Privacy Policy

What we collect

• Account info (name, email) from our auth provider, Clerk.
• Email content you draft, edit, and send through Saqua.
• Prospect and research data: the companies you research and the public info gathered about them.
• Encrypted mailbox OAuth tokens (Gmail/Outlook), used to send email and detect replies. For Gmail we read only message metadata (identifiers and labels), never message content. Tokens are never shown in the browser.
• Your conversations and workspace drafts.
• Operational metadata: usage, cost/telemetry, and error logs used to run the service.
• Waitlist email address, if you join before launch. We store it only to email you when Saqua opens, we confirm it first so nobody is added without asking, and every message carries a one-click unsubscribe. It is never sold or used for anything else, and unsubscribing removes you from all waitlist mail.

Google user data (Gmail)

When you connect a Google account, Saqua requests only two Gmail permissions:

• Send (gmail.send), used to send the emails you draft and approve, and their follow-ups.
• Metadata (gmail.metadata), used to detect replies to your sequences. This scope grants access only to message and thread identifiers and labels (such as INBOX and SENT), never the subject or body of any message. Saqua cannot and does not read your email content. When a reply is detected, Saqua stores only the message's opaque ID and a timestamp, and uses them solely to stop the follow-up sequence.

Saqua's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically:

• We do not use Google user data to develop, improve, or train generalized or non-personalized AI or ML models.
• We do not sell or transfer Google user data, and we do not use it for advertising.
• We do not allow humans to read your Google user data, except with your explicit consent, as needed for security or to comply with the law, or on data that has been aggregated and anonymized.

You can revoke Saqua's access at any time from your Google Account permissions or by disconnecting the mailbox in the app; disconnecting deletes the stored tokens.

How we use it

To research companies, draft personalized outreach, send mail and detect replies only when you connect a mailbox and explicitly ask, keep your workspace available, and operate/secure the service. We don't sell your data or use your email content for advertising.

Third parties your data passes through

Anthropic (Claude), Firecrawl, Tavily, Exa, Jina, Hunter, the X (Twitter) API, Google (Gmail), Microsoft (Outlook), and Clerk. Each processes only the minimum needed to return your result. Your Gmail data is used only within Saqua for reply detection, and it is not sent to Anthropic or any AI provider.

Security

Mailbox OAuth tokens and other secrets are encrypted at rest; our database stores only ciphertext, never raw tokens. Traffic to and from Saqua uses TLS. API keys and secrets live only in our server environment, never shown in the interface or sent to your browser. Access to production data is limited to what is needed to operate the service.

Retention & deletion

We keep your conversations, drafts, and research while your account is active. You can delete any conversation at any time, which removes it from our systems. For Gmail, we store no message content at any point, only the opaque message IDs and timestamps used to detect replies. Mailbox tokens are kept until you disconnect the mailbox or delete your account, at which point they are deleted and access is revoked. Operational logs (usage, errors) are kept for a limited period for security and reliability, then aged out. If you delete your account, we remove your workspace data and revoke stored tokens; minimal records may be retained where required by law. To access or delete your data, email support@saqua.io.

Contact

Email support@saqua.io.