How your data is handled and protected.

Service refers to ExtraAI, including the website at extraai.ai and the ExtraAI iOS and Android applications operated by ExtraAI.

Personal Data means data about a living individual who can be identified from that data (or from that and other information either in our possession or likely to come into our possession).

Usage Data is data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).

Cookies are small files stored on your device (computer or mobile device).

Data Controller means a natural or legal person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed.

Data Processors (or Service Providers) means any natural or legal person who processes the data on behalf of the Data Controller.

Data Subject is any living individual who is the subject of Personal Data.

User is the individual using our Service. The User corresponds to the Data Subject, who is the subject of Personal Data.

We collect information you provide directly to us when you register, use our services, or contact support.

Personal Information: First and last name, email address, birth date (to verify age requirements), country and region/state, account credentials (managed securely via Clerk).

Connected accounts (optional): If you connect a third-party app such as Gmail in ExtraAI Connectors, we receive the access our assistant needs to fulfill your requests (for Gmail, that is reading messages you ask about and sending messages you ask us to send). We do not connect these accounts unless you start the connection yourself.

Automatically Collected Information: Usage Data (interactions, features used, session duration), Device Information (device type, OS version, unique device ID), Location when in use (city and region for profile setup, only when you grant permission in the app), Approximate location derived from IP address for regional settings, Purchase History (managed securely via Apple App Store and RevenueCat).

We use the collected information for the following purposes:

• To provide, maintain, and improve the Application

• To process transactions and manage your subscription

• To personalize your experience and deliver relevant content

• To communicate with you (e.g., support, updates, security alerts)

• To process your text, audio, and image inputs through AI models to generate responses

• To run optional Connectors (for example Gmail) only after you connect the account, so the assistant can complete the tasks you request

We do not sell your personal data. We share your information only with trusted third-party service providers necessary to operate our Application:

• Authentication: Clerk (clerk.com/privacy)

• Payments & Subscriptions: Apple App Store and RevenueCat (revenuecat.com/privacy)

• Infrastructure & Hosting: Vercel, Expo, Sevalla, and our cloud database providers

• Connectors: Composio, which stores connection tokens and runs the third-party actions you request (for example Gmail read/send) on ExtraAI’s behalf. See composio.dev/privacy.

• AI Providers: OpenAI, Anthropic, Google (Gemini), Microsoft Azure OpenAI, and Google Firebase AI Logic. Prompts, chat attachments, voice audio, and camera frames you submit may be sent to these providers to generate AI responses. If you ask ExtraAI to use a connected account (such as Gmail), relevant content from that request may be sent to the AI provider you selected so it can complete the task.

We may also disclose information if required by law, to enforce our terms, or to protect our rights or the safety of others.

ExtraAI Connectors let you optionally link third-party accounts, including Gmail, so the ExtraAI assistant can help you in chat (for example find or summarize email, or send a message you asked for). Connecting is optional. ExtraAI works without Gmail connected.

When you connect Gmail, ExtraAI uses Google OAuth. The Google consent screen shows ExtraAI. We request only the Gmail access needed for those features: read (gmail.readonly) and send (gmail.send), plus basic account identity (openid, email, profile). We do not request full mailbox control, permanent delete, or Gmail settings access.

How we use Gmail data: ExtraAI reads messages only to answer your request (search, summarize, draft a reply). ExtraAI sends email only when you ask it to send or confirm a send. We do not use Google user data for advertising, and we do not sell Google user data.

Limited Use: ExtraAI’s use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide or improve user-facing ExtraAI features. ExtraAI employees do not read your Gmail unless you ask us to for support, or we must for security, legal, or compliance reasons.

Storage and processors: Connection tokens and Gmail actions are processed by ExtraAI and our integration provider Composio so the assistant can run the action you requested. AI model providers may receive the prompt and the email content needed for that turn. We retain connected-account data only while the Connector stays connected or as needed to operate the Service, then delete or disconnect it when you disconnect the app or delete your ExtraAI account.

Your choices: Disconnect Gmail anytime in ExtraAI → Connectors (or Account settings on iOS/Android). You can also revoke ExtraAI in your Google Account permissions (myaccount.google.com). Disconnecting stops new Gmail access. For deletion of ExtraAI account data, use in-product account deletion or contact contact@extraai.ai.

If you are a resident of the European Economic Area (EEA), you have specific rights regarding your personal data under the GDPR:

• Right to Access: Request copies of your personal data.

• Right to Rectification: Request correction of inaccurate data.

• Right to Erasure ("Right to be Forgotten"): Request deletion of your data.

• Right to Restrict Processing: Request limitation on how we process your data.

• Right to Data Portability: Request transfer of your data to another organization.

To exercise these rights, please contact us at contact@extraai.ai or use the account deletion features within the Application settings.

Retention: We retain your personal information only for as long as your account is active or as needed to provide you services, comply with legal obligations, resolve disputes, and enforce our agreements.

Security: We implement industry-standard security measures, including encryption and secure authentication, to protect your data. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

Our Application is not directed to users under the age of 16 (see our Terms of Service). We do not knowingly collect personal information from anyone under 16. If you are a parent or guardian and become aware that your child has provided us with personal information, please contact us immediately so we can delete such data.