Privacy policy

Last updated October 29, 2026

Pammy (pammy.ai) is a personal assistant you use on WhatsApp: an agenda with reminders and routines, an AI assistant that works with your documents and files, images, websites, your accounts on other websites when you ask and, if you choose, Gmail. This policy explains what Pammy handles, why, who processes it and how long it is kept.

What Pammy keeps

• Your WhatsApp number and the name on your WhatsApp profile, which becomes the name of your Pammy account.
• Your appointments, reminders, notes, routines and email alert rules, until you remove them.
• Your recent conversation with Pammy (the last 12 exchanges) so it can follow up. It is cleared after 24 hours without messages.
• The requests you send while Pammy works on them. Their text is removed after a day and the rest after 7 days.
• Files you send and files Pammy makes for you, for 7 days (see below).

Messages reach Pammy through ManyChat and WhatsApp (Meta). Pammy runs on Supabase, which stores its database and files.

Gmail

Gmail is optional. When you connect it, you give Pammy two permissions on Google’s screen: to read your email and to send email on your behalf. Pammy cannot delete, archive, label or change your mail.

How Pammy uses your Gmail data

• When you ask in WhatsApp: to search, list, open and summarize your emails, to save attachments you ask for, and to write replies and new emails.
• Email alerts: about every two minutes, Pammy checks new messages in your inbox to tell you on WhatsApp when one you asked about arrives (“tell me when the bank emails me”). For this check it reads only the sender, subject, date and Gmail’s short preview, not the full email.
• Important emails: with the same check, at most once a day, Pammy may point out an unread email that looks clearly important. It is on when you connect Gmail. Tell Pammy “stop telling me about important emails” to turn it off.
• Understanding your email: so Pammy knows what matters to you and can help at the right moment, it reads your new inbox emails, and once, when you connect, your recent and important emails of the last 60 days. It never reads promotions, social or forum emails. From them it writes short notes, for example “Your Ejari certificate expires on 31 October (Dubai Land Department, 25 October)”, with a link to the email. Pammy uses these notes when you talk to it, and now and then, at most once a day, it may ask you about one that’s coming due. It is on when you connect Gmail. Tell Pammy “stop learning from my email” to turn it off and delete the notes.
• Routines you set up: for example a daily summary of your unread email, sent to you on WhatsApp or to your own address.
• Signing in to websites for you: when you ask Pammy to do something on a website and that site emails you a sign-in code or link, Pammy reads that email to finish signing in. It reads only emails from that site that arrive while it works on your request, and uses only the code or link.

Sending email

Pammy sends an email only after showing you the exact recipients, subject, text and attachments in WhatsApp and you approve that email. A scheduled email (for example, the same request to your accountant every Wednesday) and an outreach routine are approved once, with their recipients or who to contact, and their schedule. Each time, Pammy then sends that same approved email and tells you on WhatsApp.

What Pammy keeps from Gmail, and for how long

• Your Gmail address and Google’s access tokens, encrypted (AES-256), until you disconnect.
• The emails you are working with in the conversation, and an unsent draft: removed within about an hour once you stop.
• While Pammy works on a request, the emails it read for that request. They are deleted when it finishes, at most a day later.
• For email alerts: the sender, subject and preview of the emails Pammy told you about, for 30 days.
• Notes about what matters in your email (a sentence each, with the sender, subject, date and the email’s ID), for 90 days, at most 300, and a list of which emails were already read for notes, for 90 days.
• Attachments you ask Pammy to save: 7 days, like other files.
• What Pammy told you about your emails stays in your recent conversation, which is cleared after 24 hours without messages.
• A record that an email was sent (without its content), for 30 days.
• A one-way fingerprint of your Gmail address, to count connected accounts as Google requires.

Pammy does not keep a copy of your mailbox.

Who processes your Gmail data

• OpenAI: Pammy’s AI models read the emails involved in your request, the sender, subject and preview of new emails for alerts, and the emails Pammy reads to write its notes about what matters to you, to answer you, write drafts, decide whether to alert you and write those notes. Pammy uses OpenAI’s API with storage turned off, and OpenAI does not train its models on this data.
• Pammy’s web agent: when you ask Pammy to do something on a website, the sign-in code or link from that site’s email goes to OpenAI’s Codex running on servers Pammy operates, with model training turned off (see “Your accounts on websites”).
• Pammy’s file specialist: when you ask Pammy to make or change a file using an email or an attachment, the facts and files needed go to OpenAI’s Codex running on servers Pammy operates, with model training turned off. The job’s files are deleted when it ends.
• ElevenLabs: only if you ask for voice replies, the text of the reply is turned into speech.
• ManyChat and WhatsApp (Meta): deliver Pammy’s replies and alerts to you.
• Supabase: hosts Pammy’s database and files.

Limited Use

Pammy’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Pammy uses Gmail data only to provide the features described above. It is never used for advertising, never sold, and never used to develop, improve or train generalized AI or machine-learning models. People at Pammy do not read your email, except with your permission (for example to help you with a problem), for security, or when the law requires it.

Questions, documents and files

When you ask a question, or ask Pammy to write, create or change a document or work with a file, your request, your recent conversation and the content involved are sent to OpenAI with storage turned off. Work on files runs in OpenAI’s temporary sandbox or with Pammy’s file specialist (above); the files are copied there for that task only. For current information Pammy may search the web.

Files you send in WhatsApp, and email attachments you ask Pammy to save, are kept with their text for 7 days (at most your 20 most recent). Files Pammy makes for you are available through a private link for 7 days and are then deleted.

When you ask Pammy for a website, your instructions and the files you choose go to Lovable, which builds and hosts the site.

Your accounts on websites

When you ask, Pammy can work for you on other websites: check an order, a booking or a bill, download an invoice, fill in a form, or prepare a purchase, a booking or a cancellation. It uses a browser of your own on Pammy’s servers, which keeps your sign-ins between requests, like your own browser does.

• Pammy signs in with your email address, using the code or link the site emails you (see Gmail above). It never asks for your passwords, card numbers or bank details, and never types them.
• Anything final, such as paying, ordering, booking, sending a message, cancelling or changing your account, happens only after Pammy shows you the details in WhatsApp and you approve it. Pammy never moves money between people or accounts.
• While it works, OpenAI’s Codex (running on servers Pammy operates, with model training turned off) sees the pages of that site and does only what you asked. Pages and emails are treated as information, never as instructions.
• What Pammy keeps: your browser’s data (the sign-ins and cookies of the sites it used for you), only on Pammy’s server and only for you, and a list of those sites with the dates it used them. Screenshots and downloads it sends you are kept like other files, for 7 days.
• Your browser is deleted after 60 days without use, when you tell Pammy “sign out of everything”, or when you delete your account.

Security

Everything travels encrypted (HTTPS). Google tokens are encrypted with a key kept outside the database, and only Pammy’s own services can read them. Access to Pammy’s systems is limited to what each part needs.

Your choices

• Send DISCONNECT GMAIL in WhatsApp to remove Pammy’s Gmail access. Pammy revokes it with Google and deletes your tokens, the emails it was keeping for alerts, its notes about your email, the email attachments it saved and your recent conversation. Your alert rules and routines stay so they work again if you reconnect: ask Pammy to stop them, or ask it to delete them.
• You can also remove Pammy at myaccount.google.com/permissions. Pammy deletes the same data as soon as it notices the access is gone.
• Tell Pammy “sign out of everything” to delete your browser on Pammy’s server and the list of websites it used for you.
• Send STOP to stop WhatsApp messages.
• To ask what Pammy keeps about you, or to delete your account and its data, message Pammy on WhatsApp. We answer within 30 days.