DeepDesk Privacy Policy

Effective October 9, 2026. DeepDesk is an internal outreach tool operated by SpendCraft (“SpendCraft”, “we”). Contact: info@spendcraft.com

1. What DeepDesk is

DeepDesk is a tool SpendCraft uses to send business emails to procurement, finance and operations professionals, read their replies, and manage the follow-up. It is used by SpendCraft staff and invited team members only. It is not offered to the public.

2. Information we handle

Team members: name, work email, role, sign-in events and actions taken in DeepDesk (audit log).
Business contacts (people we email): name, work email, job title, company, and details from public business sources or lists we obtained. We also keep the emails we send them, their replies, and their opt-out status.
Connected mailboxes: when a SpendCraft mailbox is connected to DeepDesk through Google, we read and send email in that mailbox and store the messages needed to run outreach and replies. We store an access token for the mailbox, encrypted.
Operational data: sending, bounce, complaint and deliverability statistics, and calendar availability of SpendCraft team members who host demos.

3. Google user data

DeepDesk requests these Google permissions for SpendCraft mailboxes: read email (gmail.readonly), send email (gmail.send), and organize email such as labels and archiving (gmail.modify). We use them only to send SpendCraft's outreach emails, detect and read replies to them, filter out warm-up mail, and let our team respond. We do not use Google user data for advertising, we do not sell it, and we do not use it to train general AI models.

DeepDesk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Humans at SpendCraft can read mailbox content inside DeepDesk to do their work. Apart from that, we do not read it except to run the service, keep it secure, follow the law, or investigate abuse.

4. How we use information

To send and track outreach, honor opt-outs, and protect sender reputation.
To classify replies and draft suggested responses. A person reviews and approves before anything is sent, except where a team member has explicitly turned on automatic sending for a specific action.
To measure which messages work, and to improve the tool.
To keep the service secure and meet legal obligations.

5. AI processing

We use AI language models to classify replies, draft messages and summarize activity. Text from messages and contact details needed for that task is sent to our AI providers under agreements that restrict their use of it. They process it for us and may not use it to train their models for others. AI does not decide limits, suppression or sending volume. Those are set by code and people.

6. Who we share with

We share information only with service providers that run DeepDesk for us (for example hosting, database, email delivery, mailbox warm-up and deliverability monitoring, AI processing, and calendar services), and where required by law. We do not sell personal information.

7. Opting out and your rights

If you received an email from us, reply “unsubscribe” or “remove me” and we will stop emailing you and keep your address on a suppression list so you are not contacted again. You can also write to info@spendcraft.com to ask what we hold about you, to correct it, or to delete it. We will respond within 30 days. Where the law gives you additional rights, such as in California or the EU, we honor them.

8. Retention

We keep contact and message records while outreach is active and for up to 24 months after the last activity, then delete or anonymize them. Opt-out records are kept so we can keep honoring them. When a mailbox is disconnected, we delete its stored access token immediately and its stored messages within 30 days. Audit logs are kept for 24 months.

9. Security

Access to DeepDesk is limited to invited users who sign in by emailed link. Access tokens are encrypted, secrets stay on the server, and actions are logged. No system is perfectly secure, and we cannot guarantee absolute security.

10. Changes and contact

We will update this page when our practices change and revise the effective date. Questions: info@spendcraft.com.