Gmail Connection Consent

Google OAuth and Limited Use. Version 1.3 · Unpublished draft · No effective date has been set.

NOT READY FOR PUBLICATION. Every field marked ACTION REQUIRED must be completed by the owner and the scope inventory in Section 4 verified against the actual Gmail API calls before Google verification is submitted. Version 1.2 has not been changed or replaced.

1. What connecting Gmail means

Connecting Gmail allows Pennny to access selected Gmail data through Google OAuth so it can provide the Gmail-based features you knowingly choose.

Gmail connection is optional. You can use the Pennny functions that do not depend on Gmail without connecting it, and you can disconnect it later.

Connecting Gmail is separate from accepting the Terms of Service; starting your free week or subscribing to Premium; sending a claim and its Success Fee; giving a SEPA mandate; connecting a bank; and consenting to marketing messages.

2. What Pennny uses Gmail for

Discovering and evidencing Opportunities. Pennny may search permitted Gmail data to identify possible refunds, compensation, reimbursements or reversible charges; find messages, receipts, tickets, invoices, confirmations and attachments relevant to an Opportunity; extract dates, amounts, merchants, references and deadlines; connect related messages into an evidence timeline; prepare a draft claim or response; and follow the reply thread on a claim you approved.

On the first connection Pennny looks back up to 36 months, then reads only new mail.

When you approve a letter, Pennny sends it from your own mailbox on your instruction, and then reads the replies to that thread so it can tell you what the company said and draft your next step. Following the answers to a letter you asked Pennny to send is part of the service you requested.

Checking whether a claim paid out. Pennny also uses what it reads to find out whether a claim succeeded. If a company writes to say it has paid you, Pennny records that and, once the payout is established, charges its fee: 30% of what the company pays you, plus 21% VAT. This is a separate purpose from finding you money: it serves Pennny's commercial interest rather than yours, so Pennny relies on legitimate interest (Article 6(1)(f)) for it and you can object — see Section 11.

No email moves money by itself. Before any direct debit, Pennny sends you a notice at least 2 days ahead, with a "This is wrong" button that pauses it. An amount that does not match what was expected stops for review instead of becoming an invoice. If a company says it paid you and the money never arrived, tell Pennny and the fee is cancelled.

3. Data Pennny may access

Depending on the scopes and the feature you select, Pennny may access message and thread identifiers; sender and recipient details; subject lines and timestamps; message text; attachments; labels and mailbox metadata needed for the feature; and derived facts such as merchant, purchase, amount, deadline and evidence relevance. Lists in the app show the sender and the subject cut to 60 characters; Pennny does not store complete message bodies.

Pennny does not request a Gmail permission broader than necessary. The consent screen, this notice, the Privacy Policy and the Google Cloud configuration list the same scopes.

4. Exact scopes

These are the scopes in the application's configuration (GOOGLE_MAILBOX_SCOPES). Engineering must verify them against the actual Gmail API calls before Google verification.

Scope	Purpose	Sensitive / restricted	Needed at launch
https://www.googleapis.com/auth/gmail.readonly	Opportunity discovery, evidence retrieval, and reading replies on a thread you approved	Restricted	Yes
https://www.googleapis.com/auth/gmail.send	Sending a message you approved, from your own mailbox	Sensitive	Yes

Pennny does not request full mailbox access if a narrower read-only or metadata scope supports the feature, and does not request delete permissions.

5. Prominent disclosure

The disclosure shown immediately before the Google OAuth flow is a consent artefact with its own versioned source, because its exact wording is recorded with each customer's consent. It is not reproduced here — one copy, one place to change.

Source of truth: content/consent/gmail-disclosure.1.3.md.

6. What Pennny records before you connect

Before the Google OAuth screen, Pennny records that you saw and acknowledged: the data categories requested; what Pennny uses them for; that Gmail connection is optional; that only a claim you send can create the 30% fee and the 12-month period; that Gmail can be disconnected; that deletion is separate from disconnection; that AI analysis may be inaccurate; and where to find the Privacy Policy and the Terms.

An acknowledgement is not a substitute for a GDPR legal basis or Google OAuth authorisation.

7. Use limitations

Pennny will use Gmail data only for disclosed, permitted and lawful features. Pennny will not sell Gmail data; use it for advertising; transfer it to data brokers; use it to build advertising profiles; request permissions for features that are not implemented; read messages unrelated to the supported purposes beyond what is technically unavoidable and minimised; allow broad staff access to Gmail content; or use Gmail data to train a general-purpose AI model.

Pennny's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

8. Human access

Human access to Gmail-derived data is restricted. It may occur only where permitted by Google's policies and applicable law: when you affirmatively request support and authorise access to the relevant case; for security or abuse investigation; to comply with law; or where necessary for Pennny's internal operations and allowed under the applicable Limited Use rules. Privileged access is logged and reviewed.

9. AI processing

Pennny uses AI to classify messages, extract facts, find patterns, match evidence and create drafts. Gmail data is not retained or used by an AI provider for its own purposes or model training. Pennny applies data minimisation, access controls, prompt-injection defences, and human review for consequential actions — no letter is sent without your explicit approval. You are told when you are dealing with Pennny's AI: in Ask and when Pennny drafts a letter for you.

10. The Success Fee

Connecting Gmail does not create a Success Fee. A fee can apply only to a claim you approved and Pennny sent, and only when a company pays you. It is 30% of what the company pays you, plus 21% VAT (36.3% in total); if nothing comes back, you pay nothing.

The company pays you directly; Pennny never holds your money. The payout is established by a matching credit on your bank account or by a company email. Pennny will provide the sending date, the claim reference, your approval record, the amount received, the calculation and the collection method. Pennny cannot charge twice for the same claim.

11. Your right to object

You can object to Pennny using your mailbox to work out whether its fee is due. Write to [ACTION REQUIRED: privacy mailbox] or use the in-app privacy controls.

What stops, and what does not. If Pennny honours your objection it stops recording payments from your mail. That is all it stops. Pennny keeps scanning for new opportunities — that is the service you are paying for and it rests on a different legal basis. Your claims keep running, replies still reach you, and you can still confirm a payment yourself at any time.

Your Article 21 right also covers the other legitimate-interest processing in the Privacy Policy. Pennny will not penalise you for exercising a privacy right. Your duty under the Terms to report a recovery for a claim Pennny sent is separate and continues.

12. Disconnecting Gmail

You can disconnect at Settings → Connections, or revoke access in your Google Account security settings. Pennny detects revocation and stops API access.

Disconnecting stops new Gmail API access; does not cancel Premium; does not revoke a SEPA mandate; and does not remove your duty to report an outcome for a Sent Claim. Findings and claims already made stay, marked as found while connected. Data already synced is deleted after 30 days unless it is evidence on an open claim. Reconnecting inside those 30 days resumes where you left off.

13. Deleting Gmail-derived data

Subject to legal exceptions, you may ask to erase your mailbox data (Settings → Privacy): imported message references, derived facts that are not evidence on an open claim, scan findings and tokens. Pennny may retain limited records where necessary for legal obligations, fraud prevention, disputes or an existing fee, and will state the category, purpose and period. Evidence needed for a fee dispute is kept separate from unrelated Gmail content.

14. Security

Encryption in transit and at rest; secure OAuth-token storage; token rotation and revocation controls; least-privilege staff access; access logging and anomaly detection; vendor security review; secrets management; environment separation; deletion and retention controls; incident response; and periodic penetration and security testing.

15. Google verification and security assessment

Where Pennny requests sensitive or restricted Gmail scopes it completes the applicable Google OAuth verification. Restricted-scope data is processed on Pennny's servers, so an independent security assessment (CASA) applies.

The verification package contains a feature-by-feature scope justification; a video showing when and why each scope is requested; the prominent disclosure and customer controls; the Privacy Policy and Limited Use statement; evidence that narrower scopes were considered; data-flow and retention diagrams; provider and subprocessor details; token security and deletion procedures; and the security-assessment evidence.

16. Consent and audit record

Pennny retains a versioned record of the disclosure shown; the purposes shown; the Terms, Privacy Policy and this notice's versions; the exact scopes requested; the account and timestamp; your action; and connection, refresh and revocation events.

17. Support and complaints

Questions: [ACTION REQUIRED: support mailbox] Privacy requests: [ACTION REQUIRED: privacy mailbox]

You may complain to the Autoriteit Persoonsgegevens. Google Account access can also be reviewed and revoked in your Google security settings.