How AMA Hermes handles data

Operator and intended user

AMA Hermes is operated for AMA COMERCIO LTDA in Brazil. It is a private business integration used by its operator, rather than a service offered to the public.

Data accessed and purpose

The Gmail integration may access message headers, message bodies, sent-mail records and attachments. These data are used for the owner's authorized business functions: reviewing correspondence, extracting relevant business information, reconciling documents, preparing reports and checking authorized outbound messages. Sending mail requires the applicable owner authorization and workflow checks.

The requested Google scopes are gmail.readonly and gmail.send. These scopes provide mailbox-wide technical access; the business-only restriction is an operational policy of the integration.

Processing and sharing

Business data and operational records may be stored on the operator-controlled Hermes server. Selected message content may be submitted to the AI provider configured for an authorized workflow. The currently configured main provider is OpenAI; a configured fallback uses a local gateway for Claude. Provider terms, account settings and technical availability also govern their processing. Provider configuration can change, and this disclosure must be updated when a change affects data handling.

Reports may be delivered to the operator through Telegram. Gmail data are not published on this website. Cloudflare serves these public informational pages and manages the domain; website hosting does not grant Cloudflare access to the Gmail mailbox.

Data transfer must be limited to the information needed for the authorized feature. Gmail data must not be sold, used for advertising, or used to develop or train generalized AI models. The operator must use external providers and settings consistently with the Google API Services User Data Policy, including its Limited Use requirements. This statement does not claim that Google has verified the application.

Storage and retention

Correspondence extracts, attachments, reports, session records and technical receipts can persist on the operator-controlled infrastructure. The integration currently provides no automatic deletion schedule. Retention is controlled by the operator and any applicable business-document requirements. External AI and messaging providers may retain data under their own policies and account settings; revoking Google access does not delete data already retained by these systems.

Access, revocation and deletion

The account owner can revoke the integration through the Google Account third-party connections settings and stop its server workflows. Requests to inspect or delete retained business copies must be handled by the operator, with due regard to required business records and backups. Access revocation and deletion of retained copies are separate actions.

Contact

For access, data-handling or deletion questions, contact the operator using the support email shown on the Google authorization screen. The only intended account user is the operator.