EmailBot KH ("we", "us", "our") operates the application available at emailbot.approfits.com (the "Service"). This Privacy Policy describes how we collect, use, and protect your information, including data accessed through Google APIs.

Information We Collect

• Account information — name, email address, and authentication credentials.
• Usage data — features used, campaigns sent, contacts managed.
• Google account data — when you connect Gmail, we access your Google profile and Gmail mailbox per the scopes you grant (see below).

Google User Data & Gmail Access

When you connect your Google account, EmailBot KH requests the following OAuth scopes:

• gmail.send — to send emails on your behalf from your campaigns and sequences.
• gmail.modify — to label, mark as read, and organize messages related to your campaigns.
• gmail.readonly — to read incoming replies so we can match them to your sent campaigns and display them in your dashboard.
• userinfo.email & userinfo.profile — to identify your connected account.

How we use Google user data: Gmail data is used solely to power features you have explicitly enabled inside EmailBot KH (sending outreach, polling replies, syncing status). We do not use Gmail data to train AI/ML models, serve advertising, or for any purpose unrelated to the user-facing features of EmailBot KH.

How we share Google user data: We do not sell, rent, or share Gmail data with third parties. Data is transmitted only between your browser, our Supabase backend, and Google's APIs over encrypted (TLS) connections.

EmailBot KH's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data Retention & Deletion After You Disconnect Gmail

You can disconnect Gmail at any time from Settings → Gmail Connection → Disconnect, or at myaccount.google.com/permissions. When you disconnect:

• Immediately: OAuth access & refresh tokens are deleted from our database, and EmailBot KH stops all Gmail API calls for that mailbox.
• Within 30 days: Gmail-derived metadata we cached (message IDs, thread IDs, reply tracking, send logs, headers, snippet text used for reply matching) is permanently purged from production and backups.
• Retained under your control: Campaign content you authored in EmailBot KH (templates, sequences, contacts, analytics) stays in your EmailBot KH account. You can delete it any time from the app, or request full deletion by emailing us.
• Account closure: Closing your EmailBot KH account purges all remaining Gmail-derived data within 30 days.

See our Gmail Connection & Permissions page for a step-by-step revocation guide.

Payment Data

Paid plans are processed through ABA PayWay (card and ABA Pay) and KHQR. EmailBot KH does not collect, process, or store full card numbers, CVV codes, PINs, or bank login credentials. Those details are entered only on ABA Bank's secure payment pages.

What we do store for each transaction, in order to issue receipts, honour refunds, and meet accounting obligations:

• Transaction reference, amount, currency, payment method, and status.
• Timestamp, plan or credit package purchased, and the associated account/tenant.
• Masked payer identifiers returned by ABA (for example the last digits of a card or a payer name), where provided.
• Refund requests, approvals, and their outcomes.

Transaction records are retained for at least 5 years where required by Cambodian tax and accounting rules, and are never used for advertising or sold to third parties. Refund handling is described in our Refund & Cancellation Policy.

Data Security

All data is encrypted in transit (TLS 1.2+) and at rest. OAuth tokens are stored encrypted in our database with row-level security policies restricting access to the owning user. Payment callbacks are signature-verified before any account credit is granted. We follow industry best practices to protect against unauthorized access, alteration, disclosure, or destruction.

Your Rights

You may access, export, or delete your data at any time from your account settings, or by emailing us at the address below.

Contact & Support

For questions about this Privacy Policy or our handling of Google user data, data-deletion requests, or account issues, you can reach us through any of the following:

• Privacy & data requests: privacy@approfits.com
• General support: support@approfits.com
• Contact form: emailbot.approfits.com/contact

We aim to respond to privacy and data-deletion requests within 5 business days.