Privacy Policy

Last updated 15 September 2026

Renavo is a customer support platform for e-commerce merchants. A merchant connects their support Gmail mailbox and their Shopify store, and Renavo brings support threads together with the matching orders so the merchant’s own team can answer them — with a draft reply prepared for them, and with a person approving anything that leaves the system.

This policy explains what Renavo collects, why, who else it reaches, and how to get it deleted. It describes what the software does today. Where something is not yet decided or not yet built, this policy says so rather than describing an intention as if it were a control.

1. Who this policy is for

Two groups of people appear in Renavo, and the distinction matters throughout this document:

• Merchants — the businesses that hold a Renavo account, and the members of their organizations. Renavo is the controller of their account data.
• The merchant’s customers — the people who email a merchant’s support address. Renavo processes their messages on the merchant’s behalf and under the merchant’s instructions. If you are a customer of a merchant who uses Renavo, contact that merchant first; they decide what happens to their support records.

2. What Renavo collects

Account and organization data

Your email address and an authentication credential, held by Renavo’s authentication provider; the name and URL slug of each organization you create; your role and status within it; and invitations you send or receive.

Gmail data, when you connect a mailbox

Connecting Gmail is optional, is done by an owner or admin, and applies to one mailbox per organization. When connected, Renavo stores, for messages in that mailbox:

• The From, To and Subject headers, and Gmail’s own timestamp for the message.
• The message body as plain text only, truncated at 32,000 characters. An HTML-only message is converted to text on Renavo’s server before it reaches the database.
• Gmail’s thread and message identifiers, so a re-sync updates a conversation in place instead of duplicating it.
• A flag recording whether the message had attachments, and the address of the connected mailbox.

What Renavo does not store from your mailbox: no HTML, no attachments (they are never downloaded, and Renavo operates no file storage for them), no raw MIME payload, and no headers other than the four named above. The first sync covers roughly the last 30 days and is capped at a few hundred messages; after that Renavo reads Gmail’s own change feed rather than re-scanning the mailbox. A merchant may additionally ask Renavo, with explicitly stated consent and a period and cap they choose, to read older mail once — a history import that stores the same four headers and text bodies, nothing more, and can be cancelled at any time.

Shopify data, when you connect a store

Renavo requests two Shopify scopes, and no others:

• read_orders — to read your orders. Renavo stores a copy of your recent orders (order name, date, totals, financial and fulfilment status, line items and the customer email) so a support thread can be matched to the order it is about.
• write_returns — used only by Renavo’s return-request workflow, and only for a return an owner or admin of your organization has approved. A return request is subject to the same approval and execution safeguards as a reply: it is bound to the exact order and item approved, re-checked immediately before the request is made, and never retried.

A return request asks your store to record a requested return. Renavo does not issue refunds, cancel orders, change inventory, fulfil orders, or approve, decline, process or close a return. You still approve the return in Shopify Admin, and refunding is a separate decision you make there. Renavo requests no other Shopify write permission of any kind.

Content you create in Renavo

Knowledge base documents you write, the structured support policies you configure, and the approval decisions your members make.

Records of what Renavo did

For each AI draft: which model and prompt version ran, how many tokens were used, which knowledge passages were retrieved, which policy applied, the outcome, and the draft text itself. Renavo does not store the assembled model input, any provider payload, or any model reasoning — the record keeps references, not a second copy of your customer’s mail.

3. Google user data, and Limited Use

The scopes Renavo requests, and why

https://www.googleapis.com/auth/gmail.readonly

To read the support mailbox you connect, so that Renavo can show the thread, match the customer to their orders, and prepare a draft reply with the conversation in view. There is no narrower Gmail scope that returns message bodies, which is what a support reply has to be based on. Renavo reads only this mailbox, and only the messages in it.

https://www.googleapis.com/auth/gmail.send

To send one specific reply that a member of your organization has already read and approved. This scope cannot read, list, label, archive or delete anything — it can only send. Renavo requests it rather than gmail.compose or gmail.modify, both of which are broader than sending a reply requires.

Renavo requests no other Google scope. It does not request access to Google Contacts, Calendar, or Drive.

How sending is limited

A send is not something Renavo decides to do. An owner or admin of your organization approves an exact message body, to an exact recipient, on an exact thread; that approval is bound to a cryptographic fingerprint of what was approved, and the fingerprint is re-checked immediately before the message goes out. If the draft changed, or a newer message arrived on the thread, the send is refused rather than adjusted. No AI model runs after approval — the approved text is sent verbatim. Nothing is ever re-sent automatically, for any reason.

A mailbox connected before Renavo supported sending holds the read-only scope alone and does not gain the send scope retroactively. Reconnecting is what grants it, and you see the scope on Google’s consent screen when you do.

Limited Use commitments

• Gmail data is used only to provide and improve the support workflow inside your own Renavo organization — showing threads, matching orders, preparing drafts, and sending replies you approve.
• Gmail data is never used for advertising of any kind, and is never sold, rented, or traded.
• Gmail data is never used to develop, improve, or train generalized or non-personalized AI or machine learning models. Renavo trains no models of its own. Where Renavo sends message content to a model provider, it does so only to produce a draft reply for that one request in your own organization, and for no other Renavo purpose — what that provider does under its own terms is described in its own policies, not claimed here.
• Gmail data is not transferred to any party except the service providers listed in section 4, and only as needed to provide the feature you are using.
• Renavo staff do not read the content of your Gmail messages, except where you explicitly ask us to in order to resolve a problem you have reported, where it is strictly necessary for security or to investigate abuse, or where the law requires it. Renavo operates no internal interface for browsing merchant data; access is limited to the operators who run and repair the service.

4. Who else your data reaches

Renavo uses the service providers below. This list reflects the services Renavo’s code actually contacts, and what it describes is what Renavo sends, when it sends it, and for what Renavo purpose. How each provider then handles that data is governed by its own terms and policies; Renavo makes no claim about them here.

• Supabase — hosted PostgreSQL and authentication. Everything described in section 2 is stored here.
• Google — the Gmail API, for the mailbox you connect. This is your own account.
• Shopify — the Admin API, for the store you connect. This is your own account.
• Anthropic (Claude) — used to generate a draft reply, when a member of your organization asks for one. It receives: the thread subject; up to 12 messages from that thread, each capped at 2,000 characters and labelled as coming from the customer or the merchant; up to 5 candidate orders (order name, date, financial and fulfilment status, cancellation flag, and a total rendered as text); up to 6 passages from your knowledge base with their document titles; your resolved support policy; and — only once an owner or admin of your organization has switched examples on — up to 3 past exchanges from your own mailbox, each a customer message and the reply your team sent, each half capped at 700 characters, with e-mail addresses, links and long digit sequences replaced by placeholders and quoted history removed. It does not receive database identifiers, Gmail message or thread ids, any provider identifier, tokens or credentials, raw provider payloads, HTML, attachments, customer postal addresses, payment details, or your own mailbox address.
• Voyage AI — used to compute the numeric representations that make knowledge search work. It receives the text of knowledge base documents when they are indexed; — when a draft is requested — up to the first 1,000 characters of the most recent inbound customer message, as the search query; and, once examples are switched on, the customer’s half of each example (up to 4,000 characters, with the same placeholders) when it is indexed.
• Cloud hosting providers — Renavo’s web application and its background workers run on third-party cloud infrastructure. The specific providers for the production environment are not finalised and are therefore not named here; this page is updated when they are.

Renavo does not sell personal data, does not share it with advertisers, and runs no advertising or third-party analytics on this site or in the product.

5. How your data is protected

• OAuth tokens are encrypted before they reach the database — AES-256-GCM, with the encryption key held in the server environment and never in the database. Each ciphertext is bound by its authenticated data to the provider and the organization it belongs to, so a token copied into another organization’s row fails to decrypt rather than silently working. Gmail and Shopify use separate encryption keys, so one compromised key does not open both.
• Credentials are stored in a database schema that the API cannot reach. There is no HTTP request — with any key — that returns a stored token, and a decrypted token exists only inside Renavo’s background worker processes, never in a page or an interactive request.
• Every table enforces row level security with per-operation policies, so one merchant’s organization cannot read or write another’s rows. This is verified by an automated test suite that runs against a real database on every change.
• Traffic to Renavo and to every provider above is encrypted in transit (TLS).
• Messages are minimised before storage rather than after: no HTML, no attachments, no raw payload, bounded bodies. The strongest control here is what is never kept.

No system is perfectly secure, and Renavo does not claim to be. What is described above is what the code enforces.

6. How long data is kept

Renavo does not yet operate a general retention or deletion schedule for your data. Three automated deletions apply to Renavo’s own operational records only: the numbers describing how the assistant performed on a message (never any text) are deleted after 400 days; the text of a shadow draft is erased when it is compared with your own reply, or after 14 days; and the record of a shadow draft is deleted after 60 days, keeping only its numbers. Renavo will publish a defined retention period for everything else here before it is offered generally. Until then, how long something is kept depends on what it is:

• Gmail-derived content — conversations, messages, and the drafts, approvals and send records attached to them — is kept only while the mailbox connection it came through is still present. Removing that connection removes them too; see section 7.
• Mirrored Shopify orders, knowledge documents and policies are kept for as long as your organization exists, and are deleted when you ask (section 8).

What limits collection today is scope, not time:

• The first Gmail sync reaches back roughly 30 days, not further. Older mail is read only when an owner or admin of the merchant explicitly requests a history import, states the merchant’s consent, and chooses the period and the number of conversations; that import reads the requested period once, can be cancelled at any time, and is tied to the mailbox connected at the time of the request.
• Message bodies are truncated at 32,000 characters.
• Only one mailbox and its own messages are read — never another mailbox, never your whole Google account.
• Disconnecting Gmail deletes Renavo’s stored credential immediately.

7. Disconnecting Gmail

An owner or admin can disconnect at any time, from Settings → Integrations → Disconnect Gmail inside your organization. That deletes Renavo’s stored Gmail credential. Renavo stops reading and stops sending immediately; there is no stored token left to use.

Disconnecting is not a pause. Deleting the connection also deletes everything ingested through it: the conversations and messages from that mailbox, and the drafts, approval requests and send records attached to those conversations. They are removed together with the credential, in the same operation. Nothing has to be requested for that to happen, and it cannot be undone — so export anything you still need before you disconnect.

One thing can delay a disconnect, briefly. If a reply is still being sent, or a reply’s delivery outcome is not yet known and nobody has reviewed it, Renavo refuses the disconnect until that is settled. Deleting those records is what makes it possible to send the same customer the same reply twice, so we keep them until an owner or admin has seen the outcome or marked it as reviewed on the Approvals page. Both are in your hands and neither needs us. This is a step in a self-serve control, not a limit on the deletion you can request below.

Disconnecting in Renavo does not itself revoke Renavo’s access at Google — Renavo cannot call Google’s revocation endpoint, because doing so would require holding a decrypted token in an interactive request, which its architecture forbids. To remove the grant at Google as well, visit your Google account’s third-party access settings. Revoking there also works on its own, and has the same effect on your data: once Google stops renewing access, Renavo marks the connection as needing to be reconnected, cancels any reply that was still waiting to be sent, and deletes its stored credential — and the conversations and records ingested through it are removed with it, exactly as on a disconnect. The same exception applies as above: if a reply is still being sent, or its delivery outcome is not yet known and nobody has reviewed it, Renavo keeps those records — and the credential row, which Google has already made unusable — until an owner or admin has seen the outcome or marked it as reviewed on the Approvals page. Reconnecting the same mailbox restores access to those conversations rather than starting over.

8. Access, correction, and deletion

Email privacy@renavo.io from the address on your Renavo account. You can ask for a copy of your organization’s data, a correction, or its deletion.

You do not need to ask us to remove Gmail-derived content. Disconnecting Gmail — or revoking Renavo’s access at Google — already deletes the conversations, messages, drafts, approvals and send records from that mailbox, along with the credential, as described in section 7. That is the fastest route, and it is entirely in your hands.

Disconnecting is a product control; a deletion request is a separate thing, and nothing here limits it. The in-flight check described in section 7 governs the Disconnect Gmail button and the automatic removal that follows a revocation at Google — the two self-serve paths. It is short-lived, it clears as soon as a reply settles or an owner or admin marks an unknown outcome as reviewed, and it never applies to a request sent to the address above.

A request to privacy@renavo.io covers your organization and account records, your knowledge documents, the address of a mailbox that was previously connected, and anything else not reachable through the controls described above. Those are removed by Renavo’s operators, which is stated plainly rather than implied to be instant.

Deleting a store is itself a self-service deletion, for the data scoped to that store. An owner can delete a store from the Stores page, and doing so permanently removes that store’s Shopify connection, its mirrored orders, its support policies, and the return approvals, decisions and execution records kept as an audit trail. It applies to that store only: other stores, and anything ingested from Gmail, are untouched. Renavo refuses the deletion while a return is queued, being processed, or has an outcome nobody has reviewed yet — those records are what stop the same return being requested twice, so they are kept until an owner or admin has seen the outcome or marked it as reviewed. A request to the address above remains a separate process and can cover more than this control reaches.

If you are a customer of a merchant who uses Renavo and you want your support history removed, ask that merchant. They control their support records; Renavo processes them on their instructions and will act on a request the merchant passes on.

9. Children

Renavo is a business tool and is not directed at children. Renavo does not knowingly collect data from anyone under 16 as a Renavo account holder.

10. International transfers

The service providers in section 4 operate internationally, and data processed by Renavo may be handled outside the country you are in. The specific hosting regions for the production environment are not finalised and will be stated here once they are.

11. Changes to this policy

This page is updated when the product changes what it collects, why, or who it reaches. The date at the top is the date of the last change. A change that materially widens what Renavo does with Gmail data will be notified to affected merchants, and a widened Google scope requires you to reconnect and approve it on Google’s own consent screen — Renavo cannot grant itself more access than you approved.

12. Contact

Privacy, data access and deletion: privacy@renavo.io
Everything else: support@renavo.io

See also the Terms of Service.