Privacy Policy

Last updated: October 29, 2026

Save Email as PDF (the Outlook add-in and the Gmail add-on, together "the Service") is operated by Innova Apps ("we"). This policy describes what data the Service processes and why. The short version: we use your email content to show your conversion choices and produce the PDF you request. Temporary conversion copies are deleted within 24 hours. We never sell your email content or use it for advertising or AI training.

What we process, and why

• Email content and attachments. The add-in or add-on reads message information to show your conversion choices. When you click the convert button, the selected message content, metadata (subject, sender, recipients, date), and selected attachments are sent over HTTPS to our conversion service, converted to PDF, merged, and returned to you. Nothing is converted unless you explicitly click the button.
• Your email address. Verified using an email sign-in link in Outlook or your Google identity in Gmail, used to enforce one successful free export per email address, ever, and to associate your purchase with your account. The allowance is shared across Outlook and Gmail.
• Outlook sign-in. Firebase Authentication verifies email sign-in links and stores your email address, account identifier and authentication information. Its SDK keeps session data in browser storage to maintain sign-in. Firebase also processes IP addresses and browser information for security. We do not request your mailbox password.
• Gmail export recovery. The add-on keeps up to 20 opaque request identifiers, request hashes and timestamps in your Apps Script user properties to recover interrupted submissions. This store contains no email content or attachments. Entries older than 24 hours are ignored and removed when the recovery store is next updated.
• Usage counters. We store a lifetime count of successful exports and temporary in-progress reservations per account. Historical monthly usage records may be used to determine whether the one-time free export has already been used.
• Payment data. Payments are processed entirely by Stripe. We never see or store your card details; we store only your Stripe customer reference and subscription status.

Where and for how long

• Our PDF conversion service runs on Google Cloud servers in Belgium (europe-west1). This location does not apply to every service listed below.
• Generated PDFs are held in temporary storage so you can download them: download links expire after 30 minutes and files are automatically deleted within 24 hours.
• Conversion job data for the Gmail add-on is deleted as soon as the job finishes, and in all cases within 24 hours.
• Email content during conversion. Rendering services process submitted content temporarily to create the PDF. The Gmail add-on also places the conversion request in temporary storage while its background job runs. That request is deleted when the job finishes, and an automated sweep removes anything left behind by a failed or abandoned job. Temporary conversion content is deleted within 24 hours.
• Account records (email address, plan, usage counters) are kept while you use the add-in and deleted on request.
• Outlook authentication data. Firebase Authentication processes this data in the United States. Authentication records remain until deletion is requested; Firebase may take up to 180 days to remove them from live and backup systems. See Firebase privacy and data processing information.
• PDFs you download or save to your own Google Drive remain under your control. The temporary-storage deletion schedule does not delete those copies.

How we protect your data

We use the following safeguards to protect sensitive Google user data, including email content, attachments, generated PDFs, and account information:

• Encryption in transit. The Gmail add-on communicates with Google APIs and our conversion and account service over HTTPS (TLS), protecting data as it travels over the internet.
• Encryption at rest. Temporary conversion requests and generated PDFs stored in Google Cloud Storage, and account and job records stored in Firestore, are encrypted at rest using Google Cloud's managed encryption.
• Authenticated access. Our backend verifies mailbox ownership through an email sign-in link in Outlook, or your Google identity in Gmail, before accepting conversion or account requests. We never handle your mailbox password. Conversion-job status is available only to the authenticated account that created the job. The add-on uses limited Google permissions to access the open email or conversation and to save the PDF you request to Drive.
• Time-limited downloads. PDF downloads require an unguessable, randomly generated link token that expires after 30 minutes. Anyone with a valid download link can use it during that period, so treat the link as private and share it only with intended recipients.
• Limited retention. We use automatic deletion after processing and scheduled cleanup to limit how long temporary conversion requests and PDFs remain on our service, as described in the retention section above. Copies you download or save to your own Drive remain under your control.

Google user data (Gmail add-on)

The Gmail add-on uses the following application permissions:

• See and run Gmail add-ons. Lets the add-on appear and run inside Gmail. It grants no access to message content on its own.
• View the email messages you open. Gives us the one message you have open, and the other messages in that same conversation, at the moment you open the add-on. We cannot see any other message, label, folder, or mailbox content, and we cannot search your mail.
• Connect to an external service. Lets the add-on contact our conversion and account service, the Gmail API to read the open message or conversation, and the Google Drive API when you choose Save to Drive. These destinations are allowlisted in the add-on's manifest.
• See, edit, create and delete only the specific Google Drive files you use with this app. This permission covers files created by the app or explicitly shared with it. Our add-on uses it when you press "Save to Drive" to create and name your exported PDF; it does not browse the rest of your Drive.
• Sign in with Google and see your primary email address. Used to prove who is requesting a conversion, so we can apply your free allowance or your subscription. We never see or handle a password.

Opening the add-on reads the open message's body, metadata and attachment details, and counts messages in that conversation, so it can show the available choices. Choosing "Whole conversation" reads the other messages in that same conversation to show their attachments. The add-on also sends your Google identity to our account service to show your allowance or plan. Message content and attachments are sent to our conversion service only when you press "Convert to PDF" or "Convert conversation".

Limited Use

Save Email as PDF's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the user-facing feature you asked for: converting your email into a PDF.
• We do not transfer Google user data except as necessary to provide that feature, to comply with applicable law, or as part of a merger or acquisition with your consent.
• We do not use Google user data for serving advertisements of any kind.
• We do not allow humans to read Google user data, except with your explicit consent for specific messages, where necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data is aggregated and anonymised for internal operations.
• We do not use Google user data to develop, improve, or train generalised artificial-intelligence or machine-learning models.

Who processes your data

• Google Cloud — our PDF conversion service in Belgium (europe-west1), account and usage storage, and website hosting.
• Firebase Authentication (United States) — Outlook email-link verification, account management and sign-in sessions.
• Google Apps Script — the runtime the Gmail add-on itself runs in.
• Stripe — payment processing, if you subscribe. We never see your card details.

We use no other processors, no analytics provider, and no advertising network.

What we never do

• No selling of your data or sharing for independent third-party use. The service providers listed above process data only to operate the Service.
• No advertising, profiling, or training of AI models on your content.
• No mailbox-wide access. The Service can only access the message you have open — and, if you choose Whole conversation, the other messages in that same conversation — and only at the moment you use it. It cannot search your mail or reach anything else in it.

Your rights

You may request access to, correction of, or deletion of your account data at any time by emailing us (see below); we will delete our account record and usage counters, and request deletion of any Firebase Authentication account, within 30 days. Firebase's removal from live and backup systems follows the retention period described above. If you are in the EU/EEA, you have the rights provided by the GDPR, including the right to lodge a complaint with your supervisory authority.

Contact

Innova Apps, support@innovaapps.ai