Xtaff Privacy Policy

Last updated: 2026-11-01 · Operated by 熙宇科技

Xtaff is an enterprise scheduling system in which AI agents ("Leaders") carry out work for an organization. This policy explains how the Xtaff Gmail connector handles Google user data. It applies to a Gmail mailbox that an organization dedicates to Xtaff and authorizes through Google OAuth.

Data we access

• gmail.readonly: search and read messages in the authorized mailbox, including headers, body text and attachment metadata (attachment contents are not downloaded).
• gmail.send: send messages from the authorized mailbox.
• The mailbox address, read from the Gmail profile to confirm the connection.

How we use it

Google user data is used only to perform mail tasks that the organization's Xtaff agents are asked to do, such as checking for new mail or sending a reply. Message content read by an agent is passed to the AI model service that the organization has configured in Xtaff, and may be kept in that organization's Xtaff workspace, where it is visible to the organization's members.

Storage and security

• The OAuth client secret and refresh token are stored encrypted (AES-256-GCM) in the organization's Xtaff deployment and are held in memory only by the connector service that calls Gmail.
• The connector can reach only Google's OAuth and Gmail API endpoints. Audit records store action names, status and timing, not message content.

Sharing

We do not sell Google user data, use it for advertising, or transfer it to anyone other than the AI model service the organization has configured for its own tasks. Xtaff's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access and deletion

Access can be revoked at any time from Google Account → Third-party connections. The organization can delete the stored credentials by removing the Gmail connector in Xtaff Controller. Mail content kept in the organization's workspace is deleted under that organization's own retention settings.

Contact

qiweiview@gmail.com

---

Xtaff 隐私政策

更新日期：2026-11-01 · 运营方：熙宇科技

Xtaff 是企业调度系统，由 AI 智能体（Leader）为组织执行工作。本政策说明 Xtaff Gmail 连接器如何处理 Google 用户数据，适用于组织专门为 Xtaff 准备、并通过 Google OAuth 授权的 Gmail 邮箱。

访问的数据

• gmail.readonly：搜索、读取该邮箱的邮件，包括邮件头、正文和附件元数据（不下载附件内容）。
• gmail.send：以该邮箱发送邮件。
• 邮箱地址：读取 Gmail profile，用于确认连接。

使用方式

Google 用户数据只用于执行组织的 Xtaff 智能体被要求完成的邮件任务，例如查看新邮件、发送回复。智能体读取的邮件内容会发送给该组织在 Xtaff 中配置的 AI 模型服务，并可能保存在该组织的 Xtaff 工作空间中，对组织成员可见。

存储与安全

• OAuth 客户端密钥与 refresh token 以 AES-256-GCM 加密保存在组织自己的 Xtaff 部署中，只由调用 Gmail 的连接器服务在内存中持有。
• 连接器只能访问 Google 的 OAuth 与 Gmail API 地址。审计记录只保存动作名、状态和耗时，不保存邮件内容。

共享

我们不出售 Google 用户数据，不用于广告，除组织为自身任务配置的 AI 模型服务外不向任何人转交。Xtaff 对通过 Google API 获得的信息的使用和转交遵守 Google API Services User Data Policy，包括其中的 Limited Use 要求。

撤销与删除

可随时在 Google 账号 → 第三方连接 撤销授权。组织在 Xtaff Controller 中删除 Gmail 连接器即删除已保存的凭据。保存在组织工作空间中的邮件内容按该组织自己的保留设置删除。

联系方式

qiweiview@gmail.com