Privacy Policy

Last updated: November 1, 2026

This policy explains how Controller Agent handles the information it receives from Google when someone at your company connects a Gmail or Google Workspace mailbox.

1. Who we are and what this policy covers

Controller Agent (controlleragentx.com) is based in Milton, Ontario, Canada.

Our Controller Agent service is an AI accounting assistant for companies that use Acumatica ERP: it reads the invoices, statements and other documents a company receives by email and prepares them as draft accounting entries for the company to review and approve.

This policy explains what information Controller Agent receives from Google when someone at your company connects a Gmail or Google Workspace mailbox, and how we access, use, store, protect, share, keep and delete it.

In this policy, "Controller Agent", "we", "us" and "our" mean the Controller Agent service and the people who operate it; "you" means the company that uses Controller Agent and the people at that company who use it.

Controller Agent is a service for businesses. It is not meant for personal use and is not directed to children.

2. The Google user data we access

Controller Agent asks Google for one permission: read-only access to Gmail (https://www.googleapis.com/auth/gmail.readonly). Only an approver at your company can connect a mailbox.

We do not ask Google for permission to send, change, label, move or delete your email, and Controller Agent has no function that does any of these. If Google's answer grants Controller Agent more than read-only access, we refuse the connection and store none of the access it granted.

We do not ask for access to your contacts, calendar, Drive files or any other Google service.

We read only the Gmail labels chosen for the mailbox in Controller Agent (your Inbox if none is chosen), and only mail received inside the date range set for it. The start of the range is applied by calendar day, so mail from up to one day earlier can be included.

For each message in those labels we read its sender, recipients, subject, date, text and attachments, and, except for a bank-statement mailbox (section 3), we keep a copy of the original message and its attachments.

We also keep the access and refresh tokens Google gives us, so that the connection keeps working, and the list of permissions Google granted.

3. How we use it

We use your Gmail data only to provide the features you see in Controller Agent: showing your mail and its documents for review, reading invoices and statements into draft accounting entries for your own company, and entering the entries you or your company approve into your company's own Acumatica.

Each document is linked to one of your companies (the one its mailbox is linked to when the document arrives), and is only ever entered into that company.

If your company marks a mailbox as a bank-statement mailbox, the statement files it receives are used only for that company's bank reconciliation. For that mailbox we keep the statement details and transactions read from those files, not a copy of the message.

Controller Agent learns from your own company's documents so that it reads them better, for example where a vendor prints its invoice number on the page. It records where a field sits on the page, not the values printed there. What it learns from documents that came from Gmail stays with your company and is never shared with, or used for, any other company.

We do not use your Gmail data, or anything derived from it, to develop, train or improve general or foundation AI models.

We do not use your Gmail data for advertising, and we do not use it to decide anyone's creditworthiness or for lending.

4. How we use AI to read your documents

To read a document, Controller Agent sends it to our AI model provider, Anthropic: the attachment itself (a PDF or image), its file name, the subject line and sender address of the email it came with, and any text already contained in the PDF.

When Controller Agent reconciles a bank account, the transactions read from a bank-statement mailbox's statement files are also sent to Anthropic to be checked.

For your company, this always goes through Anthropic's commercial service (its API). Anthropic's commercial terms do not allow it to train its models on that content.

Your company's approver chooses whose Anthropic account is used (we can also set it at your company's request): your company's own account (its own API key, billed to your company by Anthropic) or ours (our API key, with the use billed to your company). Before anyone agrees, the screen where a mailbox is connected names the account, or says that nothing is sent until the mailbox is linked to a company.

Mail of our own companies, which we use for testing, may be read through our own Claude subscription, which is under Anthropic's consumer terms and has model training switched off. A customer company's mail is never read that way.

We do not send your Gmail data to any other AI provider.

5. How we share it

We share Gmail data only in these cases:

• with Anthropic, to read your documents, as described in section 4;
• with your company's own Acumatica: values read from a document are used to look up its vendor, orders and receipts there, and when an entry is approved, its values are entered there;
• with Cloudflare, which carries the connections between you and our servers, as described in section 6;
• when it is needed for security, for example to investigate abuse;
• when the law requires it; or
• as part of a merger, acquisition or sale of assets, and only after telling you and asking you first.

We do not sell Gmail data, and we do not give or transfer it to advertising platforms, data brokers or information resellers.

Controller Agent runs on computers that we operate ourselves, and your Gmail data is stored there, not with a cloud hosting provider. If we move it to a hosting provider, we will name that provider in this policy before your data is moved.

6. How we protect it

Controller Agent's connections to Google and to Anthropic are encrypted (HTTPS).

Our service is reached through Cloudflare's network, which carries the connections between you and our servers.

Your mailbox's access and refresh tokens are encrypted (AES-256-GCM) before they are stored.

The text of each message, the stored copy of each original message and each attachment are encrypted (AES-256-GCM) under keys that belong only to you, one for each of your companies, before they are written to disk or to our database, and can be opened only for the company the mail belongs to.

The keys that unlock this encryption are kept in a separate key store on our server, apart from the data they protect.

Other details, such as each message's sender, recipients, subject and date, the values read from your documents and the transactions read from bank statements, are kept in our database so that they can be shown to you and searched.

Each customer's records are kept separate from every other customer's: a request made for one customer cannot read or change another customer's records.

People and automated agents on our side do not read your messages, except:

• when your company asks us in writing to look at specific messages, for example to fix a problem you reported;
• when it is needed to investigate a security issue or abuse; or
• to comply with the law.

We may use counts of how the service is used, never the content of your messages, for our internal operations.

Inside Controller Agent, a person or agent on our side can open a message only by naming one of the reasons above (or, for our re-encryption job, which shows the content to no one, an approved maintenance run) and an approval recorded beforehand. Every opening, and every refusal of an identified caller, is written to an access log that cannot be edited, holds no message content and is kept for two years.

Everyone who works with us, including our automated agents, must follow these rules.

7. How long we keep it, and how to stop access and delete it

We keep the mail and documents we read while your company uses Controller Agent, until the mailbox is disconnected and deleted.

Stop our access

You can stop our access at any time in your Google Account at https://myaccount.google.com/permissions. After that we can no longer read your mailbox. The copies we already hold stay until they are deleted as described below.

Delete what we hold

An approver at your company can press Disconnect and delete on a mailbox in Controller Agent. We then withdraw our access at Google (unless the same address is still connected to Controller Agent through another mailbox) and delete, at once, every copy we hold of that mailbox's mail: the messages, their attachments, the values read from them and their review cards. A confirmation lists what was deleted; if Google did not confirm the withdrawal, it says so, and you can remove our access in your Google Account. This cannot be undone; connecting the same address later starts with none of its earlier mail.

What stays after a deletion

A few records stay: the entries already made in your company's Acumatica (your own accounting records, which you void or delete in Acumatica); our record of each entry we made there, with its values, so that the same bill is never entered twice; what Controller Agent learned about where a vendor prints each field (positions on the page, never the values); how your company codes each vendor's bills to its accounts (account codes, never amounts); our own references and counts about earlier readings and statement reconciliations, with no values; bank statements already used in your bank reconciliation; and a receipt of the deletion itself, with counts and no content.

When your company stops using Controller Agent, we delete the records that remain for it, after any export period set in your agreement with us (except our access log, which is kept for its two years, section 6).

Our record of who agreed to the connect screen's disclosure, which version and when, is deleted with the mailbox. Our access log (section 6) is kept for its two years even after a mailbox is deleted, and it holds no message content.

To ask us to delete your data, or for help with any of this, contact us (section 11).

8. Your choices and rights

Before any mailbox is connected, Controller Agent shows the approver what it reads, why, who receives it, how long it is kept and how to delete it, and it connects only after the approver ticks to agree.

Your company chooses which labels and dates we read, and you can stop our access or delete a mailbox's data at any time, as described in section 7.

If a data protection law gives you rights over your personal information, such as to see, correct or delete it, contact us and we will respond as that law requires.

9. Google API Services User Data Policy and Limited Use

10. Changes to this policy

If we change this policy, we will post the new version on this page with a new date. If a change would let us use Google user data in a new way, we will ask for your consent before we use your data that way.

11. Contact us

Questions about this policy or about how we handle your data, and requests to delete it: hello@controlleragentx.com.