Privacy policy

Rubatt Inc builds autonomous AI agent systems for teams in the United States and the United Kingdom. We are the data controller for everything described on this page. You can reach us at hello@rubatt.com.

If you fill in the contact form we receive your name, email address, and whatever you write in the message. We use it to reply to you and to keep a record of the enquiry. Nothing more.

The form is protected by Cloudflare Turnstile, which checks that a person rather than a script submitted it. We use privacy aware analytics to count page views in aggregate. We do not run advertising trackers and we do not build advertising profiles.

Rubatt Command Center is an internal tool used only by Rubatt Inc. It is not a product we sell, it has no public sign up, and the only people with accounts are Rubatt staff. It runs at agents.rubatt.com behind a login and is excluded from search engines.

What it requests from Google

Command Center requests read only access to the Gmail, Google Calendar and Search Console of the account owner, meaning the Rubatt staff member who connects their own account. It asks for three scopes and no others:

• gmail.metadata, which returns message headers such as sender, subject and date. This scope cannot return message bodies, and we do not request a scope that can.
• calendar.readonly, which returns event times and titles so the tool knows what meetings are coming up.
• webmasters.readonly, which returns Search Console performance data for websites Rubatt owns: clicks, impressions, average position and the search queries that led to them. This is site data, not personal data, and the scope is read only.

What it does with that data

The data is used for one purpose: generating internal business briefs for the account owner. A brief is a short summary of the working day that counts unread replies from people already in our own records, lists upcoming meetings, reports how our own website is performing in search, and reports numbers that come from our own database. Nothing else is derived from it, and nothing generated is shown to anyone outside Rubatt Inc.

What it does not do

• We do not share, sell, rent or transfer Google user data to third parties.
• We do not use Google user data to train, retrain or improve AI or machine learning models, ours or anyone else's.
• We do not use it for advertising, profiling or any form of marketing.
• We do not read message bodies, and the scope we request cannot return them.
• We do not let humans read this data except the account owner it belongs to.

How it is stored

OAuth tokens are stored encrypted at rest. Refresh tokens are encrypted with a key held only on the server and never leave it, are never written to logs, and are never returned by any API response. Message headers and event details are used to compute a brief and are not kept as a separate copy of your mailbox or calendar. Access is limited to the account owner, over an authenticated session on an encrypted connection.

Rubatt Command Center's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In practice that means the four commitments above are binding, not aspirational: the data is used only to provide and improve the user facing feature the owner connected it for, it is not transferred to others except as required by law, it is not used for advertising, and no human reads it except where the owner has explicitly asked us to, where it is needed for security, or where the law requires it.

There are two ways to cut Command Center off, and either one is enough.

From your Google Account

Open myaccount.google.com/permissions, find Rubatt Command Center, and choose Remove access. Google invalidates the token immediately and the tool can no longer read anything.

From inside Command Center

Open Settings, find the Google Calendar, Gmail or Search Console card, and press Disconnect. The stored refresh token is deleted from our database at that moment.

To have everything else we hold about you deleted, including contact form submissions, email hello@rubatt.com and we will erase it within 30 days and confirm when it is done. You may also ask for a copy of what we hold, or ask us to correct it.

Contact enquiries are kept for as long as we are in conversation and for up to 24 months afterwards, so we can pick up where we left off. Briefs generated by Command Center are kept for 90 days and then removed. Refresh tokens are kept until you disconnect or revoke them.

Depending on where you live you may have the right to access, correct, export or delete your personal data, to object to processing, or to withdraw consent. Write to hello@rubatt.com and we will act on it. We do not charge for this and we do not make it difficult.

If we change what we collect or what we do with it, we will update this page and move the date at the top. Material changes to how Google user data is handled will be reflected here before the change takes effect.

Questions: hello@rubatt.com. See also our terms of service.