rights
•
Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent.
•
In-app: disconnect Gmail or delete your account.
•
Google Account → Security → Third-party access to revoke Bioby Creator.
•
Email hello@bioby.ai (GDPR requests answered within 30 days where applicable).
10. California residents (CCPA/CPRA)
We do not sell personal information. California residents may request access, deletion, or correction by emailing privacy with subject "California Privacy Request."
11. Children
The Service is for users 18+. We do not knowingly collect data from children under 18.
12. Changes
We may update this Policy; material changes will be announced on the site or in-app. Continued use after updates means you accept the revised Policy where permitted by law.
13. Contact
•
Bioby AI Technology (HK) Limited
•
Registered address: Unit C, 9/F Winning House, No.72-76 Wing Lok Street, Sheung Wan, Hong Kong
Support: hello@bioby.ai
Bioby AI Technology (HK) Limited
Unit C, 9/F Winning House, No.72-76 Wing Lok Street, Sheung Wan, Hong Kong
© 2026 Bioby AI Technology (HK) Limited