Privacy Policy

Last updated: August 31, 2026 · Applies to the KarDeli desktop app, the KarDeli email plugin, and kardeli.ir

This policy explains what personal data the KarDeli services ("KarDeli", "we") process, why, and what rights you have. It covers the KarDeli desktop application, your account on kardeli.ir, and the KarDeli Gmail/Email integration.

1. Who we are

KarDeli is an AI development/assistant application operated by the KarDeli team. Contact: support@kardeli.ir.

2. Data we process

• Account data — when you create a KarDeli account (by phone number with OTP, or with Google Sign-In), we store your phone and/or email, display name, profile picture, preferred language, and account status.
• Billing data — prepaid credit balance and transaction records for paid features.
• Google Sign-In data — if you use "Sign in with Google", we receive your Google account name, email address, and profile picture (scopes openid email profile) to create and identify your account.
• Gmail data — if you connect a Gmail account to the KarDeli email feature, we request the scope https://mail.google.com/ to read, search, and send email at your direction, inside your own desktop app. We also process OAuth tokens required for that access.
• Technical data — request logs (IP address, timestamps) needed to operate and secure the service.

3. Where your Gmail data and tokens live

4. Why we process it (legal bases)

• To provide the service you requested (performance of a contract) — account management, credit billing, the email integration.
• Based on your consent — accessing your Gmail via OAuth (you can revoke at any time).
• To secure and operate the service (legitimate interests) — abuse prevention, rate limiting, logs.

5. Google User Data — Limited Use disclosure

KarDeli's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, KarDeli:

• does not sell your Google user data;
• does not use Gmail data for advertising or ad targeting;
• does not allow humans to read your Gmail data, except with your explicit consent or for security/legal reasons permitted by that policy;
• does not use Gmail data to train generalized AI or machine-learning models.

6. Sharing

We do not sell personal data. We share it only with: Google (for sign-in and the Gmail API, under Google's terms), infrastructure providers that host kardeli.ir and its API (under confidentiality obligations), and authorities where required by law.

7. Retention & deletion

• Removing a connected email account in KarDeli deletes the locally stored tokens. If you used the server-brokered flow, the stored Gmail token is deleted from our database at the same time (and you can also trigger deletion from the app's disconnect action).
• You can revoke KarDeli's access at any time at myaccount.google.com/permissions — we then delete the revoked token server-side.
• Account data is retained while your account is active; deleting your account deletes your personal data, except records we must keep by law.

8. Security

Traffic is encrypted in transit (HTTPS/TLS). Long-lived tokens are never embedded in the desktop app; on the server, only hashed API tokens are stored and Gmail refresh tokens are access-restricted.

9. Your rights

You may request access, correction, export, or deletion of your personal data, and object to processing, by contacting support@kardeli.ir. If you are in the EEA/UK, you may also lodge a complaint with your supervisory authority.

10. Children

KarDeli is not directed at children under 13 (or the equivalent minimum age in your jurisdiction) and we do not knowingly collect their data.

11. Changes

We will post any changes to this policy on this page with a new "Last updated" date, and will notify material changes in the app or by email.

devops724@gmail.com