Requested access. The app requests gmail.send to send messages and gmail.readonly to verify mailbox identity and read delivery notifications. The latter permission technically allows broader mailbox reading. The service uses it for the sender profile and a limited search for Google delivery reports; the application filter does not narrow the permission granted by Google.
Use. The service creates MIME messages from fixed templates containing the destination address, name where the template uses it, temporary code, expiry and security instructions. Messages are sent from the company mailbox. DSN notifications are matched to messages using identifiers and recipients, and technical outcomes are checked without using ordinary messages for profiling. The system does not use Google data for sale, advertising, optional marketing or AI model training, and does not send it to generative services. A future change in purpose or access requires disclosure and review before use.
Storage and protection. OAuth credentials and tokens are handled within the restricted operator and backend environment and are not exposed to applicants’ browsers. The delivery payload is temporarily encrypted; stored previews omit the code. The encrypted payload is removed in the relevant final states or at its service expiry. Complete DSN reports are analysed in memory: technical receipts, hashes, identifiers, outcomes and SMTP diagnostics remain, and may include delivery contact details. Cursors and alerts contain metadata and status codes, not email bodies or OTPs. This does not remove copies held in Gmail, receipts or backups.
Sharing. Email delivery and API calls involve Google. The backend and operational metadata use private Cloudflare infrastructure. Authorised operators may review delivery failures and security where necessary; messages are not published. Consumer Gmail operates under Google’s terms and privacy policy; this page does not claim a Workspace DPA or a consumer-product processor appointment.
Owner control and rights. The owner can revoke the connection through Google Account connections. Revocation stops new API access under that connection; it does not automatically erase existing emails or receipts and may interrupt portal code delivery. For requests about app data, contact colivingliguria@pec.it or colivingliguria@gmail.com, including without an active session. Do not attach sensitive documents to the initial request.
LivingRegister Mail follows the Google API Services User Data Policy, including its Limited Use requirements. Retention criteria follow purpose and operational necessity; code expiry is not an email deletion period.