Effective Date: October 5, 2026
Last Updated: October 5, 2026
Confi Technologies, Inc. ("Confi," "we," "us," or "our") is a Delaware corporation. Confi Technologies, Inc. is a consumer-first commerce platform. Confi's V1 product helps users keep track of their post-purchase activity by analyzing order-related emails, for example orders, return windows, refunds, and subscription renewals.
Confi operates the Confi service ("Service"), which includes the Confi mobile application ("App") and supporting backend systems.
This Privacy Policy explains what data we collect, how we use it, who we share it with, and your rights regarding your data.
Contact:
Confi Technologies, Inc. Principal Office: 513 W Shoreview Drive, San Ramon, CA 94582, United States Delaware Registered Agent: Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, DE 19958, United States Privacy Inquiries: privacy@confi.ai
For data subject requests (GDPR, CCPA, and equivalent), see Sections 8 and 9.
Confi connects to the following email providers:
gmail.readonly scope)Mail.Read scope)Only personal Gmail accounts (@gmail.com) and personal Outlook.com accounts are currently supported. Organizational, workplace, or school accounts, including Google Workspace and Microsoft 365 accounts managed by an organization, are not currently supported.
We may support additional email providers in the future, and we will update this Privacy Policy as appropriate.
The OAuth scopes above are read-only. Confi uses them to read order-related emails and does not use them to send, draft, modify, delete, archive, mark as read, or move email in your account.
The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements. For Confi, the Google scope involved is the read-only Gmail scope (gmail.readonly), used with personal Gmail accounts.
Confi's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, when Confi accesses your Gmail data via the gmail.readonly scope:
Permitted use only. We use Gmail data only to provide or improve user-facing features of the Confi service that are described in this Privacy Policy, such as parsing order-related emails to help track orders, return windows, refunds, and subscription renewals.
No transfer to third parties except in limited cases. We do not transfer Gmail data that we receive through the App to others unless: (a) it is necessary to provide or improve those user-facing features, which you authorize when you connect your account, including to service providers we engage (see Sections 4 and 6); (b) it is necessary for security purposes, such as investigating abuse; (c) it is necessary to comply with applicable law or valid legal process; or (d) it is part of a merger, acquisition, or sale of assets, and only with your explicit prior consent.
No advertising use. We do not use Gmail data for serving advertisements, including retargeting, personalized advertising, or interest-based advertising. We do not sell Gmail data or transfer it to advertising platforms, data brokers, or information resellers.
No human reading of your data, except in limited cases. We do not allow humans to read your Gmail data unless: (a) we have your affirmative agreement for specific messages; (b) it is necessary for security purposes, such as investigating abuse; (c) it is necessary to comply with applicable law; or (d) the data, including derivations, has been aggregated and anonymized and is used for internal operations in accordance with applicable privacy and other legal requirements.
No credit or lending use. We do not use or transfer Gmail data to determine credit-worthiness or for lending purposes.
Confi does not use Google user data that it receives through the App to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models.
If you have questions about Confi's Limited Use compliance, contact privacy@confi.ai.
Confi's use of information received from the Microsoft Graph API is governed by Microsoft's applicable terms and is described below.
When Confi accesses your personal Outlook.com data via the Mail.Read scope:
Permitted use. We use Outlook.com mail data to provide and improve the user-facing features of the Confi service described in this Privacy Policy, such as parsing order-related emails to help track orders, return windows, refunds, and subscription renewals.
Sharing. We share Outlook.com mail data only as needed to provide those features (including with service providers we engage, see Sections 4 and 6), to comply with law or valid legal process, for security purposes, or in connection with a merger, acquisition, or sale of assets as permitted by law.
No advertising use. We do not use Outlook.com mail data for advertising or marketing purposes.
Limited human access. We do not allow humans to read your Outlook.com mail data unless you have given affirmative agreement for specific messages, it is necessary for security purposes or to comply with law, or the data has been aggregated and anonymized for internal operations.
Only personal Outlook.com accounts are supported (see Section 2). We do not sell your Outlook.com mail data.
If you have questions about Confi's Microsoft Graph data handling, contact privacy@confi.ai.
The OAuth scopes Confi requests are read-only:
gmail.readonly — classified by Google as a restricted scope. Confi requests it because order-related email content is the data source for the user-facing features described in this Privacy Policy.Mail.Read — a delegated permission that requires your consent. Confi requests it for the same purpose for personal Outlook.com accounts.Scopes that exclude message content, such as metadata-only access, would not provide the order details these features need, because those details appear in the email body. Confi requests read-only access and does not request permission to send, modify, or delete your email.
For questions about how Confi uses these permissions, contact privacy@confi.ai.
When you create an account, we collect:
Purpose: To create and maintain your account and associate your orders with your profile.
When you connect your email account, our backend queries your email provider's API using filters designed to target order-related emails.
For each relevant email, the following process occurs server-side:
What we store: Structured information extracted from your order-related emails, such as retailer, order ID, item details, amounts, dates, tracking numbers, return windows, subscription renewal information, and order state.
What we do not keep in your stored account data: the raw email body, email attachments, or emails that are not order-related.
Lawful basis (GDPR): Contractual necessity — processing your emails is necessary to deliver the service you signed up for (Article 6(1)(b) GDPR). You authorize this access through OAuth consent at your email provider.
Where the App lets you view the original email for an order:
Confi monitors subscription renewal emails as part of its order tracking, for example to detect upcoming renewal dates, price changes, and subscription status changes. This uses the same process described in Section 3.2. We retain the resulting structured subscription information (not the raw email body) while it remains relevant to your account. Subscription information in Confi may not reflect changes you make outside Confi until we detect them or you update it.
We collect limited analytics and diagnostic data through service providers we engage:
If you contact us for support, we collect the content of your support conversations and any information you provide. Support conversations may be processed by a customer-support service provider as described in Section 6.
When our automated, non-AI extraction is not confident enough, or is missing a field, an excerpt of the order-related email may be sent to a large language model ("LLM") for extraction. The excerpt is the subject line and readable body text of the email (which may be shortened).
For mail processed through the App, AI-assisted extraction is performed by an AI service provider that processes the excerpt on Confi's behalf. This applies to order-related excerpts from both Gmail and personal Outlook.com.
Key protections:
Provider-side safety systems. AI providers may operate their own automated safety systems and may retain flagged content for a limited period under their own terms. This is the provider's process, not Confi's.
Backups. Confi may maintain backups of its databases for disaster recovery and operational integrity. Backups expire in the ordinary course.
Deletion timing. When you request deletion of your account, your request starts a waiting period. When the waiting period ends, Confi deletes your data and stored access tokens from its active databases and asks your email provider to revoke its access where it can. Deleted data may remain in backups until those backups expire.
What Confi keeps after deletion is described in Section 11.
| Data Type | Retention Period | Deletion Method |
|---|---|---|
| Structured order data | Until you delete it or your account is deleted | Deletion request (timing per Sections 4A and 11) |
| Raw email body (parsing) | Not kept in your stored data after extraction | Automatic |
| Email body (viewer flow) | Shown for your session; not kept in your stored data | Automatic |
| Account data | Until account deletion | Account deletion request |
| Backups | Limited period, then expire | Automatic per Section 4A |
| Analytics events | Per our service provider's retention practices | Automatic |
| Crash reports | Per our service provider's retention practices | Automatic |
| Support conversations | Per our service provider's retention practices | Request via privacy@confi.ai |
Confi does not sell your personal information, and we do not share it with third parties for their own purposes.
We use service providers (sub-processors) to operate the Service. They process personal data on our behalf. The categories of providers we use are:
| Service Provider Category | Purpose | Data Processed |
|---|---|---|
| Analytics provider | Analytics | Event names and properties |
| Crash reporting provider | Crash reporting | Crash and device data |
| Customer support provider | Customer support | Support conversation content |
| Push notification provider | Push notifications | Device tokens; payloads designed not to contain order content |
| AI service provider | AI-assisted extraction from order emails | Excerpts of order-related email content (the subject line and readable body text, which may be shortened) |
| Cloud hosting and storage provider | Hosting and storage of the Service | Service data |
Our service providers may change as the Service evolves.
Confi and its service providers may process data in the United States. If you are located in the European Economic Area ("EEA"), United Kingdom, or Switzerland, your data may be transferred to and processed in the United States.
Where required, we rely on appropriate safeguards, such as Standard Contractual Clauses ("SCCs") approved by the European Commission, for international data transfers.
If you are located in the EEA, United Kingdom, or Switzerland, you have the following rights under applicable law:
We will respond to data rights requests within the time required by applicable law.
If you are a California resident, you have the following rights under the California Consumer Privacy Act ("CCPA"):
To exercise your rights, contact us at privacy@confi.ai or, where the App offers it, use the App.
Do Not Sell or Share My Personal Information: Confi does not sell or share your personal information as defined under the CCPA, and does not share it for cross-context behavioral advertising.
You may revoke Confi's access to your email at any time through your email provider's account settings (for Google, the third-party apps and connections section of your Google Account; for Microsoft, the apps and services section of your Microsoft Account). Microsoft users can also review and manage app permissions at https://account.live.com/consent/Manage.
When access is revoked (by you or by your email provider):
If you want your stored data deleted after revoking access, request deletion as described in Section 11 or contact privacy@confi.ai.
What happens when you request deletion of your account. Your request starts a waiting period. When the waiting period ends, we delete your account, your orders, your saved data, and the connection to your email account, along with the access tokens for your email account, and we ask your email provider to revoke Confi's access where we can. Deleted data may stay in backups until they expire (see Section 4A).
We may keep de-identified, aggregated information about how our detection performs. Before it is kept, the link to your account is removed. It does not include email content or details that identify you. We maintain this information in de-identified form, and we do not attempt to re-identify it.
We may also keep minimal records, such as a record that an account existed and was deleted, consent records, and security logs, as needed for legal and security purposes.
Confi is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at privacy@confi.ai and we will take appropriate steps to delete the data.
We use reasonable security measures designed to protect your data, including:
No method of transmission or storage is completely secure.
We may update this Privacy Policy from time to time. We will post the updated version and, where required by law, notify you through the App or by other reasonable means. The "Last Updated" date reflects the most recent revision.
For any questions, concerns, or data rights requests:
Confi Technologies, Inc. Privacy Inquiries: privacy@confi.ai Principal Office (mailing): 513 W Shoreview Drive, San Ramon, CA 94582, United States Delaware Registered Agent: Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, DE 19958, United States
Home · Privacy · Terms · Numbers · Founding
Confi Technologies, Inc. · San Francisco Bay Area
← Back to confi.ai · Confi Technologies, Inc., San Francisco Bay Area