Your data is yours. We only touch what we need to stop threats.

Information You Provide

• Account information (name, email, company)
• Payment information (processed securely by Stripe — we never see your card number)
• Domain lists and vendor information you upload
• Support requests and communications
• Detection feedback (your verdict on whether a flagged email is safe or a threat, and an optional reason category)

Gmail / Google Workspace Data

When you connect your Google Workspace account, our automated scanners access the following data to detect phishing and business email compromise threats:

How it works: Email content is loaded into our scanner's temporary memory, analyzed for threats, and immediately discarded — typically within seconds. Only the scan result (who sent it, threat level, action taken) is saved. The email itself is never written to disk, database, or logs.

Google OAuth Scopes Requested

When connecting a Google Workspace tenant, Spoof Defense requests the following OAuth scopes:

• gmail.modify — read incoming messages (headers, body, attachments) for phishing analysis, apply security labels, and optionally move detected phishing to quarantine or spam per administrator policy. We never compose or send mail.
• gmail.labels — create and maintain the SuspectedSpoof label and any administrator-configured quarantine labels.
• admin.directory.user.readonly — enumerate enrolled mailboxes during tenant onboarding so the administrator can pick which to protect.
• admin.directory.domain.readonly — verify the administrator owns the claimed Workspace domain and discover alias domains.
• userinfo.email — identify the administrator account that authorized the integration.

We do not request gmail.send, gmail.compose, or any directory-write scope. When you disconnect, Spoof Defense calls Google's OAuth revoke endpoint to invalidate the refresh token immediately.

Modifications We Make to Your Mailbox

When a malicious message is detected, Spoof Defense modifies the affected message using the Gmail or Microsoft Graph API by:

• Adding a label (e.g., SuspectedSpoof) so the recipient and any downstream filters can identify the threat.
• Optionally moving the message to a quarantine label or the spam/junk folder, per the tenant administrator's configured policy.
• Optionally inserting administrator-configured trust banners on legitimate vendor email so end users can identify authentic senders.

We never compose new messages, never send mail on behalf of users, and never delete email. Alert notifications about detected threats are sent from Spoof Defense's own email infrastructure (noreply@spoofdefense.com), not from your tenant.

Microsoft 365 Data

The same access, usage, retention, and sharing policies described above for Google data apply equally to Microsoft 365 connections. Microsoft Graph API tokens are stored encrypted and revoked upon disconnection.

Information Collected Automatically

• Log data (IP address, browser type, pages visited)
• Usage data (API requests, features used)
• Device information (operating system, device type)
• Cookies and similar technologies

• Provide and maintain the email protection service
• Detect phishing, spoofing, and business email compromise threats
• Process payments and manage subscriptions
• Send important service notifications
• Respond to support requests
• Improve and optimize threat detection accuracy
• Improve detection accuracy based on your feedback and anonymized, aggregate patterns across all customers
• Detect and prevent fraud or abuse of our platform
• Comply with legal obligations

We do not sell your personal information. We may share limited information with:

Anthropic AI Peer Review is disabled by default. The tenant administrator must enable it explicitly in tenant settings. When enabled, only a redacted excerpt of suspicious messages is sent to Anthropic under a zero-retention data processing agreement; Anthropic does not store or train on the data.

Limited Use of Google API Services User Data

Spoof Defense's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Google user data is used only to provide and improve user-facing features within the Spoof Defense product (phishing detection, labeling, quarantine).
• Google user data is not transferred to any third party other than as necessary to provide or improve user-facing features, comply with applicable law, or for security purposes (e.g., investigating abuse).
• Google user data is not used for serving advertisements, including personalized or retargeted advertising.
• No human at Spoof Defense reads Google user data unless: (a) we have the user's explicit affirmative consent, (b) it is necessary for security purposes (e.g., investigating a bug or abuse), (c) it is necessary to comply with applicable law, or (d) the data is aggregated and used for internal operations in compliance with the Limited Use requirements.

Google Data Restrictions

• Google user data is never sold to third parties
• Google user data is never used for advertising or ad targeting
• Google user data is never used to train AI models
• No human reviews email content unless explicitly requested by the account holder
• If AI Peer Review is enabled (opt-in only, off by default), a sanitized excerpt is sent to Anthropic under their zero-retention data processing agreement
• Threat-intelligence providers (VirusTotal, CrowdStrike) supply data inbound to Spoof Defense — they do not receive customer email content or hashes derived from customer data

We implement industry-standard security measures to protect your data:

You may request deletion of all your data at any time by contacting support@spoofdefense.com. We process deletion requests within 30 days.

Depending on your location, you have the right to:

We use first-party cookies only for authentication, security, and product analytics. We do not use third-party cookies, advertising cookies, or cross-site tracking.

You can opt out of product analytics while keeping essential cookies by visiting Your Privacy Choices. Browser-level controls also work.

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for such transfers, including standard contractual clauses where required.

For EU Residents (GDPR)

We act as a data controller. Our legal basis for processing includes contract performance, legitimate interests, and consent where applicable. You may exercise your GDPR rights by contacting support@spoofdefense.com.

For California Residents (CCPA / CPRA)

You have the right to know what personal information is collected, request deletion, limit sensitive information use, and opt out of any sharing of personal information for cross-context behavioral advertising. We do not sell personal information and we do not engage in cross-context behavioral advertising. Exercise your rights at Your Privacy Choices.

Children's Privacy

The Service is not intended for children under 13 (under 16 in the EU). We do not knowingly collect information from children under those ages.

For questions about this Privacy Policy or to exercise your rights: