Privacy Policy – Hemut CoPrivacy Policy - Hemut Co

a. What QuoteFlow Does With Gmail Access

QuoteFlow is Hemut’s freight document automation feature. When you connect your Gmail account, QuoteFlow monitors your inbox for incoming load request emails from shippers. When a load request is detected, QuoteFlow extracts the relevant load details, automatically creates a load order in your Hemut account, and sends a quote reply to the shipper on your behalf — eliminating manual data entry and response time.

Here is the exact sequence of what happens when an email arrives in your connected Gmail inbox:

• 1. Push notification received. Google sends a real-time notification to QuoteFlow’s servers whenever a new email arrives in your inbox. This notification contains only your Gmail account identifier and a history marker — no email content.
• 2. Email metadata fetched. QuoteFlow uses the gmail.readonly scope to retrieve the new email’s subject line, sender address, and body text.
• 3. AI classification. The subject line and body text are sent to Google Gemini to answer one question: is this a rate confirmation or load request email? If the answer is no, processing stops immediately — the email is not read further, not stored, and not acted on.
• 4. PDF extraction (rate confirmations only). If Gemini classifies the email as a rate confirmation, QuoteFlow fetches the full email message using the gmail.readonly scope and extracts the PDF attachment from it. The PDF is held in memory only — it is never written to disk.
• 5. Order creation. The PDF bytes are forwarded over HTTPS to Hemut’s order processing system, which parses the document and creates a load order. The PDF is not stored by QuoteFlow after forwarding.
• 6. Label applied. QuoteFlow uses the gmail.modify scope to apply a status label to the email in your Gmail inbox — either QuoteFlow/Approved (order created successfully) or QuoteFlow/Review Pending (could not process automatically, requires your attention). No other change is made to the email — it is not moved, deleted, archived, or marked read/unread.
• 7. Quote reply sent. QuoteFlow uses the gmail.send scope to automatically reply to the shipper’s email with a quote containing the original load details and your offered rate for the lane. The reply is sent from your connected Gmail address. No other emails are sent on your behalf.

The entire process — from notification to quote reply — is fully automated and typically completes within a few seconds of the email arriving.

b. Gmail Scopes We Request and Why

• gmail.readonly (active): To read incoming email subjects, body text, and PDF attachments for rate confirmation detection and extraction.
• gmail.modify (active): To apply QuoteFlow status labels (Approved, Review Pending) to processed emails so you can track document status in Gmail.
• gmail.send (active): To automatically send a quote reply to the shipper on your behalf. The reply contains the load details from the shipper’s original request and the rate your account has configured for that lane.

c. What Gmail Data Is and Is Not Stored

• Email subject line and sender address: used for rate confirmation classification. Not stored — discarded after classification.
• Email body text: used for rate confirmation classification via Gemini AI. Not stored — discarded after classification.
• PDF attachment bytes: forwarded to the order processing system. Not stored — forwarded in memory, never written to disk.
• Gmail message ID: used for tracking processing state and applying labels. Stored in Hemut’s database.
• Gmail thread ID: used for tracking conversation context for quote replies. Stored in Hemut’s database.
• OAuth access and refresh tokens: used for authenticating Gmail API calls on your behalf. Stored — encrypted at rest, deleted on disconnect.

We do not read, store, or process personal correspondence, promotional emails, newsletters, or any email not classified as a rate confirmation or load request. We do not perform any scan of historical emails. Only emails that arrive after you connect your account are ever accessed.

We do not sell, rent, transfer, or share Gmail data with any third party for advertising, profiling, or any purpose outside of operating the QuoteFlow service.

d. How to Disconnect Gmail

You can revoke QuoteFlow’s Gmail access at any time:

• In QuoteFlow: Go to Settings → Integrations and click Disconnect Gmail. Your OAuth tokens are deleted from our systems immediately.
• Directly in Google: Visit myaccount.google.com/permissions and remove Hemut / QuoteFlow from your connected apps.

After disconnection, QuoteFlow immediately stops monitoring your inbox, no further emails are read or replied to, and all OAuth tokens are permanently deleted from our systems within 24 hours. Gmail labels already applied to your emails remain visible in Gmail — you can remove them manually at any time.

e. Security of Gmail Credentials

OAuth tokens are protected as follows:

• Encrypted at rest using AES-256 via Google Cloud Secret Manager
• Transmitted only over HTTPS — never over unencrypted connections
• Never written to application logs or error tracking systems
• Never shared with any third party
• Scoped to the minimum permissions required — we request only the three scopes listed above and nothing else