Privacy policy
Last updated 7 November 2026
Algōs Bot is a business development agent. It reads your website and your mailbox, learns what your company sells, proposes companies worth pursuing, finds the right people, and drafts messages that you approve before anything is sent. This page describes the data that requires, where it goes, and what we refuse to do with it.
Who is responsible
Algōs Bot is operated by Simon Papaj, an individual trading as Algōs Bot, established in Hungary. Under the GDPR that makes him the controller of the data described below — the person answerable for it. Requests about your data go to privacy@projectalgos.com.
What we collect
| Data | Why | Where it lives |
|---|---|---|
| Your account: name, email address, workspace | To sign you in and keep your workspace separate from everyone else's | Supabase (Frankfurt, EU) |
| Your website's public content | To learn what you sell and who buys it | Supabase (Frankfurt, EU) |
| Company and person data from providers | To build the target list and reach the right person | Supabase (Frankfurt, EU) |
| Mailbox messages you connect | To read replies, draft responses and track the conversation | Supabase (Frankfurt, EU) |
| Records of what the agent did | So every claim can be traced to a source and every action reviewed | Supabase (Frankfurt, EU) |
The Gmail integration
Connecting a mailbox is optional and reversible. If you connect one, we request two scopes and nothing more:
- gmail.readonly — read messages, so the agent can understand replies. It cannot modify, delete, archive or send with this scope.
- gmail.send — send a message. It is used only for a draft you have explicitly approved in the app, and never by a background job acting alone.
We do not request access to your contacts, your calendar, your drive, or your other Google accounts. You can revoke access at any time at myaccount.google.com/permissions, and disconnecting inside the app revokes the token as well.
How credentials are held
A refresh token is written to Supabase Vault, which encrypts it at rest. It is decrypted only inside the database, by a function granted to the background worker role alone — application code never receives the stored value and never logs it. Access tokens are never written anywhere: one is minted per request, held in memory, and discarded when the request ends.
Google API Limited Use. Algōs Bot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
What we never do
- We do not sell your data, and we do not share it with advertisers or data brokers. There is no advertising in the product.
- We do not train models on your mailbox. Message content is sent to the model provider named below to produce a specific draft, and is not used to train anything.
- We do not read your mail for surveillance. Messages are read by the agent to do the task you asked for, and every read is recorded in an execution log you can inspect.
- We do not send without approval. Every outbound message passes a policy check and waits for a human to approve it.
Who processes data for us
These are processors, not recipients — each one performs a function on our instructions, under contract:
- Supabase — database, authentication and encrypted secret storage. Region: Frankfurt, EU.
- Vercel — application hosting.
- DeepSeek — language model inference for drafting and extraction.
- Apollo and Brave Search — company and contact data, and web search.
- Google — sign-in, and mailbox access once you connect one.
How long we keep it
Workspace data stays while your workspace exists. Disconnecting a mailbox stops all further reading immediately and deletes the stored refresh token. Deleting your account deletes your workspace's rows; a small amount of billing and audit data may be retained where the law requires it.
Your rights
You can ask for a copy of your data, ask us to correct it, or ask us to delete it. You can also object to a specific processing activity, or ask us to restrict it. Write to privacy@projectalgos.com and we will respond within 30 days. If you are in the EU, you also have the right to complain to your national data protection authority.
Security
Data is encrypted in transit and at rest. Every table is protected by row-level security scoped to your workspace, so one customer's queries cannot return another's rows. API credentials are held in a password manager and never committed to the repository. No system is perfectly secure; if we discover a breach affecting your data we will tell you without undue delay.
Children
Algōs Bot is a business tool. It is not intended for anyone under 16 and we do not knowingly collect their data.
Changes
If this policy changes in a way that matters, we will tell you by email before the change takes effect. The date at the top always reflects the current version.
Contact
Simon Papaj, trading as Algōs Bot, Hungary · privacy@projectalgos.com · www.projectalgos.com