SunUp

Paloma Mail Privacy Policy

Effective September 29, 2026 · Paloma Mail is operated by Gonzalez Consulting LLC, Tulsa, Oklahoma. Questions: info@gonzalezcap.com

Paloma Mail is an email app: it opens the mailboxes you choose to connect (Gmail, Google Workspace, Outlook / Microsoft 365, Yahoo or any IMAP mailbox) in one place so you can read, sort, answer and organize your mail.

1. What we access

Only what you connect, and only after you sign in on the provider’s own page (Google, Microsoft) or enter an app password your provider gives you. We never see your Google or Microsoft password.

Google accounts: your name and email address (openid, email, profile) and your Gmail through the Gmail API with the https://www.googleapis.com/auth/gmail.modify permission: to list, search and open your messages and attachments, change their labels (read / unread, star, archive, your own labels, spam), move messages to or from Trash, keep drafts, and send the mail you write. Paloma Mail cannot permanently delete your mail and never tries to.
Microsoft accounts: the same, through Microsoft’s mail permissions (IMAP.AccessAsUser.All, SMTP.Send) plus basic sign-in details.
Other providers: the same, over IMAP and SMTP with the app password you enter.

2. How we use it

To show your mail, search it, send mail you write and apply the changes you make directly in your mailbox; and to power Paloma Mail’s organizing features you can see in the app: business and topic tags, one-line summaries, receipt / bill / meeting / request cards, calendar hand-off, and reply reminders. Nothing else.

3. What we store — and what we don’t

We do not store copies of your emails or attachments. Messages are read from your mailbox when you open them and are not kept on our servers (your device keeps a short-lived cache so the app opens quickly). We store:

your SunUp account (username, name) and your settings;
your mailbox connections — the sign-in token or app password, encrypted in a secure vault;
the results of the organizing features (for example “Real Estate · reply pending”, a one-line summary, the vendor and amount on a receipt), linked to the message’s ID. You choose per mailbox how much is kept: notes and cards, labels only, or nothing;
if you turn on notifications, your device’s push token and the IDs of messages already announced.

4. AI processing

The organizing features are produced by software running on servers operated by Gonzalez Consulting LLC. We do not send your mail to third-party AI services, and Google user data is not used to develop, improve or train generalized AI or machine-learning models.

5. Sharing

We don’t sell your data, don’t use it for advertising, and don’t share it with data brokers. We use service providers only to run Paloma Mail for us — database and hosting (Supabase), web hosting (Netlify), network (Cloudflare), notifications (Apple Push Notification service, only if you turn notifications on) — bound to that job. If you connect a calendar app from Paloma Mail, only the meetings and to-dos you choose are sent to it. We may disclose data if the law requires it or to investigate abuse.

6. People reading your mail

Nobody at Gonzalez Consulting LLC reads your email unless you ask us to (for example for support, pointing us to a specific message), it is needed for security or to investigate abuse, or the law requires it.

7. Google user data — Limited Use

Paloma Mail’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data is used only to provide and improve the user-facing email features described above.
It is not transferred to others except as needed to provide or improve those features, to comply with the law, for security, or as part of a merger or acquisition with your notice.
It is never used or transferred for advertising (including personalized, re-targeted or interest-based ads), and never sold.
No person reads it except with your permission, for security or abuse investigations, to comply with the law, or when it is aggregated and anonymized for internal operations.

8. Security

Encryption in transit (TLS) and at rest, an encrypted token vault, per-person access rules in our database, audit logging, multi-factor sign-in for our staff’s admin consoles, and an annual independent security assessment.

9. Your choices

Disconnect a mailbox in Paloma Mail → Settings — its stored sign-in and our notes about it are deleted.
Delete your data or your account in Paloma Mail → Settings → Your data, or by writing to info@gonzalezcap.com. Google sign-ins are revoked at Google as part of it.
Revoke access at the source any time: Google — myaccount.google.com/permissions; Microsoft — account.microsoft.com/privacy/app-access.

10. Retention

Organizing results are kept while the mailbox is connected and deleted when you disconnect it or delete your account (at the latest within 30 days). Server logs are kept up to 30 days and never contain message content.

11. Children

Paloma Mail is not directed to children under 13, and we don’t knowingly collect their information.

12. Changes and contact

We’ll post changes here and tell you in the app for material ones. Questions: info@gonzalezcap.com · Gonzalez Consulting LLC, Tulsa, Oklahoma.